Malware Analysis Report

2025-04-13 09:53

Sample ID 230709-3vjnnsgc55
Target Air Cluster Pro 130.exe
SHA256 47eb4710f7de558af843178388748abd984027eb76cdd1b6ff50fa8257babeed
Tags
gcleaner netsupport redline 0307 ali discovery evasion infostealer loader persistence rat spyware stealer vidar 9462b9ab55a818f8de0d37d4a4bd1b2a
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

47eb4710f7de558af843178388748abd984027eb76cdd1b6ff50fa8257babeed

Threat Level: Known bad

The file Air Cluster Pro 130.exe was found to be: Known bad.

Malicious Activity Summary

gcleaner netsupport redline 0307 ali discovery evasion infostealer loader persistence rat spyware stealer vidar 9462b9ab55a818f8de0d37d4a4bd1b2a

GCleaner

RedLine

Vidar

NetSupport

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Blocklisted process makes network request

Modifies Windows Firewall

Drops file in Drivers directory

Reads user/profile data of web browsers

Drops startup file

Loads dropped DLL

Checks BIOS information in registry

Unexpected DNS network traffic destination

Identifies Wine through registry keys

Executes dropped EXE

Checks computer location settings

Checks installed software on the system

Accesses 2FA software files, possible credential harvesting

Enumerates connected drives

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Drops file in System32 directory

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Program crash

Unsigned PE

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Modifies registry key

Kills process with taskkill

Uses Task Scheduler COM API

Modifies data under HKEY_USERS

Modifies system certificate store

Gathers network information

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Delays execution with timeout.exe

Enumerates system info in registry

Suspicious behavior: GetForegroundWindowSpam

Runs ping.exe

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Checks processor information in registry

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-07-09 23:50

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-07-09 23:50

Reported

2023-07-09 23:59

Platform

win7-20230705-en

Max time kernel

547s

Max time network

571s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Air Cluster Pro 130.exe"

Signatures

GCleaner

loader gcleaner

NetSupport

rat netsupport

RedLine

infostealer redline

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1671301472.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\meroplex.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A

Downloads MZ/PE file

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\Programs\Adblock\DnsService.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1671301472.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1671301472.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\meroplex.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\meroplex.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adblock Fast.lnk C:\Users\Admin\Programs\Adblock\Adblock.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp N/A
N/A N/A C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1671301472.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\meroplex.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rahmatlukum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\researchprevailing.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lukumrahmat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-U5TKL.tmp\s5.tmp N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\crashpad_handler.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s6.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\DnsService.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\MassiveExtension.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nskAB8E.tmp\poinstaller.exe N/A
N/A N/A C:\Program Files (x86)\PremierOpinion\pmropn.exe N/A
N/A N/A C:\Program Files (x86)\PremierOpinion\pmservice.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\DnsService.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1671301472.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\meroplex.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Air Cluster Pro 130.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp N/A
N/A N/A C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe N/A
N/A N/A C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe N/A
N/A N/A C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe N/A
N/A N/A C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe N/A
N/A N/A C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe N/A
N/A N/A C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-U5TKL.tmp\s5.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-U5TKL.tmp\s5.tmp N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s6.exe N/A

