Malware Analysis Report

2024-12-08 01:57

Sample ID 230307-svygqaaa4x
Target ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059
SHA256 ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059
Tags
gcleaner socelars evasion loader persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059

Threat Level: Known bad

The file ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059 was found to be: Known bad.

Malicious Activity Summary

gcleaner socelars evasion loader persistence spyware stealer

Socelars

GCleaner

Socelars payload

Process spawned unexpected child process

Checks for common network interception software

Downloads MZ/PE file

Drops file in Drivers directory

Reads user/profile data of web browsers

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

Drops file in Program Files directory

Enumerates physical storage devices

Program crash

Script User-Agent

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Modifies data under HKEY_USERS

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Kills process with taskkill

Suspicious use of SetWindowsHookEx

Modifies registry class

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-03-07 15:27

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-03-07 15:27

Reported

2023-03-07 15:29

Platform

win10v2004-20230221-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.exe"

Signatures

GCleaner

loader gcleaner

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\rundll32.exe

Socelars

stealer socelars

Socelars payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks for common network interception software

evasion

Downloads MZ/PE file

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\is-G2E37.tmp\Flabs1.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\is-G2E37.tmp\Flabs1.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\kgfvacuj.3yu\chenp.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\csniqjcr.zov\gcleaner.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Media Player\\Raladypaka.exe\"" C:\Users\Admin\AppData\Local\Temp\is-G2E37.tmp\Flabs1.exe N/A

Legitimate hosting services abused for malware hosting/C2

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
File created C:\Program Files (x86)\Windows Media Player\Raladypaka.exe C:\Users\Admin\AppData\Local\Temp\is-G2E37.tmp\Flabs1.exe N/A
File opened for modification C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230307162751.pma C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A
File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
File created C:\Program Files\Windows Media Player\CNGBYKENEQ\poweroff.exe C:\Users\Admin\AppData\Local\Temp\is-G2E37.tmp\Flabs1.exe N/A
File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
File created C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\b3e195fa-371c-4a83-8b5a-7d2ecb7e749f.tmp C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A
File created C:\Program Files (x86)\Windows Media Player\Raladypaka.exe.config C:\Users\Admin\AppData\Local\Temp\is-G2E37.tmp\Flabs1.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133226800715164735" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-G2E37.tmp\Flabs1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\32-23055-00a-14c9e-5efb2be27ac9d\Raladypaka.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4652 wrote to memory of 1288 N/A C:\Users\Admin\AppData\Local\Temp\ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.exe C:\Users\Admin\AppData\Local\Temp\is-A219K.tmp\ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.tmp
PID 4652 wrote to memory of 1288 N/A C:\Users\Admin\AppData\Local\Temp\ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.exe C:\Users\Admin\AppData\Local\Temp\is-A219K.tmp\ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.tmp
PID 4652 wrote to memory of 1288 N/A C:\Users\Admin\AppData\Local\Temp\ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.exe C:\Users\Admin\AppData\Local\Temp\is-A219K.tmp\ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.tmp
PID 1288 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\is-A219K.tmp\ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.tmp C:\Users\Admin\AppData\Local\Temp\is-G2E37.tmp\Flabs1.exe
PID 1288 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\is-A219K.tmp\ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.tmp C:\Users\Admin\AppData\Local\Temp\is-G2E37.tmp\Flabs1.exe
PID 3148 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\is-G2E37.tmp\Flabs1.exe C:\Users\Admin\AppData\Local\Temp\32-23055-00a-14c9e-5efb2be27ac9d\Raladypaka.exe
PID 3148 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\is-G2E37.tmp\Flabs1.exe C:\Users\Admin\AppData\Local\Temp\32-23055-00a-14c9e-5efb2be27ac9d\Raladypaka.exe
PID 3148 wrote to memory of 4328 N/A C:\Users\Admin\AppData\Local\Temp\is-G2E37.tmp\Flabs1.exe C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe
PID 3148 wrote to memory of 4328 N/A C:\Users\Admin\AppData\Local\Temp\is-G2E37.tmp\Flabs1.exe C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe
PID 4328 wrote to memory of 5844 N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe C:\Windows\System32\cmd.exe
PID 4328 wrote to memory of 5844 N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe C:\Windows\System32\cmd.exe
PID 5844 wrote to memory of 7128 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\csniqjcr.zov\gcleaner.exe
PID 5844 wrote to memory of 7128 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\csniqjcr.zov\gcleaner.exe
PID 5844 wrote to memory of 7128 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\csniqjcr.zov\gcleaner.exe
PID 5032 wrote to memory of 7348 N/A C:\Users\Admin\AppData\Local\Temp\32-23055-00a-14c9e-5efb2be27ac9d\Raladypaka.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5032 wrote to memory of 7348 N/A C:\Users\Admin\AppData\Local\Temp\32-23055-00a-14c9e-5efb2be27ac9d\Raladypaka.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4328 wrote to memory of 7508 N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe C:\Windows\System32\cmd.exe
PID 4328 wrote to memory of 7508 N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe C:\Windows\System32\cmd.exe
PID 7508 wrote to memory of 7560 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe
PID 7508 wrote to memory of 7560 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe
PID 7508 wrote to memory of 7560 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe
PID 4328 wrote to memory of 7748 N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe C:\Windows\System32\cmd.exe
PID 4328 wrote to memory of 7748 N/A C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe C:\Windows\System32\cmd.exe
PID 7748 wrote to memory of 7824 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\kgfvacuj.3yu\chenp.exe
PID 7748 wrote to memory of 7824 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\kgfvacuj.3yu\chenp.exe
PID 7748 wrote to memory of 7824 N/A C:\Windows\System32\cmd.exe C:\Users\Admin\AppData\Local\Temp\kgfvacuj.3yu\chenp.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 7348 wrote to memory of 7940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.exe

"C:\Users\Admin\AppData\Local\Temp\ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.exe"

C:\Users\Admin\AppData\Local\Temp\is-A219K.tmp\ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.tmp

"C:\Users\Admin\AppData\Local\Temp\is-A219K.tmp\ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.tmp" /SL5="$9006E,146662,62976,C:\Users\Admin\AppData\Local\Temp\ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.exe"

