Analysis Overview
SHA256
ea40d05c81d27ac61843cabdbaf45a81347ae058d1229300313a17b6143f35e3
Threat Level: Known bad
The file ea40d05c81d27ac61843cabdbaf45a81347ae058d1229300313a17b6143f35e3 was found to be: Known bad.
Malicious Activity Summary
Socelars payload
GCleaner
Socelars
Process spawned unexpected child process
Checks for common network interception software
Drops file in Drivers directory
Downloads MZ/PE file
Executes dropped EXE
Reads user/profile data of web browsers
Checks computer location settings
Loads dropped DLL
Legitimate hosting services abused for malware hosting/C2
Adds Run key to start application
Drops file in Program Files directory
Enumerates physical storage devices
Program crash
Enumerates system info in registry
Suspicious use of FindShellTrayWindow
Kills process with taskkill
Script User-Agent
Suspicious use of SendNotifyMessage
Modifies system certificate store
Suspicious use of SetWindowsHookEx
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Modifies registry class
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2023-02-24 13:04
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2023-02-24 13:04
Reported
2023-02-24 13:06
Platform
win10v2004-20230220-en
Max time kernel
150s
Max time network
153s
Command Line
Signatures
GCleaner
Process spawned unexpected child process
| Description | Indicator | Process | Target |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\rundll32.exe |
Socelars
Socelars payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Checks for common network interception software
Downloads MZ/PE file
Drops file in Drivers directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\system32\drivers\etc\hosts | C:\Users\Admin\AppData\Local\Temp\is-U8CHP.tmp\Bolt.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\is-U8CHP.tmp\Bolt.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\c3-1d3c7-2f5-ad193-fd73a7157fc8b\Hagunefushe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\wclvndjg.2id\chenp.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\2k5gyh1v.qvf\gcleaner.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\is-5I7JH.tmp\ea40d05c81d27ac61843cabdbaf45a81347ae058d1229300313a17b6143f35e3.tmp | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Reads user/profile data of web browsers
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Common Files\\Hagunefushe.exe\"" | C:\Users\Admin\AppData\Local\Temp\is-U8CHP.tmp\Bolt.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js | C:\Users\Admin\AppData\Local\Temp\jav0kyrl.pg1\handdiy_3.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230224140437.pma | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe | N/A |
| File created | C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html | C:\Users\Admin\AppData\Local\Temp\jav0kyrl.pg1\handdiy_3.exe | N/A |
| File created | C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js | C:\Users\Admin\AppData\Local\Temp\jav0kyrl.pg1\handdiy_3.exe | N/A |
| File created | C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\0ff94ee3-e0b7-4852-83d2-80c58b1d57fb.tmp | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe | N/A |
| File created | C:\Program Files (x86)\Common Files\Hagunefushe.exe.config | C:\Users\Admin\AppData\Local\Temp\is-U8CHP.tmp\Bolt.exe | N/A |
| File created | C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png | C:\Users\Admin\AppData\Local\Temp\jav0kyrl.pg1\handdiy_3.exe | N/A |
| File created | C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js | C:\Users\Admin\AppData\Local\Temp\jav0kyrl.pg1\handdiy_3.exe | N/A |
| File created | C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js | C:\Users\Admin\AppData\Local\Temp\jav0kyrl.pg1\handdiy_3.exe | N/A |
| File created | C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js | C:\Users\Admin\AppData\Local\Temp\jav0kyrl.pg1\handdiy_3.exe | N/A |
| File created | C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js | C:\Users\Admin\AppData\Local\Temp\jav0kyrl.pg1\handdiy_3.exe | N/A |
| File created | C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json | C:\Users\Admin\AppData\Local\Temp\jav0kyrl.pg1\handdiy_3.exe | N/A |
| File created | C:\Program Files\Common Files\VDVTHEWUMR\poweroff.exe | C:\Users\Admin\AppData\Local\Temp\is-U8CHP.tmp\Bolt.exe | N/A |
| File created | C:\Program Files (x86)\Common Files\Hagunefushe.exe | C:\Users\Admin\AppData\Local\Temp\is-U8CHP.tmp\Bolt.exe | N/A |
| File created | C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js | C:\Users\Admin\AppData\Local\Temp\jav0kyrl.pg1\handdiy_3.exe | N/A |
Enumerates physical storage devices
Program crash
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133217210782098617" | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000002000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 | C:\Users\Admin\AppData\Local\Temp\c3-1d3c7-2f5-ad193-fd73a7157fc8b\Hagunefushe.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A | C:\Users\Admin\AppData\Local\Temp\bd-4bbd6-b2d-70d84-4e1d8aabf9980\Hagunefushe.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 | C:\Users\Admin\AppData\Local\Temp\bd-4bbd6-b2d-70d84-4e1d8aabf9980\Hagunefushe.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A | C:\Users\Admin\AppData\Local\Temp\c3-1d3c7-2f5-ad193-fd73a7157fc8b\Hagunefushe.exe | N/A |
Script User-Agent
| Description | Indicator | Process | Target |