Reads user/profile data of web browsers

spyware stealer

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 9.9.9.9 N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\rahmatlukum.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\rahmatlukum.exe N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\F: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SYSWOW64\pmls.dll C:\Program Files (x86)\PremierOpinion\pmropn.exe N/A
File opened for modification C:\Windows\SYSWOW64\pmls.dll C:\Program Files (x86)\PremierOpinion\pmropn.exe N/A
File created C:\Windows\system32\pmls64.dll C:\Program Files (x86)\PremierOpinion\pmropn.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1671301472.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\meroplex.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\dl2AaL24LxDSqSJOJLa LLC\mpnfimp.dll C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp N/A
File created C:\Program Files (x86)\dl2AaL24LxDSqSJOJLa LLC\is-O4FJS.tmp C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp N/A
File created C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ini C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\PremierOpinion\pmservice.exe C:\Users\Admin\AppData\Local\Temp\nskAB8E.tmp\poinstaller.exe N/A
File created C:\Program Files (x86)\PremierOpinion\pmropn.exe C:\Users\Admin\AppData\Local\Temp\nskAB8E.tmp\poinstaller.exe N/A
File opened for modification C:\Program Files (x86)\Air Cluster Pro 130.exe\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp N/A
File created C:\Program Files (x86)\dl2AaL24LxDSqSJOJLa LLC\is-DNKM8.tmp C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp N/A
File created C:\Program Files (x86)\PremierOpinion\pmservice.exe C:\Users\Admin\AppData\Local\Temp\nskAB8E.tmp\poinstaller.exe N/A
File created C:\Program Files (x86)\PremierOpinion\pmls.dll C:\Users\Admin\AppData\Local\Temp\nskAB8E.tmp\poinstaller.exe N/A
File opened for modification C:\Program Files (x86)\PremierOpinion\pmropn.exe C:\Users\Admin\AppData\Local\Temp\nskAB8E.tmp\poinstaller.exe N/A
File opened for modification C:\Program Files (x86)\dl2AaL24LxDSqSJOJLa LLC\cnpacnoc.dll C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp N/A
File created C:\Program Files (x86)\PremierOpinion\pmropn32.exe C:\Users\Admin\AppData\Local\Temp\nskAB8E.tmp\poinstaller.exe N/A
File created C:\Program Files (x86)\Air Cluster Pro 130.exe\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp N/A
File opened for modification C:\Program Files (x86)\dl2AaL24LxDSqSJOJLa LLC\ODISSDK.dll C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp N/A
File opened for modification C:\Program Files (x86)\dl2AaL24LxDSqSJOJLa LLC\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp N/A
File opened for modification C:\Program Files (x86)\PremierOpinion\pmropn64.exe C:\Users\Admin\AppData\Local\Temp\nskAB8E.tmp\poinstaller.exe N/A
File created C:\Program Files (x86)\Air Cluster Pro 130.exe\is-4NU8N.tmp C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp N/A
File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\Privacy.url C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Air Cluster Pro 130.exe\is-02K75.tmp C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp N/A
File opened for modification C:\Program Files (x86)\PremierOpinion\pmls64.dll C:\Users\Admin\AppData\Local\Temp\nskAB8E.tmp\poinstaller.exe N/A
File created C:\Program Files (x86)\PremierOpinion\pmls64.dll C:\Users\Admin\AppData\Local\Temp\nskAB8E.tmp\poinstaller.exe N/A
File created C:\Program Files (x86)\PremierOpinion\pmropn64.exe C:\Users\Admin\AppData\Local\Temp\nskAB8E.tmp\poinstaller.exe N/A
File opened for modification C:\Program Files (x86)\PremierOpinion\pmropn32.exe C:\Users\Admin\AppData\Local\Temp\nskAB8E.tmp\poinstaller.exe N/A
File opened for modification C:\Program Files (x86)\dl2AaL24LxDSqSJOJLa LLC\mfcm140.dll C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp N/A
File opened for modification C:\Program Files (x86)\Air Cluster Pro 130.exe\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp N/A
File created C:\Program Files (x86)\dl2AaL24LxDSqSJOJLa LLC\is-45MRC.tmp C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp N/A
File created C:\Program Files (x86)\dl2AaL24LxDSqSJOJLa LLC\is-CMBBC.tmp C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp N/A
File created C:\Program Files (x86)\dl2AaL24LxDSqSJOJLa LLC\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp N/A
File created C:\Program Files (x86)\dl2AaL24LxDSqSJOJLa LLC\is-UQLJL.tmp C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp N/A
File created C:\Program Files (x86)\dl2AaL24LxDSqSJOJLa LLC\is-IUBEB.tmp C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp N/A
File created C:\Program Files (x86)\AW Manager\Windows Manager\Uninstall.lnk C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\EULA.url C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\PremierOpinion\pmls.dll C:\Users\Admin\AppData\Local\Temp\nskAB8E.tmp\poinstaller.exe N/A
File opened for modification C:\Program Files (x86)\dl2AaL24LxDSqSJOJLa LLC\DMReportSnapshot.dll C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\MSI8CB7.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIA77C.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSICB81.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI910E.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIC559.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSICF88.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSICFB8.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\6e8151.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSID2B8.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSID6DF.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\6e8151.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI8C39.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\6e8155.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Logs\DPX\setupact.log C:\Windows\SysWOW64\expand.exe N/A
File opened for modification C:\Windows\Installer\MSI8E4F.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI896B.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSID110.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSID1AD.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\6e8153.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Logs\DPX\setuperr.log C:\Windows\SysWOW64\expand.exe N/A
File created C:\Windows\Installer\6e8153.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI8D83.tmp C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\Programs\Adblock\Adblock.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eb4bce00ffaaaf46b42b39f311b0211a000000000200000000001066000000010000200000000df1c922c46626533c6849b1ddcf0cca731009523c85291a0323bacd6e149ebd000000000e80000000020000200000005fbd0e425623eba7da5ef617af12a1bcf929c93529deb7bef8187109fe2133b220000000039ce448baed0a08b11f5ab6b8d52fe3cb1ede9a4d9e8cc73d80b6f92b95b37b40000000b5fd96eedefdd71aec67f32e13d8d7747cbe94276895c21a27ca3d2a97c615a0e2e6fe3398afa74fe179c6fabf48b2b47d727a13afb7e8f0ed5a0770ec3d16d6 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395711778" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
Key created \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0edcca0c0b2d901 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eb4bce00ffaaaf46b42b39f311b0211a00000000020000000000106600000001000020000000b2cf69fc027502926d9319b592d79222c8a74a8b604428cae92ac74b10f49713000000000e8000000002000020000000b2e8345654fe79fb8beba6abe7957a2a74157ae2304b8de0ceb3da3427a4894e90000000f70e9bbb408f525068db310db38e07454947ae68f8c370b48594260de4b13632b2b9db8361ee40aa43700b7f182ef69ed8d8ff955a8a56634356f58b2bd634b79938b632a1581e5153e77e471676d2a66f073cd2f0158a8aa9e6d7cf0660f9925a0d7c550c5520759a60dc0e4b35ecc817302db0f3849c0e7f95ebdf4e615e763bcdb00f2da6b7b3006fa9cfb2c5c031400000006cae564cdf71d6ebc4ce7f5bb41c0b57b466f4e31ba679c890144ade7fdaf66c303a924ccc690da6cd0528fe0929bc3acc94336f55b69d7b7aaba1a7fa45ed13 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA5290E1-1EB3-11EE-A571-E2628752BD04} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E C:\Windows\system32\msiexec.