C:\Users\Admin\AppData\Local\Temp\is-G2E37.tmp\Flabs1.exe

"C:\Users\Admin\AppData\Local\Temp\is-G2E37.tmp\Flabs1.exe" /S /UID=flabs1

C:\Users\Admin\AppData\Local\Temp\32-23055-00a-14c9e-5efb2be27ac9d\Raladypaka.exe

"C:\Users\Admin\AppData\Local\Temp\32-23055-00a-14c9e-5efb2be27ac9d\Raladypaka.exe"

C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe

"C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\csniqjcr.zov\gcleaner.exe /mixfive & exit

C:\Users\Admin\AppData\Local\Temp\csniqjcr.zov\gcleaner.exe

C:\Users\Admin\AppData\Local\Temp\csniqjcr.zov\gcleaner.exe /mixfive

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbf67a46f8,0x7ffbf67a4708,0x7ffbf67a4718

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 7128 -ip 7128

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7128 -s 460

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe & exit

C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe

C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kgfvacuj.3yu\chenp.exe & exit

C:\Users\Admin\AppData\Local\Temp\kgfvacuj.3yu\chenp.exe

C:\Users\Admin\AppData\Local\Temp\kgfvacuj.3yu\chenp.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,7312107183602630511,11646494481067058070,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,7312107183602630511,11646494481067058070,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,7312107183602630511,11646494481067058070,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\kgfvacuj.3yu\chenp.exe

"C:\Users\Admin\AppData\Local\Temp\kgfvacuj.3yu\chenp.exe" -h

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c taskkill /f /im chrome.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im chrome.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7312107183602630511,11646494481067058070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7312107183602630511,11646494481067058070,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 7128 -ip 7128

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7128 -s 764

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 7128 -ip 7128

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7128 -s 772

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4452 -ip 4452

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 612

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 7128 -ip 7128

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7128 -s 840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7312107183602630511,11646494481067058070,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 7128 -ip 7128

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7128 -s 860

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 7128 -ip 7128

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7128 -s 984

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 7128 -ip 7128

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7128 -s 1012

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 7128 -ip 7128

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7128 -s 1352

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7312107183602630511,11646494481067058070,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7312107183602630511,11646494481067058070,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffbf3ef9758,0x7ffbf3ef9768,0x7ffbf3ef9778

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7312107183602630511,11646494481067058070,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7312107183602630511,11646494481067058070,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\csniqjcr.zov\gcleaner.exe" & exit

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 7128 -ip 7128

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7128 -s 492

C:\Windows\SysWOW64\taskkill.exe

taskkill /im "gcleaner.exe" /f

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=556,i,8297312205442002056,809025536535289720,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=556,i,8297312205442002056,809025536535289720,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2136 --field-trial-handle=556,i,8297312205442002056,809025536535289720,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3160 --field-trial-handle=556,i,8297312205442002056,809025536535289720,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3296 --field-trial-handle=556,i,8297312205442002056,809025536535289720,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3800 --field-trial-handle=556,i,8297312205442002056,809025536535289720,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4640 --field-trial-handle=556,i,8297312205442002056,809025536535289720,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4860 --field-trial-handle=556,i,8297312205442002056,809025536535289720,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4992 --field-trial-handle=556,i,8297312205442002056,809025536535289720,131072 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,7312107183602630511,11646494481067058070,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff638895460,0x7ff638895470,0x7ff638895480

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4960 --field-trial-handle=556,i,8297312205442002056,809025536535289720,131072 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,7312107183602630511,11646494481067058070,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 --field-trial-handle=556,i,8297312205442002056,809025536535289720,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 --field-trial-handle=556,i,8297312205442002056,809025536535289720,131072 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,7312107183602630511,11646494481067058070,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1868 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2964 --field-trial-handle=556,i,8297312205442002056,809025536535289720,131072 /prefetch:2