| HTTP User-Agent header | Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) | N/A | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\wclvndjg.2id\chenp.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\wclvndjg.2id\chenp.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\wclvndjg.2id\chenp.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\wclvndjg.2id\chenp.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\ea40d05c81d27ac61843cabdbaf45a81347ae058d1229300313a17b6143f35e3.exe
"C:\Users\Admin\AppData\Local\Temp\ea40d05c81d27ac61843cabdbaf45a81347ae058d1229300313a17b6143f35e3.exe"
C:\Users\Admin\AppData\Local\Temp\is-5I7JH.tmp\ea40d05c81d27ac61843cabdbaf45a81347ae058d1229300313a17b6143f35e3.tmp
"C:\Users\Admin\AppData\Local\Temp\is-5I7JH.tmp\ea40d05c81d27ac61843cabdbaf45a81347ae058d1229300313a17b6143f35e3.tmp" /SL5="$90054,139494,55808,C:\Users\Admin\AppData\Local\Temp\ea40d05c81d27ac61843cabdbaf45a81347ae058d1229300313a17b6143f35e3.exe"
C:\Users\Admin\AppData\Local\Temp\is-U8CHP.tmp\Bolt.exe
"C:\Users\Admin\AppData\Local\Temp\is-U8CHP.tmp\Bolt.exe" /S /UID=95
C:\Users\Admin\AppData\Local\Temp\c3-1d3c7-2f5-ad193-fd73a7157fc8b\Hagunefushe.exe
"C:\Users\Admin\AppData\Local\Temp\c3-1d3c7-2f5-ad193-fd73a7157fc8b\Hagunefushe.exe"
C:\Users\Admin\AppData\Local\Temp\bd-4bbd6-b2d-70d84-4e1d8aabf9980\Hagunefushe.exe
"C:\Users\Admin\AppData\Local\Temp\bd-4bbd6-b2d-70d84-4e1d8aabf9980\Hagunefushe.exe"
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2k5gyh1v.qvf\gcleaner.exe /mixfive & exit
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab60846f8,0x7ffab6084708,0x7ffab6084718
C:\Users\Admin\AppData\Local\Temp\2k5gyh1v.qvf\gcleaner.exe
C:\Users\Admin\AppData\Local\Temp\2k5gyh1v.qvf\gcleaner.exe /mixfive
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6880 -ip 6880
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 452
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jav0kyrl.pg1\handdiy_3.exe & exit
C:\Users\Admin\AppData\Local\Temp\jav0kyrl.pg1\handdiy_3.exe
C:\Users\Admin\AppData\Local\Temp\jav0kyrl.pg1\handdiy_3.exe
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,9087582463470434183,9788093888786374635,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,9087582463470434183,9788093888786374635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,9087582463470434183,9788093888786374635,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wclvndjg.2id\chenp.exe & exit
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 6880 -ip 6880
C:\Users\Admin\AppData\Local\Temp\wclvndjg.2id\chenp.exe
C:\Users\Admin\AppData\Local\Temp\wclvndjg.2id\chenp.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 764
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9087582463470434183,9788093888786374635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9087582463470434183,9788093888786374635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
C:\Users\Admin\AppData\Local\Temp\wclvndjg.2id\chenp.exe
"C:\Users\Admin\AppData\Local\Temp\wclvndjg.2id\chenp.exe" -h
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 6880 -ip 6880
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 764
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6880 -ip 6880
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 764
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9087582463470434183,9788093888786374635,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 6880 -ip 6880
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 796
C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6880 -ip 6880
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 1000
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5488 -ip 5488
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5488 -s 604
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 6880 -ip 6880
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 1020
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 6880 -ip 6880
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 1088
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffab1ba9758,0x7ffab1ba9768,0x7ffab1ba9778
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 6880 -ip 6880
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9087582463470434183,9788093888786374635,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9087582463470434183,9788093888786374635,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 1380
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9087582463470434183,9788093888786374635,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9087582463470434183,9788093888786374635,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\2k5gyh1v.qvf\gcleaner.exe" & exit
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 6880 -ip 6880
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 1420
C:\Windows\SysWOW64\taskkill.exe
taskkill /im "gcleaner.exe" /f