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\ProductName = "Windows Manager" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Language = "1033" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\AuthorizedLUAApp = "0" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\DeploymentFlags = "3" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5785CBDF4ABB5AD409841A692AF14EA9\C414548CC3098124D97E31A29BF7FD26 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Media C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\PackageCode = "B8DDBE5C483C5BC4A933A9E42F81D915" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Version = "16777216" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\ProductIcon = "C:\\Windows\\Installer\\{C845414C-903C-4218-9DE7-132AB97FDF62}\\logo.exe" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C414548CC3098124D97E31A29BF7FD26 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C414548CC3098124D97E31A29BF7FD26\MainFeature C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5785CBDF4ABB5AD409841A692AF14EA9 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\PackageName = "Windows Manager - Postback Johan.msi" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\AW Manager\\Windows Manager 1.0.0\\install\\97FDF62\\" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Media\DiskPrompt = "[1]" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Assignment = "1" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\AdvertiseFlags = "388" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\InstanceType = "0" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Net C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Media\1 = ";" C:\Windows\system32\msiexec.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Clients = 3a0000000000 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\AW Manager\\Windows Manager 1.0.0\\install\\97FDF62\\" C:\Windows\system32\msiexec.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s6.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s6.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s6.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s6.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1671301472.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1671301472.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1671301472.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\meroplex.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\meroplex.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp N/A
N/A N/A C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-U5TKL.tmp\s5.tmp N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2340 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\Air Cluster Pro 130.exe C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp
PID 2340 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\Air Cluster Pro 130.exe C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp
PID 2340 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\Air Cluster Pro 130.exe C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp
PID 2340 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\Air Cluster Pro 130.exe C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp
PID 2340 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\Air Cluster Pro 130.exe C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp
PID 2340 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\Air Cluster Pro 130.exe C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp
PID 2340 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\Air Cluster Pro 130.exe C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp
PID 908 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp C:\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe
PID 908 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp C:\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe
PID 908 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp C:\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe
PID 908 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp C:\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe
PID 908 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp C:\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe
PID 908 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp C:\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe
PID 908 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp C:\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe
PID 1088 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp
PID 1088 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp
PID 1088 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp
PID 1088 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp
PID 1088 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp
PID 1088 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp
PID 1088 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp
PID 2084 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s0.exe
PID 2084 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s0.exe
PID 2084 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s0.exe
PID 2084 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s0.exe
PID 2084 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s0.exe
PID 2084 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s0.exe
PID 2084 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s0.exe
PID 836 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s0.exe C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp
PID 836 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s0.exe C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp
PID 836 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s0.exe C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp
PID 836 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s0.exe C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp
PID 836 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s0.exe C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp
PID 836 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s0.exe C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp
PID 836 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s0.exe C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp
PID 608 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp C:\Windows\SysWOW64\cmd.exe
PID 608 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp C:\Windows\SysWOW64\cmd.exe
PID 608 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp C:\Windows\SysWOW64\cmd.exe
PID 608 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp C:\Windows\SysWOW64\cmd.exe
PID 1960 wrote to memory of 2420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 1960 wrote to memory of 2420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 1960 wrote to memory of 2420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 1960 wrote to memory of 2420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 608 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp C:\Windows\SysWOW64\cmd.exe
PID 608 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp C:\Windows\SysWOW64\cmd.exe
PID 608 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp C:\Windows\SysWOW64\cmd.exe
PID 608 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp C:\Windows\SysWOW64\cmd.exe
PID 2784 wrote to memory of 2892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2784 wrote to memory of 2892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2784 wrote to memory of 2892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2784 wrote to memory of 2892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 608 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe
PID 608 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe
PID 608 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe
PID 608 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe
PID 608 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp C:\Windows\SysWOW64\cmd.exe
PID 608 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp C:\Windows\SysWOW64\cmd.exe
PID 608 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp C:\Windows\SysWOW64\cmd.exe
PID 608 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp C:\Windows\SysWOW64\cmd.exe
PID 2084 wrote to memory of 2304 N/A C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s2.exe
PID 2084 wrote to memory of 2304 N/A C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s2.exe
PID 2084 wrote to memory of 2304 N/A C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s2.exe
PID 2084 wrote to memory of 2304 N/A C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s2.exe
PID 2304 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s2.exe C:\Windows\SysWOW64\cmd.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Air Cluster Pro 130.exe