Network

Country Destination Domain Proto
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 8.8.8.8:53 s3.eu-central-1.wasabisys.com udp
NL 130.117.252.12:443 s3.eu-central-1.wasabisys.com tcp
US 8.8.8.8:53 76.38.195.152.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 12.252.117.130.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 connectini.net udp
GB 37.230.138.123:443 connectini.net tcp
US 8.8.8.8:53 s3.eu-central-1.wasabisys.com udp
US 8.8.8.8:53 wewewe.s3.eu-central-1.amazonaws.com udp
US 8.8.8.8:53 n8w5.c12.e2-1.dev udp
NL 130.117.252.27:443 s3.eu-central-1.wasabisys.com tcp
NL 130.117.252.27:443 s3.eu-central-1.wasabisys.com tcp
DE 52.219.171.110:443 wewewe.s3.eu-central-1.amazonaws.com tcp
US 8.8.8.8:53 360devtracking.com udp
GB 37.230.138.66:80 360devtracking.com tcp
US 8.8.8.8:53 iplogger.com udp
DE 148.251.234.93:443 iplogger.com tcp
US 8.8.8.8:53 123.138.230.37.in-addr.arpa udp
US 8.8.8.8:53 27.252.117.130.in-addr.arpa udp
US 8.8.8.8:53 110.171.219.52.in-addr.arpa udp
US 8.8.8.8:53 66.138.230.37.in-addr.arpa udp
US 8.8.8.8:53 93.234.251.148.in-addr.arpa udp
NL 142.251.39.100:80 www.google.com tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 connectini.net udp
GB 37.230.138.123:443 connectini.net tcp
GB 37.230.138.123:443 connectini.net tcp
US 8.8.8.8:53 100.39.251.142.in-addr.arpa udp
GB 37.230.138.66:80 360devtracking.com tcp
NL 45.12.253.74:80 45.12.253.74 tcp
US 8.8.8.8:53 iplogger.org udp
US 8.8.8.8:53 htagzdownload.pw udp
DE 148.251.234.83:443 iplogger.org tcp
BE 35.205.61.67:80 htagzdownload.pw tcp
US 8.8.8.8:53 www.cpasdrole.com udp
US 104.21.65.120:80 www.cpasdrole.com tcp
US 8.8.8.8:53 74.253.12.45.in-addr.arpa udp
US 8.8.8.8:53 83.234.251.148.in-addr.arpa udp
US 8.8.8.8:53 120.65.21.104.in-addr.arpa udp
US 8.8.8.8:53 a.dowgmua.com udp
US 104.21.57.8:443 a.dowgmua.com tcp
US 8.8.8.8:53 www.ippfinfo.top udp
DE 178.18.252.110:443 www.ippfinfo.top tcp
US 8.8.8.8:53 8.57.21.104.in-addr.arpa udp
US 8.8.8.8:53 67.61.205.35.in-addr.arpa udp
US 8.8.8.8:53 b.dowgmub.com udp
US 172.67.140.42:443 b.dowgmub.com tcp
US 8.8.8.8:53 ocsp.trust-provider.cn udp
NL 47.246.48.208:80 ocsp.trust-provider.cn tcp
DE 148.251.234.83:443 iplogger.org tcp
US 8.8.8.8:53 110.252.18.178.in-addr.arpa udp
US 8.8.8.8:53 68.32.18.104.in-addr.arpa udp
US 8.8.8.8:53 42.140.67.172.in-addr.arpa udp
US 8.8.8.8:53 208.48.246.47.in-addr.arpa udp
US 8.8.8.8:53 67.55.52.23.in-addr.arpa udp
US 8.8.8.8:53 xv.yxzgamen.com udp
US 104.21.27.36:443 xv.yxzgamen.com tcp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
US 8.8.8.8:53 www.profitabletrustednetwork.com udp
US 192.243.59.12:443 www.profitabletrustednetwork.com tcp
US 192.243.59.12:443 www.profitabletrustednetwork.com tcp
US 8.8.8.8:53 36.27.21.104.in-addr.arpa udp
US 8.8.8.8:53 simplewebanalysis.com udp
IN 3.111.220.229:443 simplewebanalysis.com tcp
US 8.8.8.8:53 250.255.255.239.in-addr.arpa udp
US 8.8.8.8:53 12.59.243.192.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 tracker-tds2.site udp
FI 95.216.226.187:443 tracker-tds2.site tcp
BE 35.205.61.67:80 htagzdownload.pw tcp
US 8.8.8.8:53 coressp.top udp
DE 5.75.133.219:443 coressp.top tcp
US 8.8.8.8:53 new.lightfoot.top udp
DE 116.202.184.109:443 new.lightfoot.top tcp
US 8.8.8.8:53 js.pushssp.top udp
US 8.8.8.8:53 229.220.111.3.in-addr.arpa udp
US 8.8.8.8:53 187.226.216.95.in-addr.arpa udp
US 8.8.8.8:53 219.133.75.5.in-addr.arpa udp
US 8.8.8.8:53 109.184.202.116.in-addr.arpa udp
DE 5.75.133.219:443 js.pushssp.top tcp
US 8.8.8.8:53 js.cdnpsh.com udp
DE 5.75.133.219:443 js.cdnpsh.com tcp
US 8.8.8.8:53 feed.cdnpsh.com udp
US 8.8.8.8:53 163.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 arc.srv.lan udp
NL 45.12.253.56:80 45.12.253.56 tcp
US 8.8.8.8:53 ntp.srv.lan udp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
US 8.8.8.8:53 56.253.12.45.in-addr.arpa udp
US 8.8.8.8:53 edge.msiserver.lan udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 accounts.server.lan udp
US 8.8.8.8:53 hyhjuer.s3.eu-west-3.amazonaws.com udp
US 8.8.8.8:53 m.facebook.com udp
US 157.240.5.35:443 m.facebook.com tcp
FR 52.95.155.64:443 hyhjuer.s3.eu-west-3.amazonaws.com tcp
US 8.8.8.8:53 www.kp-iruma.com udp
US 104.21.1.175:80 www.kp-iruma.com tcp
US 157.240.5.35:443 m.facebook.com udp
US 8.8.8.8:53 138.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 64.155.95.52.in-addr.arpa udp
US 8.8.8.8:53 35.5.240.157.in-addr.arpa udp
US 8.8.8.8:53 175.1.21.104.in-addr.arpa udp
US 8.8.8.8:53 secure.facebook.com udp
US 157.240.5.21:443 secure.facebook.com tcp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 apis.google.com udp
NL 172.217.168.206:443 apis.google.com udp
US 8.8.8.8:53 21.5.240.157.in-addr.arpa udp
US 8.8.8.8:53 206.168.217.172.in-addr.arpa udp
US 8.8.8.8:53 clients2.google.com udp
NL 142.251.36.46:443 clients2.google.com udp
NL 142.251.36.46:443 clients2.google.com tcp
US 8.8.8.8:53 46.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 164.2.77.40.in-addr.arpa udp
US 8.8.8.8:53 accounts.server.lan udp
US 20.189.173.3:443 tcp
US 8.8.8.8:53 177.238.32.23.in-addr.arpa udp
US 157.240.5.35:443 www.facebook.com udp
US 157.240.5.21:443 secure.facebook.com udp
US 8.8.8.8:53 accounts.server.lan udp
US 209.197.3.8:80 tcp
US 8.8.8.8:53 edge.msiserver.lan udp
US 8.8.8.8:53 update.msiservers.lan udp
US 157.240.5.35:443 www.facebook.com udp
US 157.240.5.21:443 secure.facebook.com udp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp
BE 35.205.61.67:80 htagzdownload.pw tcp
BE 35.205.61.67:80 htagzdownload.pw tcp
BE 35.205.61.67:80 htagzdownload.pw tcp
BE 35.205.61.67:80 htagzdownload.pw tcp
US 8.8.8.8:53 accounts.server.lan udp
BE 35.205.61.67:80 htagzdownload.pw tcp
BE 35.205.61.67:80 htagzdownload.pw tcp
US 8.8.8.8:53 m.facebook.com udp
US 8.8.8.8:53 www.listfcbt.top udp
US 157.240.5.35:443 m.facebook.com udp
US 8.8.8.8:53 www.typefdq.xyz udp
US 8.8.8.8:53 www.rqckdpt.top udp
US 8.8.8.8:53 secure.facebook.com udp
US 157.240.5.21:443 secure.facebook.com udp
US 8.8.8.8:53 www.facebook.com udp
GB 157.240.221.35:443 www.facebook.com udp
US 8.8.8.8:53 35.221.240.157.in-addr.arpa udp