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1796,i,7865229617318710322,2886640948594334044,131072 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1796,i,7865229617318710322,2886640948594334044,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1796,i,7865229617318710322,2886640948594334044,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3172 --field-trial-handle=1796,i,7865229617318710322,2886640948594334044,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3208 --field-trial-handle=1796,i,7865229617318710322,2886640948594334044,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3824 --field-trial-handle=1796,i,7865229617318710322,2886640948594334044,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4632 --field-trial-handle=1796,i,7865229617318710322,2886640948594334044,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4852 --field-trial-handle=1796,i,7865229617318710322,2886640948594334044,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5004 --field-trial-handle=1796,i,7865229617318710322,2886640948594334044,131072 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,9087582463470434183,9788093888786374635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff699e55460,0x7ff699e55470,0x7ff699e55480
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5192 --field-trial-handle=1796,i,7865229617318710322,2886640948594334044,131072 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,9087582463470434183,9788093888786374635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 --field-trial-handle=1796,i,7865229617318710322,2886640948594334044,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 --field-trial-handle=1796,i,7865229617318710322,2886640948594334044,131072 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,9087582463470434183,9788093888786374635,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2508 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4584 --field-trial-handle=1796,i,7865229617318710322,2886640948594334044,131072 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | s3.eu-central-1.wasabisys.com | udp |
| NL | 130.117.252.21:80 | s3.eu-central-1.wasabisys.com | tcp |
| US | 8.8.8.8:53 | 21.252.117.130.in-addr.arpa | udp |
| US | 8.8.8.8:53 | connectini.net | udp |
| GB | 37.230.138.123:443 | connectini.net | tcp |
| US | 8.8.8.8:53 | n8w5.c12.e2-1.dev | udp |
| US | 8.8.8.8:53 | s3.eu-central-1.wasabisys.com | udp |
| US | 8.8.8.8:53 | wewewe.s3.eu-central-1.amazonaws.com | udp |
| NL | 130.117.252.17:443 | s3.eu-central-1.wasabisys.com | tcp |
| NL | 130.117.252.17:443 | s3.eu-central-1.wasabisys.com | tcp |
| DE | 52.219.170.230:443 | wewewe.s3.eu-central-1.amazonaws.com | tcp |
| US | 8.8.8.8:53 | 360devtracking.com | udp |
| GB | 37.230.138.66:80 | 360devtracking.com | tcp |
| US | 8.8.8.8:53 | 123.138.230.37.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.252.117.130.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 230.170.219.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 66.138.230.37.in-addr.arpa | udp |
| US | 8.8.8.8:53 | google.com | udp |
| NL | 142.251.39.100:80 | www.google.com | tcp |
| US | 8.8.8.8:53 | connectini.net | udp |
| GB | 37.230.138.123:443 | connectini.net | tcp |
| GB | 37.230.138.123:443 | connectini.net | tcp |
| GB | 37.230.138.66:80 | 360devtracking.com | tcp |
| NL | 45.12.253.74:80 | 45.12.253.74 | tcp |
| US | 8.8.8.8:53 | iplogger.org | udp |
| DE | 148.251.234.83:443 | iplogger.org | tcp |
| US | 8.8.8.8:53 | htagzdownload.pw | udp |
| US | 8.8.8.8:53 | 100.39.251.142.in-addr.arpa | udp |
| BE | 35.205.61.67:80 | htagzdownload.pw | tcp |
| US | 8.8.8.8:53 | www.cpasdrole.com | udp |
| US | 188.114.97.0:80 | www.cpasdrole.com | tcp |
| BE | 35.205.61.67:80 | htagzdownload.pw | tcp |
| US | 8.8.8.8:53 | www.countlist.top | udp |
| US | 8.8.8.8:53 | 74.253.12.45.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.234.251.148.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.97.114.188.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.61.205.35.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.ippfinfo.top | udp |
| US | 8.8.8.8:53 | a.dowgmua.com | udp |
| US | 188.114.97.0:443 | a.dowgmua.com | tcp |
| DE | 178.18.252.110:443 | www.ippfinfo.top | tcp |
| US | 8.8.8.8:53 | ocsp.trust-provider.cn | udp |
| US | 8.8.8.8:53 | b.dowgmub.com | udp |
| US | 172.67.140.42:443 | b.dowgmub.com | tcp |
| US | 8.8.8.8:53 | 110.252.18.178.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 188.155.64.172.in-addr.arpa | udp |
| NL | 47.246.48.208:80 | ocsp.trust-provider.cn | tcp |
| DE | 148.251.234.83:443 | iplogger.org | tcp |
| US | 8.8.8.8:53 | nav.smartscreen.msiserver.lan | udp |
| US | 8.8.8.8:53 | 42.140.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 208.48.246.47.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 234.95.206.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.profitabletrustednetwork.com | udp |
| US | 173.233.139.164:443 | www.profitabletrustednetwork.com | tcp |
| US | 173.233.139.164:443 | www.profitabletrustednetwork.com | tcp |
| US | 8.8.8.8:53 | xv.yxzgamen.com | udp |
| US | 188.114.97.0:443 | xv.yxzgamen.com | tcp |
| US | 8.8.8.8:53 | simplewebanalysis.com | udp |
| IN | 3.7.139.166:443 | simplewebanalysis.com | tcp |
| US | 8.8.8.8:53 | 250.255.255.239.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 164.139.233.173.in-addr.arpa | udp |
| US | 8.8.8.8:53 | brevocalvia.com | udp |
| US | 172.67.163.247:443 | brevocalvia.com | tcp |
| US | 172.67.163.247:443 | brevocalvia.com | udp |
| US | 8.8.8.8:53 | tartator.com | udp |
| US | 8.8.8.8:53 | cdnjs.cloudflare.com | udp |
| DE | 178.162.196.156:443 | tartator.com | tcp |
| US | 104.17.25.14:443 | cdnjs.cloudflare.com | tcp |
| US | 104.17.25.14:443 | cdnjs.cloudflare.com | tcp |