"C:\Users\Admin\AppData\Local\Temp\Air Cluster Pro 130.exe"

C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp

"C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp" /SL5="$90124,833540,832512,C:\Users\Admin\AppData\Local\Temp\Air Cluster Pro 130.exe"

C:\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe

"C:\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe"

C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp

"C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp" /SL5="$501A2,938139,832512,C:\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe"

C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s0.exe

"C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s0.exe" /VERYSILENT /PASSWORD=NtIRVUpMK9ZD30Nf98220 -token mtn1co3fo4gs5vwq -subid 2217

C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp

"C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp" /SL5="$10226,9877208,832512,C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s0.exe" /VERYSILENT /PASSWORD=NtIRVUpMK9ZD30Nf98220 -token mtn1co3fo4gs5vwq -subid 2217

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-RB18J.tmp\{app}\cvysapfvmvsjevb.cab -F:* %ProgramData%

C:\Windows\SysWOW64\expand.exe

expand C:\Users\Admin\AppData\Local\Temp\is-RB18J.tmp\{app}\cvysapfvmvsjevb.cab -F:* C:\ProgramData

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\wmiprvse.exe" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe" /f

C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe

"C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c start https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i^&c=5306757^&pl=0x00^&pb=1^&px=2217

C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s2.exe

"C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s2.exe" /usten SUB=2217

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c taskkill /im "s2.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s2.exe" & exit

C:\Windows\SysWOW64\taskkill.exe

taskkill /im "s2.exe" /f

C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe

"C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe" /qn CAMPAIGN="2217"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 228C4D49FCBAC0798151B2057DA4F1C0 C

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi" /qn CAMPAIGN=2217 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1688939445 /qn CAMPAIGN=""2217"" " CAMPAIGN="2217"

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 275447B7DE5EDCDA158688A518DF3471

C:\Windows\SysWOW64\taskkill.exe

"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding DC91C32924D3C2D08E6342A41CA4C132 M Global\MSI0000

C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s4.exe

"C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s4.exe"

C:\Users\Admin\AppData\Local\Temp\1671301472.exe

C:\Users\Admin\AppData\Local\Temp\1671301472.exe

C:\Users\Admin\AppData\Local\Temp\meroplex.exe

C:\Users\Admin\AppData\Local\Temp\meroplex.exe

C:\Users\Admin\AppData\Local\Temp\rahmatlukum.exe

C:\Users\Admin\AppData\Local\Temp\rahmatlukum.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\researchprevailing.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\researchprevailing.exe

C:\Users\Admin\AppData\Local\Temp\lukumrahmat.exe

C:\Users\Admin\AppData\Local\Temp\lukumrahmat.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s4.exe & exit