Files

memory/4652-133-0x0000000000400000-0x0000000000416000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-A219K.tmp\ad4fe1e40d5bd2e9881400aaaf00b43abdfcfcab35587923bd92067fa34d2059.tmp

MD5 98d2d99fc3af8c3cf275413037eba7da
SHA1 a922a0f5a229990301f0cf53b74c4b69fa9e82e3
SHA256 a6657d272d82dc1da0704c458274e4cf1e94a465569bc17abc8e7ae2f5d31003
SHA512 125fef09f222e154568b7dcff309381f2f7ca5e3536b98a8995563d642d56a787ba9808a144f6d83e84a2a44e279359213ea034ab7f9637fd43e3952e54a3618

C:\Users\Admin\AppData\Local\Temp\is-G2E37.tmp\idp.dll

MD5 8f995688085bced38ba7795f60a5e1d3
SHA1 5b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256 203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512 043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

memory/1288-146-0x0000000000660000-0x0000000000661000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-G2E37.tmp\Flabs1.exe

MD5 ee726f15ff7c438fc1faf75032a81028
SHA1 86fdbb74d64fce06fe518ee220f5f5bafced7214
SHA256 4c78cca2ac2fa4d8f2e0c47e0f2785242825da458f00e5337cd56f157ff4bd97
SHA512 d9c16d6e027dadd8f8e7ed90e9993a20c4244dc7475a2e5674c1be7a43218824250a3453f97220a960fd886c0760a32d9cfb848e94055a82f7af3dcc401bb0de

C:\Users\Admin\AppData\Local\Temp\is-G2E37.tmp\Flabs1.exe

MD5 ee726f15ff7c438fc1faf75032a81028
SHA1 86fdbb74d64fce06fe518ee220f5f5bafced7214
SHA256 4c78cca2ac2fa4d8f2e0c47e0f2785242825da458f00e5337cd56f157ff4bd97
SHA512 d9c16d6e027dadd8f8e7ed90e9993a20c4244dc7475a2e5674c1be7a43218824250a3453f97220a960fd886c0760a32d9cfb848e94055a82f7af3dcc401bb0de

memory/3148-157-0x0000000000180000-0x00000000001D2000-memory.dmp

memory/3148-158-0x000000001C490000-0x000000001C4A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\32-23055-00a-14c9e-5efb2be27ac9d\Raladypaka.exe

MD5 1e8e3939ec32c19b2031d50cc9875084
SHA1 83cc7708448c52f5c184cc329fa11f4cfe9c2823
SHA256 5988245cd9d0c40bcb12155b966cb8ddd86da1107bca456341de5bd5fb560808
SHA512 0d3ad7c0865e421fad34e27a47108fdc9e359f8603c4c01f6d789d3ead6e6ac5815f979301870f8157fedaf8178ed34873fbff807807d46698249f098fc78caa

C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe

MD5 fba3b4b12a0c6c9924132b149147a0a2
SHA1 a776068968a89ff9503e794e4ab0c04bbee6e5f6
SHA256 7403a6d53688cddeb84997cf90f616a3f25e79681b9c47074b5534f4e8b45890
SHA512 a1a41956ee97b4e590795a319d357f7f1b22115f5f663211af71cb14ffae879cb0fda743c7a016bb1a479d64dacee2f865e67f29d589d30d10b928a2bbb628ee

C:\Users\Admin\AppData\Local\Temp\32-23055-00a-14c9e-5efb2be27ac9d\Raladypaka.exe

MD5 1e8e3939ec32c19b2031d50cc9875084
SHA1 83cc7708448c52f5c184cc329fa11f4cfe9c2823
SHA256 5988245cd9d0c40bcb12155b966cb8ddd86da1107bca456341de5bd5fb560808
SHA512 0d3ad7c0865e421fad34e27a47108fdc9e359f8603c4c01f6d789d3ead6e6ac5815f979301870f8157fedaf8178ed34873fbff807807d46698249f098fc78caa

C:\Users\Admin\AppData\Local\Temp\32-23055-00a-14c9e-5efb2be27ac9d\Raladypaka.exe.config

MD5 98d2687aec923f98c37f7cda8de0eb19
SHA1 f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7
SHA256 8a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465
SHA512 95c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590

C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe

MD5 fba3b4b12a0c6c9924132b149147a0a2
SHA1 a776068968a89ff9503e794e4ab0c04bbee6e5f6
SHA256 7403a6d53688cddeb84997cf90f616a3f25e79681b9c47074b5534f4e8b45890
SHA512 a1a41956ee97b4e590795a319d357f7f1b22115f5f663211af71cb14ffae879cb0fda743c7a016bb1a479d64dacee2f865e67f29d589d30d10b928a2bbb628ee

C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe.config

MD5 98d2687aec923f98c37f7cda8de0eb19
SHA1 f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7
SHA256 8a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465
SHA512 95c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590

C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Raladypaka.exe

MD5 fba3b4b12a0c6c9924132b149147a0a2
SHA1 a776068968a89ff9503e794e4ab0c04bbee6e5f6
SHA256 7403a6d53688cddeb84997cf90f616a3f25e79681b9c47074b5534f4e8b45890
SHA512 a1a41956ee97b4e590795a319d357f7f1b22115f5f663211af71cb14ffae879cb0fda743c7a016bb1a479d64dacee2f865e67f29d589d30d10b928a2bbb628ee

C:\Users\Admin\AppData\Local\Temp\32-23055-00a-14c9e-5efb2be27ac9d\Raladypaka.exe