| US | 8.8.8.8:53 | 166.139.7.3.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 247.163.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.25.17.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 156.196.162.178.in-addr.arpa | udp |
| BE | 35.205.61.67:80 | htagzdownload.pw | tcp |
| US | 8.8.8.8:53 | arc.srv.lan | udp |
| NL | 45.12.253.56:80 | 45.12.253.56 | tcp |
| US | 8.8.8.8:53 | ntp.srv.lan | udp |
| US | 8.8.8.8:53 | nav.smartscreen.msiserver.lan | udp |
| US | 8.8.8.8:53 | 56.253.12.45.in-addr.arpa | udp |
| BE | 35.205.61.67:80 | htagzdownload.pw | tcp |
| US | 8.8.8.8:53 | edge.msiserver.lan | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | accounts.server.lan | udp |
| US | 8.8.8.8:53 | 195.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 42.36.251.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ferramentasadicionais.s3.sa-east-1.amazonaws.com | udp |
| US | 8.8.8.8:53 | m.facebook.com | udp |
| US | 157.240.24.35:443 | m.facebook.com | tcp |
| BR | 52.95.163.122:443 | ferramentasadicionais.s3.sa-east-1.amazonaws.com | tcp |
| BR | 52.95.163.122:443 | ferramentasadicionais.s3.sa-east-1.amazonaws.com | tcp |
| US | 157.240.24.35:443 | m.facebook.com | udp |
| US | 8.8.8.8:53 | 35.24.240.157.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 122.163.95.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.evoori.com | udp |
| US | 188.114.97.0:80 | www.evoori.com | tcp |
| US | 8.8.8.8:53 | secure.facebook.com | udp |
| US | 157.240.24.15:443 | secure.facebook.com | tcp |
| US | 8.8.8.8:53 | www.facebook.com | udp |
| NL | 157.240.247.35:443 | www.facebook.com | tcp |
| US | 8.8.8.8:53 | 15.24.240.157.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 35.247.240.157.in-addr.arpa | udp |
| US | 8.8.8.8:53 | clients2.google.com | udp |
| NL | 142.251.36.46:443 | clients2.google.com | udp |
| US | 8.8.8.8:53 | 46.36.251.142.in-addr.arpa | udp |
| BE | 35.205.61.67:80 | htagzdownload.pw | tcp |
| US | 8.8.8.8:53 | 176.122.125.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 164.2.77.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | accounts.server.lan | udp |
| US | 20.189.173.6:443 | tcp | |
| US | 13.107.4.50:80 | tcp | |
| US | 13.107.4.50:80 | tcp | |
| US | 13.107.4.50:80 | tcp | |
| BE | 35.205.61.67:80 | htagzdownload.pw | tcp |
| US | 8.8.8.8:53 | 44.8.109.52.in-addr.arpa | udp |
| BE | 35.205.61.67:80 | htagzdownload.pw | tcp |
| US | 8.8.8.8:53 | accounts.server.lan | udp |
| BE | 35.205.61.67:80 | htagzdownload.pw | tcp |
| NL | 173.223.113.164:443 | tcp | |
| NL | 173.223.113.131:80 | tcp | |
| US | 131.253.33.203:80 | tcp | |
| US | 93.184.220.29:80 | tcp | |
| NL | 88.221.25.155:80 | tcp | |
| BE | 35.205.61.67:80 | htagzdownload.pw | tcp |
| BE | 35.205.61.67:80 | htagzdownload.pw | tcp |
| US | 8.8.8.8:53 | edge.msiserver.lan | udp |
| US | 8.8.8.8:53 | update.msiservers.lan | udp |
| US | 157.240.24.35:443 | m.facebook.com | udp |
| US | 157.240.24.15:443 | secure.facebook.com | udp |
| NL | 157.240.247.35:443 | www.facebook.com | udp |
| BE | 35.205.61.67:80 | htagzdownload.pw | tcp |
| BE | 35.205.61.67:80 | htagzdownload.pw | tcp |
| BE | 35.205.61.67:80 | htagzdownload.pw | tcp |
| BE | 35.205.61.67:80 | htagzdownload.pw | tcp |
| BE | 35.205.61.67:80 | htagzdownload.pw | tcp |
| BE | 35.205.61.67:80 | htagzdownload.pw | tcp |
| BE | 35.205.61.67:80 | htagzdownload.pw | tcp |
| US | 8.8.8.8:53 | accounts.server.lan | udp |
| US | 8.8.8.8:53 | www.listfcbt.top | udp |
| US | 8.8.8.8:53 | m.facebook.com | udp |
| US | 157.240.24.35:443 | m.facebook.com | udp |
| US | 8.8.8.8:53 | www.typefdq.xyz | udp |
| US | 8.8.8.8:53 | secure.facebook.com | udp |
| US | 157.240.24.15:443 | secure.facebook.com | udp |
| US | 8.8.8.8:53 | www.facebook.com | udp |
| NL | 157.240.247.35:443 | www.facebook.com | udp |
| BE | 35.205.61.67:80 | htagzdownload.pw | tcp |
Files
memory/4944-133-0x0000000000400000-0x0000000000414000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\is-5I7JH.tmp\ea40d05c81d27ac61843cabdbaf45a81347ae058d1229300313a17b6143f35e3.tmp
| MD5 | c343f4d888e76856f44b0af206e09064 |
| SHA1 | dad44447f0efcab9536f8957b0b6699182b457da |
| SHA256 | af52a5e4a63430e9f657ce29e2124090106842aba3913274f152249d058cb440 |
| SHA512 | fa6fa1e2273ee09a71b66c91f15346609de6a10bb2c15a35acc27ff52e079d4f23835813293d78c3aa1f2a46a62e7916657f250cd3ab08dc6f65406152644b1e |
C:\Users\Admin\AppData\Local\Temp\is-U8CHP.tmp\idp.dll
| MD5 | 8f995688085bced38ba7795f60a5e1d3 |
| SHA1 | 5b1ad67a149c05c50d6e388527af5c8a0af4343a |
| SHA256 | 203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006 |
| SHA512 | 043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35 |
memory/4280-146-0x0000000002130000-0x0000000002131000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\is-U8CHP.tmp\Bolt.exe
| MD5 | f6c312d7bc53140df83864221e8ebee1 |
| SHA1 | da7ad1f5fa18bf00c3352cb510554b061bbfe04f |
| SHA256 | e119a3b5fcb628740e8313a44d312296fd03771d9ed727b10b58aae29192a2db |
| SHA512 | 38c9d9b32fd1ee096f23ee62b5e64cc962f21a85d07ea32860d45d5e8249474d28239238a635cf69db30fd3f035c7c93dcce264a9e8288dbef70ffe2a493922a |
C:\Users\Admin\AppData\Local\Temp\is-U8CHP.tmp\Bolt.exe
| MD5 | f6c312d7bc53140df83864221e8ebee1 |
| SHA1 | da7ad1f5fa18bf00c3352cb510554b061bbfe04f |
| SHA256 | e119a3b5fcb628740e8313a44d312296fd03771d9ed727b10b58aae29192a2db |