C:\Windows\system32\PING.EXE

ping 0

C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s5.exe

"C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s5.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /INSTALLERSHOWNELSEWHERE /sid=2217

C:\Users\Admin\AppData\Local\Temp\is-U5TKL.tmp\s5.tmp

"C:\Users\Admin\AppData\Local\Temp\is-U5TKL.tmp\s5.tmp" /SL5="$202B4,16940999,792064,C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s5.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /INSTALLERSHOWNELSEWHERE /sid=2217

C:\Windows\SysWOW64\ipconfig.exe

"C:\Windows\System32\ipconfig.exe" /flushdns

C:\Windows\system32\taskkill.exe

"taskkill.exe" /f /im "Adblock.exe"

C:\Windows\system32\taskkill.exe

"taskkill.exe" /f /im "MassiveEngine.exe"

C:\Windows\system32\taskkill.exe

"taskkill.exe" /f /im "MassiveExtension.exe"

C:\Users\Admin\Programs\Adblock\Adblock.exe

"C:\Users\Admin\Programs\Adblock\Adblock.exe" --installerSessionId=c1c8bcc41688946756 --downloadDate=2023-07-09T23:52:32 --distId=marketator2 --sid=2217

C:\Windows\system32\cmd.exe

"cmd.exe" /c "reg copy HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /s /f"

C:\Windows\system32\reg.exe

reg copy HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /s /f

C:\Windows\system32\cmd.exe

"cmd.exe" /c "reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /f"

C:\Windows\system32\reg.exe

reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /f

C:\Users\Admin\Programs\Adblock\crashpad_handler.exe

C:\Users\Admin\Programs\Adblock\crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps" "--metrics-dir=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps" --url=https://o428832.ingest.sentry.io:443/api/5420194/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=06798e99d7ee416faaf4e01cd2f1faaf "--attachment=C:\Users\Admin\AppData\Roaming\Adblock Fast\log.txt" "--attachment=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\98f7b2f0-c30c-4f63-5584-a24cdedb92d5.run\__sentry-event" "--attachment=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\98f7b2f0-c30c-4f63-5584-a24cdedb92d5.run\__sentry-breadcrumb1" "--attachment=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\98f7b2f0-c30c-4f63-5584-a24cdedb92d5.run\__sentry-breadcrumb2" --initial-client-data=0x1e4,0x1e8,0x1ec,0x1b8,0x1f0,0x13f4ad340,0x13f4ad358,0x13f4ad370

C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s6.exe

"C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s6.exe"

C:\Users\Admin\Programs\Adblock\DnsService.exe

C:\Users\Admin\Programs\Adblock\DnsService.exe /abfpid:2164

C:\Windows\system32\netsh.exe

C:\Windows\system32\netsh.exe firewall add allowedprogram "C:\Users\Admin\Programs\Adblock\DnsService.exe" AdBlockFast ENABLE

C:\Users\Admin\Programs\Adblock\MassiveExtension.exe

C:\Users\Admin\Programs\Adblock\MassiveExtension.exe proxy --dumps_path "C:\Users\Admin\AppData\Roaming\Adblock Fast\Massive\crashdumps" --h_path "C:\Users\Admin\Programs\Adblock\crashpad_handler.exe" --log_path "C:\Users\Admin\AppData\Roaming\Adblock Fast\Massive\logs" --src https://[email protected]/5375291 --allow_reporting true --version 0.16.0 --env prod --product_id massivesdk

C:\Users\Admin\AppData\Local\Temp\nskAB8E.tmp\poinstaller.exe

"C:\Users\Admin\AppData\Local\Temp\nskAB8E.tmp\poinstaller.exe" -c:1517 -t:2217 /s

C:\Program Files (x86)\PremierOpinion\pmropn.exe

C:\Program Files (x86)\PremierOpinion\pmropn.exe -install -uninst:PremierOpinion -t:2217 /s -bid:LNqfKIvckXVU567GiuPOPN -o:0

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram program = "c:\program files (x86)\premieropinion\pmropn.exe" name = pmropn.exe mode = ENABLE scope = ALL

C:\Program Files (x86)\PremierOpinion\pmservice.exe

"C:\Program Files (x86)\PremierOpinion\pmservice.exe" /service

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://da26gklo05t50.cloudfront.net/tracker/thank_you.php?trk=2217