MD5 1e8e3939ec32c19b2031d50cc9875084
SHA1 83cc7708448c52f5c184cc329fa11f4cfe9c2823
SHA256 5988245cd9d0c40bcb12155b966cb8ddd86da1107bca456341de5bd5fb560808
SHA512 0d3ad7c0865e421fad34e27a47108fdc9e359f8603c4c01f6d789d3ead6e6ac5815f979301870f8157fedaf8178ed34873fbff807807d46698249f098fc78caa

memory/1288-192-0x0000000000400000-0x00000000004BF000-memory.dmp

memory/4652-194-0x0000000000400000-0x0000000000416000-memory.dmp

memory/4328-195-0x0000000000D40000-0x0000000000DBA000-memory.dmp

memory/5032-196-0x0000000000BA0000-0x0000000000C0A000-memory.dmp

memory/4328-197-0x000000001BBD0000-0x000000001BC36000-memory.dmp

memory/4328-198-0x000000001C370000-0x000000001C83E000-memory.dmp

memory/4328-200-0x0000000001530000-0x0000000001540000-memory.dmp

memory/4328-199-0x000000001CA30000-0x000000001CACC000-memory.dmp

memory/5032-201-0x0000000001110000-0x0000000001120000-memory.dmp

memory/4328-202-0x000000001C840000-0x000000001C848000-memory.dmp

memory/4328-203-0x000000001E6E0000-0x000000001E73E000-memory.dmp

memory/4328-204-0x000000001F190000-0x000000001F49E000-memory.dmp

memory/4328-205-0x0000000001530000-0x0000000001540000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\f8-28ee9-5d4-18fbc-929eee5778ef9\Kenessey.txt

MD5 97384261b8bbf966df16e5ad509922db
SHA1 2fc42d37fee2c81d767e09fb298b70c748940f86
SHA256 9c0d294c05fc1d88d698034609bb81c0c69196327594e4c69d2915c80fd9850c
SHA512 b77fe2d86fbc5bd116d6a073eb447e76a74add3fa0d0b801f97535963241be3cdce1dbcaed603b78f020d0845b2d4bfc892ceb2a7d1c8f1d98abc4812ef5af21

C:\Users\Admin\AppData\Local\Temp\csniqjcr.zov\gcleaner.exe

MD5 2269a6f3d0cede0cf190c0424ab5b853
SHA1 d70ffdf1db784115ce479a778e1eeec184460e4b
SHA256 241e61a533e5de6485fbd2f5c6bce8fdfca5081a4f81bc89113f50c302494e0b
SHA512 4f6d546a93734af2a85d2409ac28f09786ea05eefc2986250064854bd430ca7ddf6cbe70a1274c8d9c541b60276e01cb2f0f8a78d67e33fc83eae57fca98bd1d

C:\Users\Admin\AppData\Local\Temp\csniqjcr.zov\gcleaner.exe

MD5 2269a6f3d0cede0cf190c0424ab5b853
SHA1 d70ffdf1db784115ce479a778e1eeec184460e4b
SHA256 241e61a533e5de6485fbd2f5c6bce8fdfca5081a4f81bc89113f50c302494e0b
SHA512 4f6d546a93734af2a85d2409ac28f09786ea05eefc2986250064854bd430ca7ddf6cbe70a1274c8d9c541b60276e01cb2f0f8a78d67e33fc83eae57fca98bd1d

memory/4328-212-0x000000001E560000-0x000000001E5C2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe

MD5 c40e098b934dd5baaff26717530d6d4d
SHA1 c11ef5cc4723bd97d34bc6f11bdfc11cb2ddf480
SHA256 e9c3b78b6059b1decae5365a506fc39b21e5babd13dbfd21920f4406c3217c1c
SHA512 0da40ffcf2674dc46784b499eedb8eb3c2aabf18a1fa1af2433599a3b886cec21f027b9be6e7e6461fb4cbeebebe0dd418f50319174f971d4324b252b4d37f8c

memory/7128-215-0x00000000020F0000-0x0000000002130000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\qyv40rrh.1f5\handdiy_2.exe

MD5 c40e098b934dd5baaff26717530d6d4d
SHA1 c11ef5cc4723bd97d34bc6f11bdfc11cb2ddf480
SHA256 e9c3b78b6059b1decae5365a506fc39b21e5babd13dbfd21920f4406c3217c1c
SHA512 0da40ffcf2674dc46784b499eedb8eb3c2aabf18a1fa1af2433599a3b886cec21f027b9be6e7e6461fb4cbeebebe0dd418f50319174f971d4324b252b4d37f8c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 5a10efe23009825eadc90c37a38d9401
SHA1 fd98f2ca011408d4b43ed4dfd5b6906fbc7b87c0
SHA256 05e135dee0260b4f601a0486401b64ff8653875d74bf259c2da232550dbfb4f5
SHA512 89416a3f5bf50cd4a432ac72cd0a7fb79d5aeb10bdcc468c55bbfa79b9f43fab17141305d44cb1fe980ec76cc6575c27e2bcfcbad5ccd886d45b9de03fb9d6d7

C:\Users\Admin\AppData\Local\Temp\kgfvacuj.3yu\chenp.exe

MD5 b5e1e946ebad560b876703e9675ca326
SHA1 c0e2e24a911a4d8e9cbc5a483ef8876fbabfa772
SHA256 c33ecac87bf07fc75b6768b76622daac389e05ef718c457e0393238d646bb130
SHA512 8ee9e9af2731eb83af3f17aa19b9a74547429f026882fb6d592d74d97ed958f990f46c5be5371e06360503672e9f8ca00ccf9d64ed59d11475c86a6f35ac1ff5

C:\Users\Admin\AppData\Local\Temp\kgfvacuj.3yu\chenp.exe

MD5 b5e1e946ebad560b876703e9675ca326
SHA1 c0e2e24a911a4d8e9cbc5a483ef8876fbabfa772
SHA256 c33ecac87bf07fc75b6768b76622daac389e05ef718c457e0393238d646bb130
SHA512 8ee9e9af2731eb83af3f17aa19b9a74547429f026882fb6d592d74d97ed958f990f46c5be5371e06360503672e9f8ca00ccf9d64ed59d11475c86a6f35ac1ff5

memory/7940-240-0x00007FFC16CB0000-0x00007FFC16CB1000-memory.dmp

\??\pipe\LOCAL\crashpad_7348_GREHSCFUKEWLTCUC

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\kgfvacuj.3yu\chenp.exe

MD5 b5e1e946ebad560b876703e9675ca326
SHA1 c0e2e24a911a4d8e9cbc5a483ef8876fbabfa772
SHA256 c33ecac87bf07fc75b6768b76622daac389e05ef718c457e0393238d646bb130
SHA512 8ee9e9af2731eb83af3f17aa19b9a74547429f026882fb6d592d74d97ed958f990f46c5be5371e06360503672e9f8ca00ccf9d64ed59d11475c86a6f35ac1ff5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