| SHA512 | 38c9d9b32fd1ee096f23ee62b5e64cc962f21a85d07ea32860d45d5e8249474d28239238a635cf69db30fd3f035c7c93dcce264a9e8288dbef70ffe2a493922a |
memory/4488-151-0x00000000008A0000-0x0000000000936000-memory.dmp
memory/4488-152-0x000000001B530000-0x000000001B540000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\c3-1d3c7-2f5-ad193-fd73a7157fc8b\Hagunefushe.exe
| MD5 | fba3b4b12a0c6c9924132b149147a0a2 |
| SHA1 | a776068968a89ff9503e794e4ab0c04bbee6e5f6 |
| SHA256 | 7403a6d53688cddeb84997cf90f616a3f25e79681b9c47074b5534f4e8b45890 |
| SHA512 | a1a41956ee97b4e590795a319d357f7f1b22115f5f663211af71cb14ffae879cb0fda743c7a016bb1a479d64dacee2f865e67f29d589d30d10b928a2bbb628ee |
C:\Users\Admin\AppData\Local\Temp\bd-4bbd6-b2d-70d84-4e1d8aabf9980\Hagunefushe.exe
| MD5 | 1e8e3939ec32c19b2031d50cc9875084 |
| SHA1 | 83cc7708448c52f5c184cc329fa11f4cfe9c2823 |
| SHA256 | 5988245cd9d0c40bcb12155b966cb8ddd86da1107bca456341de5bd5fb560808 |
| SHA512 | 0d3ad7c0865e421fad34e27a47108fdc9e359f8603c4c01f6d789d3ead6e6ac5815f979301870f8157fedaf8178ed34873fbff807807d46698249f098fc78caa |
C:\Users\Admin\AppData\Local\Temp\c3-1d3c7-2f5-ad193-fd73a7157fc8b\Hagunefushe.exe
| MD5 | fba3b4b12a0c6c9924132b149147a0a2 |
| SHA1 | a776068968a89ff9503e794e4ab0c04bbee6e5f6 |
| SHA256 | 7403a6d53688cddeb84997cf90f616a3f25e79681b9c47074b5534f4e8b45890 |
| SHA512 | a1a41956ee97b4e590795a319d357f7f1b22115f5f663211af71cb14ffae879cb0fda743c7a016bb1a479d64dacee2f865e67f29d589d30d10b928a2bbb628ee |
C:\Users\Admin\AppData\Local\Temp\c3-1d3c7-2f5-ad193-fd73a7157fc8b\Hagunefushe.exe
| MD5 | fba3b4b12a0c6c9924132b149147a0a2 |
| SHA1 | a776068968a89ff9503e794e4ab0c04bbee6e5f6 |
| SHA256 | 7403a6d53688cddeb84997cf90f616a3f25e79681b9c47074b5534f4e8b45890 |
| SHA512 | a1a41956ee97b4e590795a319d357f7f1b22115f5f663211af71cb14ffae879cb0fda743c7a016bb1a479d64dacee2f865e67f29d589d30d10b928a2bbb628ee |
C:\Users\Admin\AppData\Local\Temp\bd-4bbd6-b2d-70d84-4e1d8aabf9980\Hagunefushe.exe.config
| MD5 | 98d2687aec923f98c37f7cda8de0eb19 |
| SHA1 | f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7 |
| SHA256 | 8a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465 |
| SHA512 | 95c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590 |
C:\Users\Admin\AppData\Local\Temp\bd-4bbd6-b2d-70d84-4e1d8aabf9980\Hagunefushe.exe
| MD5 | 1e8e3939ec32c19b2031d50cc9875084 |
| SHA1 | 83cc7708448c52f5c184cc329fa11f4cfe9c2823 |
| SHA256 | 5988245cd9d0c40bcb12155b966cb8ddd86da1107bca456341de5bd5fb560808 |
| SHA512 | 0d3ad7c0865e421fad34e27a47108fdc9e359f8603c4c01f6d789d3ead6e6ac5815f979301870f8157fedaf8178ed34873fbff807807d46698249f098fc78caa |
C:\Users\Admin\AppData\Local\Temp\bd-4bbd6-b2d-70d84-4e1d8aabf9980\Hagunefushe.exe
| MD5 | 1e8e3939ec32c19b2031d50cc9875084 |
| SHA1 | 83cc7708448c52f5c184cc329fa11f4cfe9c2823 |
| SHA256 | 5988245cd9d0c40bcb12155b966cb8ddd86da1107bca456341de5bd5fb560808 |
| SHA512 | 0d3ad7c0865e421fad34e27a47108fdc9e359f8603c4c01f6d789d3ead6e6ac5815f979301870f8157fedaf8178ed34873fbff807807d46698249f098fc78caa |
C:\Users\Admin\AppData\Local\Temp\c3-1d3c7-2f5-ad193-fd73a7157fc8b\Hagunefushe.exe.config
| MD5 | 98d2687aec923f98c37f7cda8de0eb19 |
| SHA1 | f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7 |
| SHA256 | 8a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465 |
| SHA512 | 95c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590 |
memory/4280-186-0x0000000000400000-0x00000000004BD000-memory.dmp
memory/4944-188-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2692-189-0x0000000000900000-0x000000000097A000-memory.dmp
memory/2172-190-0x0000000000D00000-0x0000000000D6A000-memory.dmp
memory/2692-191-0x00000000010D0000-0x00000000010E0000-memory.dmp
memory/2172-192-0x0000000001720000-0x0000000001730000-memory.dmp
memory/2692-193-0x0000000001240000-0x00000000012A6000-memory.dmp
memory/2692-194-0x000000001BF70000-0x000000001C43E000-memory.dmp
memory/2692-195-0x000000001C5F0000-0x000000001C68C000-memory.dmp
memory/2692-196-0x0000000001120000-0x0000000001128000-memory.dmp
memory/2692-197-0x000000001CFE0000-0x000000001D03E000-memory.dmp
memory/2692-198-0x000000001FD80000-0x000000002008E000-memory.dmp
memory/2692-199-0x00000000010D0000-0x00000000010E0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\c3-1d3c7-2f5-ad193-fd73a7157fc8b\Kenessey.txt
| MD5 | 97384261b8bbf966df16e5ad509922db |
| SHA1 | 2fc42d37fee2c81d767e09fb298b70c748940f86 |
| SHA256 | 9c0d294c05fc1d88d698034609bb81c0c69196327594e4c69d2915c80fd9850c |
| SHA512 | b77fe2d86fbc5bd116d6a073eb447e76a74add3fa0d0b801f97535963241be3cdce1dbcaed603b78f020d0845b2d4bfc892ceb2a7d1c8f1d98abc4812ef5af21 |
memory/2692-202-0x000000001E030000-0x000000001E092000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\2k5gyh1v.qvf\gcleaner.exe
| MD5 | fa57369ccb2c6a49e00abdc729a2507c |
| SHA1 | 3d2b68ba23d411250482e8f62ab532f5d7d1fd6b |
| SHA256 | 623399af649200a0e92da55f00fe0a5e61ec2a665a1b6c289add61cc74ab2c11 |
| SHA512 | 890049f02bac1c73d8008195d7b30c88d5bc8ec732aa862ee69e305355472d6d419eb296280b5d92cc44c7fc470df1faca74495bdd58e80b9046c06ae5133e93 |
C:\Users\Admin\AppData\Local\Temp\2k5gyh1v.qvf\gcleaner.exe
| MD5 | fa57369ccb2c6a49e00abdc729a2507c |
| SHA1 | 3d2b68ba23d411250482e8f62ab532f5d7d1fd6b |
| SHA256 | 623399af649200a0e92da55f00fe0a5e61ec2a665a1b6c289add61cc74ab2c11 |
| SHA512 | 890049f02bac1c73d8008195d7b30c88d5bc8ec732aa862ee69e305355472d6d419eb296280b5d92cc44c7fc470df1faca74495bdd58e80b9046c06ae5133e93 |