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:2

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x0

C:\Users\Admin\Programs\Adblock\DnsService.exe

C:\Users\Admin\Programs\Adblock\DnsService.exe /abfpid:2164

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x50c

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x1

Network

Country Destination Domain Proto
US 8.8.8.8:53 yearcoal.online udp
US 172.67.220.175:80 yearcoal.online tcp
US 8.8.8.8:53 geesemonth.xyz udp
US 172.67.149.68:80 geesemonth.xyz tcp
US 8.8.8.8:53 www.cobaltshoesx.com udp
US 149.102.225.29:443 www.cobaltshoesx.com tcp
US 8.8.8.8:53 apps.identrust.com udp
US 2.18.121.68:80 apps.identrust.com tcp
US 8.8.8.8:53 str.skymiddle.host udp
US 188.114.97.0:80 str.skymiddle.host tcp
US 8.8.8.8:53 act.reactionharbor.xyz udp
US 188.114.96.0:80 act.reactionharbor.xyz tcp
US 8.8.8.8:53 www.mildstat.com udp
GB 23.106.59.52:80 www.mildstat.com tcp
US 8.8.8.8:53 www.mminnn.com udp
GB 23.106.59.45:80 www.mminnn.com tcp
US 8.8.8.8:53 geo.netsupportsoftware.com udp
GB 62.172.138.67:80 geo.netsupportsoftware.com tcp
US 8.8.8.8:53 koppertrain.top udp
DE 45.15.157.190:1203 koppertrain.top tcp
NL 45.12.253.74:80 45.12.253.74 tcp
NL 45.12.253.56:80 45.12.253.56 tcp
US 8.8.8.8:53 londontownlink.com udp
DE 164.92.247.217:80 londontownlink.com tcp
US 8.8.8.8:53 collect.installeranalytics.com udp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 8.8.8.8:53 ocsp.r2m01.amazontrust.com udp
DE 52.222.226.205:80 ocsp.r2m01.amazontrust.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 8.8.8.8:53 ambasoft.info udp
NL 193.42.110.193:80 ambasoft.info tcp
US 8.8.8.8:53 carambasti.info udp
NL 193.42.110.193:80 carambasti.info tcp
US 8.8.8.8:53 iplogger.com udp
DE 148.251.234.93:443 iplogger.com tcp
DE 148.251.234.93:443 iplogger.com tcp
DE 148.251.234.93:443 iplogger.com tcp
DE 148.251.234.93:443 iplogger.com tcp
US 8.8.8.8:53 b47n300.info udp
LV 94.140.112.52:80 b47n300.info tcp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.13.31:443 api.ip.sb tcp
US 8.8.8.8:53 n57b30a.info udp
LV 94.140.112.52:81 n57b30a.info tcp
US 104.26.13.31:443 api.ip.sb tcp
US 188.114.97.0:80 act.reactionharbor.xyz tcp
US 8.8.8.8:53 files.catbox.moe udp
CA 108.181.20.35:443 files.catbox.moe tcp
US 8.8.8.8:53 downloads.adblockfast.com udp
US 104.21.93.193:443 downloads.adblockfast.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 8.8.8.8:53 api.joinmassive.com udp
CA 108.181.20.35:443 files.catbox.moe tcp
NL 65.9.86.78:443 api.joinmassive.com tcp
NL 65.9.86.78:443 api.joinmassive.com tcp
NL 65.9.86.78:443 api.joinmassive.com tcp
NL 65.9.86.78:443 api.joinmassive.com tcp
NL 65.9.86.78:443 api.joinmassive.com tcp
NL 65.9.86.78:443 api.joinmassive.com tcp
NL 65.9.86.78:443 api.joinmassive.com tcp
NL 65.9.86.78:443 api.joinmassive.com tcp
NL 65.9.86.78:443 api.joinmassive.com tcp
NL 65.9.86.78:443 api.joinmassive.com tcp
NL 65.9.86.78:443 api.joinmassive.com tcp
NL 65.9.86.78:443 api.joinmassive.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 8.8.8.8:53 api.joinmassive.com udp
NL 65.9.86.115:443 api.joinmassive.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
NL 65.9.86.115:443 api.joinmassive.com tcp
NL 65.9.86.115:443 api.joinmassive.com tcp
NL 65.9.86.115:443 api.joinmassive.com tcp
NL 65.9.86.115:443 api.joinmassive.com tcp
NL 65.9.86.115:443 api.joinmassive.com tcp
NL 65.9.86.115:443 api.joinmassive.com tcp
NL 65.9.86.115:443 api.joinmassive.com tcp
NL 65.9.86.115:443 api.joinmassive.com tcp
NL 65.9.86.115:443 api.joinmassive.com tcp
NL 65.9.86.115:443 api.joinmassive.com tcp
NL 65.9.86.115:443 api.joinmassive.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 8.8.8.8:53 d1ql3z8u1oo390.cloudfront.net udp
NL 52.222.137.7:80 d1ql3z8u1oo390.cloudfront.net tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 9.9.9.9:53 www.msftncsi.com udp
US 8.8.8.8:53 downloads.joinmassive.com udp
US 18.65.39.36:443 downloads.joinmassive.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 8.8.8.8:53 post.securestudies.com udp
CA 108.181.20.35:443 files.catbox.moe tcp
US 8.8.8.8:53 api.joinmassive.com udp
US 165.193.78.234:443 post.securestudies.com tcp
NL 65.9.86.117:443 api.joinmassive.com tcp
US 18.65.39.36:443 downloads.joinmassive.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