MD5 e5e3377341056643b0494b6842c0b544
SHA1 d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256 e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA512 83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 c1a3c45dc07f766430f7feaa3000fb18
SHA1 698a0485bcf0ab2a9283d4ebd31ade980b0661d1
SHA256 adaba08026551b1b8f6c120143686da79f916d02adbef4a8d1c184e32a19fd48
SHA512 9fc93f01ab4b14f555791d757ffe881787cc697102547c61847552e597e206e70c6d35fedff559c72a0a67d1b95e769095ecb0a8a7d4f07cf58a7a0d57d3e9f4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 131c3bd36abfd1b7e7fb6d0a1a98f850
SHA1 3fdc0149624ace96683417df629c1b34e65b5c07
SHA256 1ddeccbd8579779f097ec0c83847d662cdbc0a9a79053537ff56363ef0a63b50
SHA512 9e4051b87e75d12e48a64b6d8ff3a0efa82a87721adceab3fea3d3b6fb06b99e58bfb3975afd2e05841e52d46775a7e7c455969548cb7f3547abfc45fd79a6bb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 5edab6d3ffbeee247ccb4423f929a323
SHA1 a4ad201d149d59392a2a3163bd86ee900e20f3d9
SHA256 460cddb95ea1d9bc8d95d295dd051b49a1436437a91ddec5f131235b2d516933
SHA512 263fa99f03ea1ef381ca19f10fbe0362c1f9c129502dc6b730b076cafcf34b40a70ee8a0ee9446ec9c89c3a2d9855450609ec0f8cf9d0a1b2aebdd12be58d38c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

MD5 ec8ff3b1ded0246437b1472c69dd1811
SHA1 d813e874c2524e3a7da6c466c67854ad16800326
SHA256 e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab
SHA512 e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

MD5 796d7a048a46cb5c4a4691923e8a979a
SHA1 71d52dd8b2dba245858025db72248a59d762f6d8
SHA256 4e0eff558ad16f3410f6d0d9444d31baa006ba02818224f1cca4498d4690d209
SHA512 a3f2e423510b827c6a0148c2761e058f47ad828d19610ab021f4890ea53d017298252f1c9b47a03d6362cf35909aae8334c8f88a32df2fc4774519aaadec8376

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

MD5 162c19b639b0ae9487884280c0d833fd
SHA1 24b9b27a28292d9475fbe4cd03f60d6f7edd2b1f
SHA256 f6e1fc1d71871466bdb65fb76ad7edaa4e6ddce496f89d4f2732d728aa8cd5da
SHA512 a5375567f7a0def610c9ed4020ba5c2d961055c4feadad59c4f0af4e7f70cd2166f9bc92e36ae1154021f99d8cd1c1bdf7aee73184ac76e9c7d2f27ecd738210

C:\Users\Admin\AppData\Local\Temp\db.dll

MD5 1b20e998d058e813dfc515867d31124f
SHA1 c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f
SHA256 24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00
SHA512 79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

C:\Users\Admin\AppData\Local\Temp\db.dll

MD5 1b20e998d058e813dfc515867d31124f
SHA1 c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f
SHA256 24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00
SHA512 79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

C:\Users\Admin\AppData\Local\Temp\db.dat

MD5 76c3dbb1e9fea62090cdf53dadcbe28e
SHA1 d44b32d04adc810c6df258be85dc6b62bd48a307
SHA256 556fd54e5595d222cfa2bd353afa66d8d4d1fbb3003afed604672fceae991860
SHA512 de4ea57497cf26237430880742f59e8d2a0ac7e7a0b09ed7be590f36fbd08c9ced0ffe46eb69ec2215a9cff55720f24fffcae752cd282250b4da6b75a30b3a1b

memory/4328-378-0x000000001D470000-0x000000001D619000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

MD5 4986956b31c1044294aa111983480cb1
SHA1 fc9f4b1111a88260cf0e053695d4d2808b9ef8c7
SHA256 44916912dcae0869f3d8f770564f64e96b2393e396efbe72a1c37b73595fa697
SHA512 74907ba2d36bb3b647d9d24fdd62ed6ca9e52f6013abbf25118f43143cbc39ea45adaefb6dac8218e924ea4364b75795f775886a66e2631d9bd8d22dabb7f9e4

memory/5032-402-0x0000000001110000-0x0000000001120000-memory.dmp

memory/4328-399-0x0000000001530000-0x0000000001540000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

memory/7128-425-0x0000000000400000-0x00000000004E3000-memory.dmp

memory/4328-426-0x0000000001530000-0x0000000001540000-memory.dmp

memory/6428-433-0x00007FFC16CB0000-0x00007FFC16CB1000-memory.dmp

\??\pipe\crashpad_5808_XODRUIYOEIKQWEIQ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 973e33d24ebbe8b07ab002a2daf45f85
SHA1 e763b14aba9e85db3be16d8e3b141c6a0ced99c9
SHA256 10e1df46fbc34b42ec83784b6f1acad7a1acaa8c4701b92190b6b8f31de98e51
SHA512 8423fc5e8519a5057ce6aa4d61416e801d9ffccb552ce654dec99eef04981e843da0cc6106646ae8c70b09b2c4b6dfd1fa345173f71ffe7d9835e2cc05e42207

C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\manifest.json

MD5 05bfb082915ee2b59a7f32fa3cc79432
SHA1 c1acd799ae271bcdde50f30082d25af31c1208c3
SHA256 04392a223cc358bc79fcd306504e8e834d6febbff0f3496f2eb8451797d28aa1
SHA512 6feea1c8112ac33d117aef3f272b1cc42ec24731c51886ed6f8bc2257b91e4d80089e8ca7ce292cc2f39100a7f662bcc5c37e5622a786f8dc8ea46b8127152f3