C:\Users\Admin\AppData\Local\Temp\jav0kyrl.pg1\handdiy_3.exe
| MD5 | cd2cd260bdc51afa1a429deb289178aa |
| SHA1 | 9aba96c96b13c92bb846e6e3a4f7879b1d4f7a71 |
| SHA256 | ad4e0ba259ac824927b62d57198492fa94c8268f3000432a7fdf727bf67de797 |
| SHA512 | ae7780fcebb1dfe284bfcc99f6a666fedd8fc6968fa85abc8e8ea0ae22c89d0bce63b635732acee271b1d29bb855c91064591ffac57d39ec6344ce242c44aa0d |
C:\Users\Admin\AppData\Local\Temp\jav0kyrl.pg1\handdiy_3.exe
| MD5 | cd2cd260bdc51afa1a429deb289178aa |
| SHA1 | 9aba96c96b13c92bb846e6e3a4f7879b1d4f7a71 |
| SHA256 | ad4e0ba259ac824927b62d57198492fa94c8268f3000432a7fdf727bf67de797 |
| SHA512 | ae7780fcebb1dfe284bfcc99f6a666fedd8fc6968fa85abc8e8ea0ae22c89d0bce63b635732acee271b1d29bb855c91064591ffac57d39ec6344ce242c44aa0d |
memory/6880-212-0x0000000000610000-0x0000000000650000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | aaeb1f5e097ab38083674077b84b8ed6 |
| SHA1 | 7d9191cb2277c30f1147c9d29d75fc8e6aa0a4f2 |
| SHA256 | 1654b27bfaeee49bfe56e0c4c0303418f4887f3ea1933f03cafce10352321aef |
| SHA512 | 130f1b62134626959f69b13e33c42c3182e343d7f0a5b6291f7bb0c2f64b60885f5e6331e1866a4944e9b7b2e49fe798e073316fde23927ede2c348ba0e56eda |
memory/1740-230-0x00007FFAD4360000-0x00007FFAD4361000-memory.dmp
\??\pipe\LOCAL\crashpad_5620_JSVAHTJVEOOKLVKF
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
| MD5 | e5e3377341056643b0494b6842c0b544 |
| SHA1 | d53fd8e256ec9d5cef8ef5387872e544a2df9108 |
| SHA256 | e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25 |
| SHA512 | 83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef |
C:\Users\Admin\AppData\Local\Temp\wclvndjg.2id\chenp.exe
| MD5 | dc719929115e50ed4383bcc7f7182be3 |
| SHA1 | 562e69bdf814c156872fd6ad6a3d0116b0304516 |
| SHA256 | 5b0708551a5c3cf9932c8aea5e890e3f2abe7b7b5911cefebc6155d20692e365 |
| SHA512 | 34b1dda47ff7a20052f582f4874dc35f4e768558baf8727419d5f91ec2f8c6e28d2a6bc0253975e6bac5d45edfa1edd09aabc5339d2caade73418b73096b9404 |
C:\Users\Admin\AppData\Local\Temp\wclvndjg.2id\chenp.exe
| MD5 | dc719929115e50ed4383bcc7f7182be3 |
| SHA1 | 562e69bdf814c156872fd6ad6a3d0116b0304516 |
| SHA256 | 5b0708551a5c3cf9932c8aea5e890e3f2abe7b7b5911cefebc6155d20692e365 |
| SHA512 | 34b1dda47ff7a20052f582f4874dc35f4e768558baf8727419d5f91ec2f8c6e28d2a6bc0253975e6bac5d45edfa1edd09aabc5339d2caade73418b73096b9404 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
| MD5 | 47e94a96372e6f095b8a3fd7edc48ec0 |
| SHA1 | 377b68f34e5964ca8be1b1b0c1507dd7f0e5f005 |
| SHA256 | 15c77bafd922bd085317fd544d0fa129e3b8c814e3ba0d48936366004427732e |
| SHA512 | 5bd63de2e831805b723d7ddf1343c3b721ef5b757d9ab01bf8554ef8e29ac2cc09fa104fc85d530f27d66b67280774b3ebbef6729ea3ab61ce8028ab4ba5bdad |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001
| MD5 | 5af87dfd673ba2115e2fcf5cfdb727ab |
| SHA1 | d5b5bbf396dc291274584ef71f444f420b6056f1 |
| SHA256 | f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4 |
| SHA512 | de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | a7cef41b6d689606ebbc38b17db721ce |
| SHA1 | 2b4b7d0e9fcf788ee0202e607443cc617ab11cc6 |
| SHA256 | 6c2952b1ea9317566bad9cf0e43d9b79567577f48b889d5784cd24b1b8a725ab |
| SHA512 | dd261f69e5e205c74f3823f4a6c0557f69f28cef1a13c5754de7cc69e49a4b0e623e65842b6d3c4a01f0fac4cc03ca9bd576c7dccbcaf6c0142205d0a178ef63 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk
| MD5 | db804934720ee5d9346d18e54359a7fe |
| SHA1 | 106f9a9dc932e87db9392d789a555b28b783b23c |
| SHA256 | 18743348ae9cfbab37ad2be3246850939e3b75c6968eb4f597e250ce92e690c4 |
| SHA512 | 63d1ea260253a284d11ab3d7088bbc49ac72daba0f26729e41b135c48a73c39aac6ffa3e3d0389995b811a80652a0115a61c6b849364e478036aaea022f74668 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
| MD5 | ec8ff3b1ded0246437b1472c69dd1811 |
| SHA1 | d813e874c2524e3a7da6c466c67854ad16800326 |
| SHA256 | e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab |
| SHA512 | e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
| MD5 | cf8858a4fe5ddbb92295b0682c86402a |
| SHA1 | 759bfcf66d02a8a9bda9274a51a3d899b61b838d |
| SHA256 | 8da66c0baa5e21edf507fb5d063c6c1c23e358dcc1016648e6f5d3d4bfc44e9f |
| SHA512 | 5637caeed5d074338de91e56514252e50e97ddb69fb140c57fd5472c3c40c86b113e93af799ea4e006d7587cea030855933a10ca38335fb0296f73637a7fac80 |
C:\Users\Admin\AppData\Local\Temp\wclvndjg.2id\chenp.exe
| MD5 | dc719929115e50ed4383bcc7f7182be3 |
| SHA1 | 562e69bdf814c156872fd6ad6a3d0116b0304516 |
| SHA256 | 5b0708551a5c3cf9932c8aea5e890e3f2abe7b7b5911cefebc6155d20692e365 |
| SHA512 | 34b1dda47ff7a20052f582f4874dc35f4e768558baf8727419d5f91ec2f8c6e28d2a6bc0253975e6bac5d45edfa1edd09aabc5339d2caade73418b73096b9404 |
memory/2692-335-0x00000000010D0000-0x00000000010E0000-memory.dmp
memory/2172-336-0x0000000001720000-0x0000000001730000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\db.dll
| MD5 | 1b20e998d058e813dfc515867d31124f |
| SHA1 | c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f |
| SHA256 | 24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00 |
| SHA512 | 79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6 |
C:\Users\Admin\AppData\Local\Temp\db.dll
| MD5 | 1b20e998d058e813dfc515867d31124f |
| SHA1 | c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f |
| SHA256 | 24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00 |
| SHA512 | 79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6 |
C:\Users\Admin\AppData\Local\Temp\db.dat