NL 65.9.86.117:443 api.joinmassive.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 18.65.39.36:443 downloads.joinmassive.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 18.65.39.36:443 downloads.joinmassive.com tcp
US 18.65.39.36:443 downloads.joinmassive.com tcp
N/A 127.0.0.1:50515 tcp
US 18.65.39.36:443 downloads.joinmassive.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 18.65.39.36:443 downloads.joinmassive.com tcp
US 8.8.8.8:53 ocsp.r2m02.amazontrust.com udp
DE 52.222.226.205:80 ocsp.r2m02.amazontrust.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
N/A 127.0.0.1:50534 tcp
N/A 127.0.0.1:50538 tcp
N/A 127.0.0.1:50542 tcp
N/A 127.0.0.1:50557 tcp
N/A 127.0.0.1:50563 tcp
N/A 127.0.0.1:50576 tcp
N/A 127.0.0.1:50590 tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
NL 65.9.86.23:443 api.joinmassive.com tcp
NL 65.9.86.23:443 api.joinmassive.com tcp
NL 65.9.86.117:443 api.joinmassive.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
NL 65.9.86.23:443 api.joinmassive.com tcp
NL 65.9.86.117:443 api.joinmassive.com tcp
NL 65.9.86.23:443 api.joinmassive.com tcp
US 8.8.8.8:53 api.joinmassive.com udp
NL 65.9.86.78:443 api.joinmassive.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 165.193.78.234:443 post.securestudies.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 8.8.8.8:53 dpd.securestudies.com udp
NL 65.9.86.104:443 dpd.securestudies.com tcp
US 8.8.8.8:53 ocsp.r2m01.amazontrust.com udp
US 18.239.100.55:80 ocsp.r2m01.amazontrust.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 165.193.78.234:443 post.securestudies.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 8.8.8.8:53 geo-network.joinmassive.com udp
US 44.241.114.175:8017 geo-network.joinmassive.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
N/A 127.0.0.1:50650 tcp
N/A 127.0.0.1:50676 tcp
N/A 127.0.0.1:50683 tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
N/A 127.0.0.1:50690 tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 165.193.78.234:443 post.securestudies.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
N/A 127.0.0.1:50717 tcp
N/A 127.0.0.1:50733 tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 165.193.78.234:443 post.securestudies.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 165.193.78.234:443 post.securestudies.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 8.8.8.8:53 post.securestudies.com udp
US 165.193.78.234:443 post.securestudies.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 165.193.78.234:443 post.securestudies.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 8.8.8.8:53 dpd.securestudies.com udp
CA 108.181.20.35:443 files.catbox.moe tcp
NL 65.9.86.104:443 dpd.securestudies.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
N/A 127.0.0.1:50966 tcp
N/A 127.0.0.1:50977 tcp
N/A 127.0.0.1:50982 tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 8.8.8.8:53 rules.securestudies.com udp
US 66.119.41.119:443 rules.securestudies.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 8.8.8.8:53 www.premieropinion.com udp
US 165.193.78.250:80 www.premieropinion.com tcp
US 8.8.8.8:53 da26gklo05t50.cloudfront.net udp
US 165.193.78.250:443 www.premieropinion.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
N/A 127.0.0.1:51039 tcp
N/A 127.0.0.1:51041 tcp
NL 108.156.61.55:443 da26gklo05t50.cloudfront.net tcp
NL 108.156.61.55:443 da26gklo05t50.cloudfront.net tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 165.193.78.234:443 post.securestudies.com tcp
US 8.8.8.8:53 stackpath.bootstrapcdn.com udp
US 104.18.11.207:443 stackpath.bootstrapcdn.com tcp
US 104.18.11.207:443 stackpath.bootstrapcdn.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 8.8.8.8:53 save.enabledstats.com udp
US 3.216.197.213:443 save.enabledstats.com tcp
US 3.216.197.213:443 save.enabledstats.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 8.8.8.8:53 ocsp.r2m01.amazontrust.com udp
US 8.8.8.8:53 ocsp.r2m01.amazontrust.com udp
US 18.239.100.55:80 ocsp.r2m01.amazontrust.com tcp
US 18.239.100.55:80 ocsp.r2m01.amazontrust.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
N/A 127.0.0.1:51086 tcp
N/A 127.0.0.1:51088 tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 165.193.78.234:443 post.securestudies.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
N/A 127.0.0.1:51141 tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
US 8.8.8.8:53 files.catbox.moe udp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp
CA 108.181.20.35:443 files.catbox.moe tcp