C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\jquery-3.3.1.min.js

MD5 a09e13ee94d51c524b7e2a728c7d4039
SHA1 0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae
SHA256 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
SHA512 f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a

C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\content.js

MD5 c31f14d9b1b840e4b9c851cbe843fc8f
SHA1 205e3a99dc6c0af0e2f4450ebaa49ebde8e76bb4
SHA256 03601415885fd5d8967c407f7320d53f4c9ca2ec33bbe767d73a1589c5e36c54
SHA512 2c3d7ed5384712a0013a2ebbc526e762f257e32199651192742282a9641946b6aea6235d848b1e8cb3b0f916f85d3708a14717a69cbcf081145bc634d11d75aa

C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\icon.png

MD5 362695f3dd9c02c83039898198484188
SHA1 85dcacc66a106feca7a94a42fc43e08c806a0322
SHA256 40cfea52dbc50a8a5c250c63d825dcaad3f76e9588f474b3e035b587c912f4ca
SHA512 a04dc31a6ffc3bb5d56ba0fb03ecf93a88adc7193a384313d2955701bd99441ddf507aa0ddfc61dfc94f10a7e571b3d6a35980e61b06f98dd9eee424dc594a6f

C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\background.html

MD5 9ffe618d587a0685d80e9f8bb7d89d39
SHA1 8e9cae42c911027aafae56f9b1a16eb8dd7a739c
SHA256 a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e
SHA512 a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12

C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\aes.js

MD5 4ff108e4584780dce15d610c142c3e62
SHA1 77e4519962e2f6a9fc93342137dbb31c33b76b04
SHA256 fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a
SHA512 d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2

C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\background.js

MD5 b51e4437ee2a60e28308e941273ef18c
SHA1 fb426d0d98e97c208230858fbf6eb391c3b41cdb
SHA256 971fdf2c44371ecdcb768f5505d16f1a8b5407fb82e9cd158d01f0f37c2d34bb
SHA512 91447f07e265aae1a08686264ecf2d16088954121744343fcee729a030330dfca4c175865e24423ce28c6d9f3d33036c0015acd8ab90ea70ad0d556a518bf369

C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\pad-nopadding.js

MD5 0f26002ee3b4b4440e5949a969ea7503
SHA1 31fc518828fe4894e8077ec5686dce7b1ed281d7
SHA256 282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d
SHA512 4290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11

C:\Program Files\nndannfdnoaiphfcbbpgkhodebpoiocf\js\mode-ecb.js

MD5 23231681d1c6f85fa32e725d6d63b19b
SHA1 f69315530b49ac743b0e012652a3a5efaed94f17
SHA256 03164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a
SHA512 36860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 07cf7be817a33021b63ef6035992c26f
SHA1 2dae1ffa97b4fa6b61c584040d5557f34645eae9
SHA256 a1f3d5111b90161834fbdd25d30860e8cb144199b6f4643b8df267868a5f2103
SHA512 bba6a1e68c825d3df93b546fba7079b73e7791791253c3112855587f6f2eca2703a27414ecb49903d11dec25a8886fea393838c525209ba4447977a41438f231

memory/7300-481-0x00007FFC17260000-0x00007FFC17261000-memory.dmp

memory/7300-483-0x00007FFC16550000-0x00007FFC16551000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 d43e8a3af143a9f180c0e69884ef1d29
SHA1 6e12d90126a04b7c6655062e453f99937fd84567
SHA256 6e49faa5ccf6a4ff1ecf0f8868e6ee08b5594b1e810a111f40220ba73a0c9211
SHA512 96ae1e40818466715449f18d16d72165df6d62850a29f1dab3440194818608ca791b930a903269bdf5f3a76fab1650c7b42e11f6a16fb6ed42ef59c1b5e344f4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 2a651175bb3986afddf0e9dfb65bcf96
SHA1 5e4fd8b245a9c93e0f8c43629df3969d44540f9e
SHA256 6d6d899147d2cc8648f11aeb0497d05ed5971e2e834613b17fd70764be60346d
SHA512 c2ac026767fd6254a9187e0670faecadecb740c0da9fe3ca46336066d243e3af7d7e46a72fdc197a681ad71308644f7f34d4ca8c9dd27189db09a79b41cc1f0c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 71137c4c699b337ad0d8131111c1ea9c
SHA1 6d5922b3cda3ffcada24e72512d0d80b9fe8cf17
SHA256 231ab9094b9f3de623e395e33a4631884c94199b10b0a854fd854c211b0b9b8f
SHA512 7d063dbca32602ef7a639cc29976975af5733919850c421fde72fc855f5a4c92eb247e7b59eee9f0d09aac822488426d0ee46f94aea74ae2cb85198059c33d5c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 302e431ca9e61de907ca81b758c2e0c3
SHA1 14fcc39cdf2519b5097aa99686ee041bce5198d3
SHA256 505b7a9b2b02affb7b24e669ead3c99f0a13228aaf7f609c881b8713d78006e9
SHA512 3c490136493402dbb145c55ce7910d660560d63922c6ae3c87c89b9fc7b19e4617b4b1094900159d66ac32a602a20c7c8fd3a2f00347b3cf1f55e9a8b15feef9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 633a90287a1a06bffbd5751dd4231741
SHA1 e1a0a5c2063aa66d6d2a63f029e87edec029111c
SHA256 c5920de61825b852422127e920c039c8ed6d0a4562bc3f55c6a0df4786803e37
SHA512 da867f78d66a868bdc60173350b94248b97c33857742829db9903d19a902346e2ca9480cf3ee2d44cf4110b94b70d8697b6d1d396555fcbadc625773451a8da3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 aa538a70e8328a616e01ba01d2ebbe0e
SHA1 c5c5d97ebf4ea6a026361ba5f4961bed702545ff
SHA256 d6069e69b0cb3c946953094a15e983452a8d7a0bf99b287cc0e4800dede2a2d0
SHA512 314af4b766e85cedfa157d2e510c6f0f0390a43f229fc05bc0a081e7ee31eab1383981871501b57ffabc3ee265719a2593bae0b40dc6dcb495479af8df4454e0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5704b3.TMP