| MD5 | 76c3dbb1e9fea62090cdf53dadcbe28e |
| SHA1 | d44b32d04adc810c6df258be85dc6b62bd48a307 |
| SHA256 | 556fd54e5595d222cfa2bd353afa66d8d4d1fbb3003afed604672fceae991860 |
| SHA512 | de4ea57497cf26237430880742f59e8d2a0ac7e7a0b09ed7be590f36fbd08c9ced0ffe46eb69ec2215a9cff55720f24fffcae752cd282250b4da6b75a30b3a1b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 206702161f94c5cd39fadd03f4014d98 |
| SHA1 | bd8bfc144fb5326d21bd1531523d9fb50e1b600a |
| SHA256 | 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167 |
| SHA512 | 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
| MD5 | 197dc7e4f2b9ea921d60c7ed6a24fba5 |
| SHA1 | 77645e400d305337f38f65ea4583be5b28587d51 |
| SHA256 | 9115273717cf8b447c724097e059e3d3ad743bbfdee024bf04564fd034beb76b |
| SHA512 | 4e009121e1ee0ba6b59c5cacb00b91598ea3589e77367ada54241087cfefce0a085ec69cd54fd99951a367ec7177dec0a90e914ff9bade869742dabee01ca0cc |
memory/2692-407-0x00000000010D0000-0x00000000010E0000-memory.dmp
memory/6468-413-0x00007FFAD4360000-0x00007FFAD4361000-memory.dmp
\??\pipe\crashpad_5808_LADTLSVSBVEIWMOG
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
memory/6880-417-0x0000000000400000-0x000000000057B000-memory.dmp
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
| MD5 | 6065f2f2841e056b648742b96f23533c |
| SHA1 | ff00abfc1427177624cc4bf0ada3e0d082f02141 |
| SHA256 | 32aba359f1b91e23a972b738c9d8132d001743afc653bda5a0adeab1648ab78a |
| SHA512 | 87a5d64fdca9cbacb8fdc031db31ac4825e6df7951bdf1652516379404f3aa13ff94578e8887623fd00c358a3c58c81dd0d6d85699482599f7599e05e21fbd76 |
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png
| MD5 | 362695f3dd9c02c83039898198484188 |
| SHA1 | 85dcacc66a106feca7a94a42fc43e08c806a0322 |
| SHA256 | 40cfea52dbc50a8a5c250c63d825dcaad3f76e9588f474b3e035b587c912f4ca |
| SHA512 | a04dc31a6ffc3bb5d56ba0fb03ecf93a88adc7193a384313d2955701bd99441ddf507aa0ddfc61dfc94f10a7e571b3d6a35980e61b06f98dd9eee424dc594a6f |
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js
| MD5 | c31f14d9b1b840e4b9c851cbe843fc8f |
| SHA1 | 205e3a99dc6c0af0e2f4450ebaa49ebde8e76bb4 |
| SHA256 | 03601415885fd5d8967c407f7320d53f4c9ca2ec33bbe767d73a1589c5e36c54 |
| SHA512 | 2c3d7ed5384712a0013a2ebbc526e762f257e32199651192742282a9641946b6aea6235d848b1e8cb3b0f916f85d3708a14717a69cbcf081145bc634d11d75aa |
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js
| MD5 | a09e13ee94d51c524b7e2a728c7d4039 |
| SHA1 | 0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae |
| SHA256 | 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef |
| SHA512 | f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a |
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json
| MD5 | 05bfb082915ee2b59a7f32fa3cc79432 |
| SHA1 | c1acd799ae271bcdde50f30082d25af31c1208c3 |
| SHA256 | 04392a223cc358bc79fcd306504e8e834d6febbff0f3496f2eb8451797d28aa1 |
| SHA512 | 6feea1c8112ac33d117aef3f272b1cc42ec24731c51886ed6f8bc2257b91e4d80089e8ca7ce292cc2f39100a7f662bcc5c37e5622a786f8dc8ea46b8127152f3 |
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html
| MD5 | 9ffe618d587a0685d80e9f8bb7d89d39 |
| SHA1 | 8e9cae42c911027aafae56f9b1a16eb8dd7a739c |
| SHA256 | a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e |
| SHA512 | a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 1452db74ac45078de6c6bd32f3aa99b1 |
| SHA1 | 200fe81bc8e6679de0bc279190c9e68d435af09e |
| SHA256 | dc21d508256295fa02919ef335ea5f4b03f10f0f7dd3c4182d8010d7a45c2fa1 |
| SHA512 | 38797dbfc628beefe878379209f2d9effa741cfb0b621fe517641557e4b1124709b410e6af4c46c9448b51e29f50a085ded7acc87ca6dacb1a32bc91e7a3c41c |
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js
| MD5 | 554f937aa96d2555cdef706b42afbc54 |
| SHA1 | 9eba2c1dc18c6e06ae914b295f35fbe9f259d1aa |
| SHA256 | cd3cce81365dfab13ef73ab8c3995e258ce502412c3fd3822e5c56d18509db47 |
| SHA512 | 8bf4880088e239d46c2ae21c4722f324ec2b2a34509981dde4636d943c0ba262252abbc94c99c4546926294af964d274bfcec99df463e25cdaa5bb3064bcf94a |
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js
| MD5 | 4ff108e4584780dce15d610c142c3e62 |
| SHA1 | 77e4519962e2f6a9fc93342137dbb31c33b76b04 |
| SHA256 | fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a |
| SHA512 | d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2 |
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js
| MD5 | 0f26002ee3b4b4440e5949a969ea7503 |
| SHA1 | 31fc518828fe4894e8077ec5686dce7b1ed281d7 |
| SHA256 | 282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d |
| SHA512 | 4290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11 |
C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js
| MD5 | 23231681d1c6f85fa32e725d6d63b19b |
| SHA1 | f69315530b49ac743b0e012652a3a5efaed94f17 |
| SHA256 | 03164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a |
| SHA512 | 36860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2 |
memory/3192-468-0x00007FFAD2B20000-0x00007FFAD2B21000-memory.dmp
memory/3192-469-0x00007FFAD31F0000-0x00007FFAD31F1000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 285252a2f6327d41eab203dc2f402c67 |
| SHA1 | acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6 |
| SHA256 | 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026 |
| SHA512 | 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | b97c761269d1853d8553324bd17ba3f1 |
| SHA1 | 4dbf36c69d8580e4d7182da0eb4e4f40a4b5b10a |
| SHA256 | 7e60d26e5bfc176feb41afa3e6e7f191ae9599501c5dbaf27c9efe19ab7e456a |
| SHA512 | 1a78c64fff2d5d4cfb688f18a8d9f384dce9fe7c5a3eac5258f1e3cb8d75cac7ff759165d302f613a0f51839f672b2b2704b2382dc56d646c3ac588c660bc88a |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
| MD5 | 99914b932bd37a50b983c5e7c90ae93b |
| SHA1 | bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f |
| SHA256 | 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a |
| SHA512 | 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | d0250cc2a245879249abb66da6c1867e |
| SHA1 | 7b8102ef72bd6ead90c32338244c2f17da413775 |
| SHA256 | 2c7779ea7e0842f02dd15e61b52d10a7e8c86c0fdd36601e984347a77afe4b2f |
| SHA512 | 0d055749a3b34c2dbdbcf1f54fbff6df5b9789a54fcea396b0f90efbb72fd55c3de3c5eb8a418e5bbba2365553cba72e85f421e1877a913bcb2cd48e62d0acc7 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
| MD5 | eac39760dc7e0e64be5dd613a31292a1 |
| SHA1 | d065227a2a8287e3a30f29e1a4d3d254bbd15779 |
| SHA256 | 98df42a89cc8d2da77bb9e3dc57013153f166e2125f5735d0c32b0658610a88e |
| SHA512 | 027106d7b80868fb51f26196f476623a4485929b85e9a7956695eb50f364368f4e8fe802aceb5bb92861fe25a15752d769018e4aace10005631a39504c8cd18a |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 9111edddc71ea6142b373746e690dabb |
| SHA1 | 847f52e7cc8f7f088bce2d66b62f0da252c48e6d |
| SHA256 | 4e763309b7a7e6911d63cf5b1ba79b6ced5c2b23895540bd0caae4e282eb1f16 |
| SHA512 | 589a9ef0b126e787d5bb43d44f92ea685081ee400594a76fc5649a956a668e14c7d33a8f070f1e9be7acc341af1084bf6d5ec101c615293cf83ff0f003fc3ac0 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | ff6c52110001882bdba7d7aa7d268d65 |
| SHA1 | 8595da8c4480a7807725f44feba4f6c716a9ebbe |
| SHA256 | b6e0a4039055c0f016f80704d699579f8506f0b426baa5ff282fbbcf905f9ff6 |
| SHA512 | 441b0e5fbfc92625d98cab7596d7ea9cb5cd56fa6cb346aed5f05bc0c10409e2d7b4fcf81b90f53d5a7ee9c9c88d74a0d41b0b525b0bf18954f4826f1bffa631 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 762adf5a821bd8e88076c06aa9808d23 |
| SHA1 | ef8015e481ccea7cfb2b8ed94ec268fad655df95 |
| SHA256 | 03958224fbb99eb2ad1eb028369ea2ce0a2b6f5795480cfef92cff6e0fa27730 |
| SHA512 | 64c3786660532bd1e16093347e462feb2816b3fc941086d32be97b7d182f5c56d4f6ffb1aa41c8b5e44ff634009ec22b43add28ed4d7f246d30e8994aa4f4463 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 2007a44a050a457fbea4b406b8985550 |
| SHA1 | e1c3c1f7504968d9e5942a7146a0819de5b03927 |
| SHA256 | 4d5f9e453362ab4967a115023f419c92eabcc12cf1ec485fa10d1180e1bc665d |
| SHA512 | 4eeb239eae1689473de3e9ab77429c7d62de8f53cb1434a87805e164bc5a249c557787a207ff27fe1fc7d6e3496e9ff725883fd3d9343910edcde1371aae3cfb |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 4e9e701425e7763c5cea6d026674ca69 |
| SHA1 | 9fd9d594f6f51c63b603c40a739c0568019aae08 |
| SHA256 | 4c141665b74bcaf2a7e6a9df79ffca6269c8ed99ca461bdc38e49d03d43f27ac |
| SHA512 | 05594441e9dde734625860a4693eefed4f058461a9f951c686159187487d846022311a666a8b59e72889b9510b520c3712da88d7a4f27d71d3685d458fbdb090 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | cde74bb6ae4e2d46dad547b382346b0e |
| SHA1 | 197a9fedf2fc39bf449f02b878771bf5d8b05578 |
| SHA256 | d0c39692618f7cb2cef04424c08b58c65123d5af28d5be08f81161be8232a481 |
| SHA512 | 46dbd3aedcc83108252ba2dc4c556c852d05f47cde534c4f1e21466b4602d1bbaa7b2db009b2ba4acfc4e0cf764f67b0bf78dcb7265f783a7217110e144c101f |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 0ccda93ece6e0a6cc66069e9d2cda23e |
| SHA1 | 6070e6a646b6328e27011cb5c655f20fe6e14ebb |
| SHA256 | 28f1f8874786370d5410f08a84259f12a06f510f01dbc6f116978a194005cb31 |
| SHA512 | e28d35ae63335cfab0143e14415006edd1049b6369079deec75df3f7248601fdc8f929e02237dca67132878d7eb2adaadd98937eefca66d4160afe2f7084dca8 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 1013be15801c2d5c4e129171f255b820 |
| SHA1 | da1bb838a36c51acdcffc535bd9742360e5b1712 |
| SHA256 | edc307c23b4bb035d849a45bd1e60884a1fc5d203c92ceb8603a88210328ab27 |
| SHA512 | 97a3b1b706cc1ce897cdda15365a91c6262e9bdd8839724261b2b0d5e3105680282af4f7828b3a098789c01458fc2062dc2df751e289fe3e85301b37e9ad455b |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | 98ff43780a655b2d0d653127ecb280c8 |
| SHA1 | 9dfd240a5db28e3bdb592192871044bdadd2a062 |
| SHA256 | 39c3b247faf9237ecee134238f718d4d1aaf4a1ba617b7d75933caa64f6ea355 |
| SHA512 | 4c45a0cdbf127ccd98fef4d81b8b293eb2e7e1979f3f17430f4c07fad4865226cfdc8494e23878d0757e9e9af92280528a49dd8117836e505b83bac88d01f490 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | eee9429b4236fd74fb9bcde540a81575 |
| SHA1 | 8a3ff30788d545f169407a11bc363755ba2b6f71 |
| SHA256 | b60a48828344a29e5261815b840c171120e1bc6a3769483a785b935a298bbe00 |
| SHA512 | 2f750471f0a95af6b5b0343e3591db2fb021d0f4e910f3b219478f587ab281b871b61e7bc07e044f9dc235ecc53ca4b106b516cee0315cb4bbbc36f008d8854e |
memory/2740-640-0x0000026F01310000-0x0000026F01311000-memory.dmp
memory/2740-639-0x0000026F01310000-0x0000026F01311000-memory.dmp
memory/2740-641-0x0000026F01310000-0x0000026F01311000-memory.dmp
memory/2740-645-0x0000026F01310000-0x0000026F01311000-memory.dmp
memory/2740-647-0x0000026F01310000-0x0000026F01311000-memory.dmp
memory/2740-646-0x0000026F01310000-0x0000026F01311000-memory.dmp
memory/2740-648-0x0000026F01310000-0x0000026F01311000-memory.dmp
memory/2740-650-0x0000026F01310000-0x0000026F01311000-memory.dmp
memory/2740-649-0x0000026F01310000-0x0000026F01311000-memory.dmp
memory/2740-651-0x0000026F01310000-0x0000026F01311000-memory.dmp