MD5 db29ddc1c920e63ca3253aab0933c94b
SHA1 f9a3df75070a58a276e7bc4ebd0ec220a05f90de
SHA256 be723cf4a0810f505054bf838780e26af881479ff7b17cfda6436ffdfade1f63
SHA512 89f92beff8c7aa4b78f0fd65bb16b74aff82e4e8e39ee7a7a0a37e155b46b1b07b8a7ca0814464496e6f2d77dd1ac1fee4051eca7953e60fb5397da0ff7d99bd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 b5ebca135584ec7287273c653b52f8cf
SHA1 c7d4f68f066b635932ddbebaae17acfd8e15008e
SHA256 1506895dcf78140b849fa44d45ea4b11039ff7aad2a5ba0652baff5845ea0ce8
SHA512 e8c610ef156f5cb4a8a8af735615b959cc2736c6a978045d1945480358b8786b4c50563132a71296b02f8ac92fc1bbca498495b02b9179f1fda605cc90c2dac9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57054f.TMP

MD5 45b535c6276c124acae97ddfd5ca8ecd
SHA1 89673d472f28701b97c764ae65c7c890e035031d
SHA256 fa5eeee8c4f70b023ccbed8e0ab39c2dd4c65fbdc3d02fa39ecb800bcab03756
SHA512 5d0ca31f54fcb7960d877e95bf043f78a75d2d11ba35fc8152580a88d5d2ca7edabd0e44c4fd21c2602807664762f9ed6f55afa53f68121532462c1c39986027

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 21049af5532984917cb100658f3f02c5
SHA1 53b972debcf8fef3b3ed9857e024b94a770f2374
SHA256 35db7fc9b06749703a6b0942a52bd845b100f9d4b8f574859af42e68eb3a3c69
SHA512 6a81cb36b28d7c7c2ac4e196ce03189e2772d5ca0ab179796962d02e38576d6aea3b9affd01e48b882f134bc8dd14ad63c7e1829545ad989f8b77db4060b6747

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 3525cba730dca45de99f831f15e19fa0
SHA1 6a5b37cb64cf195722f1532ac4bf9ed19168576c
SHA256 e5da7ccf1d9ab923fbd5c3fbdf0a9a5aaf16d3f5127876fe3710123e63aea816
SHA512 a21e5174e0e7f03f970ab185cea298ff2fa306ca6c79756a4d409fb3ba6f930b730854851c8e554a16e7eb16a23568d211f5436acbb860c70d6e687a0a7fb25b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 85122eda63d8f03f43c6848665e4c263
SHA1 be5a306e5d92a14df1c430cb8705e541671beb9c
SHA256 7c29a070c5f2fe0c3d5d12f74ed031bdae76b324daaea20c4155fc41453c1ee0
SHA512 e3d2f4400ead2916f3c395ad87a91a24a38dbe80c0654f4e085ae47a72613b3d5c2064db2c75d1f03f02f77186df81d51eb9dd36c8e58420ea5b09de2569bd22

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 40daad30c875e3b09f458843d390f6d7
SHA1 0154e5932fe0e50a13f6907d4d64ad9d34488766
SHA256 33c365054abef884de6e151c40414dc0f5d350fa04176fb3640aa8b688d2a66f
SHA512 1b54009f03746bf5ab33d3d1f8793336d51076707382e4aa9bf3ab634b8d8d20ddad6ae8b67b8a8f7f277b39fcee8b7b48b6c7a3957472c8891343fa196bd149

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 a080e2818ed1665648d29b8ca074fbd3
SHA1 856d40ee0f24283e84dc0d45e34c03ca7d727319
SHA256 df050908fe9a8eba71114ca2b99c76f086205e5a6f1c33ced0cc69f68e62e735
SHA512 87f7a8d6294c6f4d2cc2384c4eedb559ee87dccef69e4e0beb4aaf23c63475f60cdc4d19fcf7444a654c5255d2b772a28cf64b3238d0579d65bb821c0b3bea67

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 c4917d1bde1122d2b622f80f61262a43
SHA1 4f49a7ed0849daad02653aa755f58f7ca86414e4
SHA256 24089655ef481dc6169508325bf58887a75cf8ccda736e29fb2752feb07aa668
SHA512 3c6af9c45e203ff8703b2f1ef62caa031d4bb00f79716b0cf3f4684e3eab2a9d655f847b68efa99b26efa986b19d9f4e498a3baa43eb570be1858fec4c6a1b06

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 6244005dd2f848045245c2bda8d2b8d3
SHA1 1c2252bf0b0f12160dbfa95f2fb58ca78876f194
SHA256 3c3f2f1c424df7d14770f5e4add0d807b5836945e55928f4a8f1db5a4cf8ce30
SHA512 4819ac6466ebe99de56bfacbe5f7cbf4cf44faacda96a03bea744a4e394ac2e79c617e52d43b24913a706f23e4dd3b8192b98fcb0eb12bfd0a6e198aedfdb84c

memory/5084-687-0x000001C2C2AD0000-0x000001C2C2AD1000-memory.dmp

memory/5084-688-0x000001C2C2AD0000-0x000001C2C2AD1000-memory.dmp

memory/5084-689-0x000001C2C2AD0000-0x000001C2C2AD1000-memory.dmp

memory/5084-694-0x000001C2C2AD0000-0x000001C2C2AD1000-memory.dmp

memory/5084-693-0x000001C2C2AD0000-0x000001C2C2AD1000-memory.dmp

memory/5084-695-0x000001C2C2AD0000-0x000001C2C2AD1000-memory.dmp

memory/5084-697-0x000001C2C2AD0000-0x000001C2C2AD1000-memory.dmp

memory/5084-696-0x000001C2C2AD0000-0x000001C2C2AD1000-memory.dmp

memory/5084-699-0x000001C2C2AD0000-0x000001C2C2AD1000-memory.dmp

memory/5084-698-0x000001C2C2AD0000-0x000001C2C2AD1000-memory.dmp