Files

memory/2340-54-0x0000000000400000-0x00000000004D8000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp

MD5 c1186d360e7b3db56757bc78a428f486
SHA1 2018c76fa571ce86c8beddc70589aab0a380e3e4
SHA256 999b0adc768a8a974e04fa9fe6c44abf026b0847ba1926b2513236ef90334ab5
SHA512 af2e6084f25ca2745421f227868f214d5e12c3ee23f7ee52d35b57705d1b7c3adb5863549738e673288b7fd5ac959a6e47f52f7397af374fa8a04080cfc9e502

C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp

MD5 c1186d360e7b3db56757bc78a428f486
SHA1 2018c76fa571ce86c8beddc70589aab0a380e3e4
SHA256 999b0adc768a8a974e04fa9fe6c44abf026b0847ba1926b2513236ef90334ab5
SHA512 af2e6084f25ca2745421f227868f214d5e12c3ee23f7ee52d35b57705d1b7c3adb5863549738e673288b7fd5ac959a6e47f52f7397af374fa8a04080cfc9e502

memory/908-62-0x0000000000240000-0x0000000000241000-memory.dmp

memory/2340-63-0x0000000000400000-0x00000000004D8000-memory.dmp

memory/908-64-0x0000000000400000-0x000000000071C000-memory.dmp

memory/908-65-0x0000000000240000-0x0000000000241000-memory.dmp

memory/908-72-0x0000000000400000-0x000000000071C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-STEF3.tmp\Air Cluster Pro 130.tmp

MD5 c1186d360e7b3db56757bc78a428f486
SHA1 2018c76fa571ce86c8beddc70589aab0a380e3e4
SHA256 999b0adc768a8a974e04fa9fe6c44abf026b0847ba1926b2513236ef90334ab5
SHA512 af2e6084f25ca2745421f227868f214d5e12c3ee23f7ee52d35b57705d1b7c3adb5863549738e673288b7fd5ac959a6e47f52f7397af374fa8a04080cfc9e502

\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe

MD5 435d1f832643e1644d3acd0c07865b17
SHA1 c93c66cfc41b29b3b6b826809283f0826b652799
SHA256 996f52042a0a448e33a3688faa7b8e5493b0f51d95d5ec4ff3fb875f18dbea13
SHA512 dfdc4fcfea634a4d24351bc1c89cbe2e9b3ddd90d64bdda33d5edba84b5efba727b58814a206daf16b7e8349efb05212e1dc4d13ed3edf3979cd82f0bb35bfa5

C:\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe

MD5 435d1f832643e1644d3acd0c07865b17
SHA1 c93c66cfc41b29b3b6b826809283f0826b652799
SHA256 996f52042a0a448e33a3688faa7b8e5493b0f51d95d5ec4ff3fb875f18dbea13
SHA512 dfdc4fcfea634a4d24351bc1c89cbe2e9b3ddd90d64bdda33d5edba84b5efba727b58814a206daf16b7e8349efb05212e1dc4d13ed3edf3979cd82f0bb35bfa5

\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe

MD5 435d1f832643e1644d3acd0c07865b17
SHA1 c93c66cfc41b29b3b6b826809283f0826b652799
SHA256 996f52042a0a448e33a3688faa7b8e5493b0f51d95d5ec4ff3fb875f18dbea13
SHA512 dfdc4fcfea634a4d24351bc1c89cbe2e9b3ddd90d64bdda33d5edba84b5efba727b58814a206daf16b7e8349efb05212e1dc4d13ed3edf3979cd82f0bb35bfa5

\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe

MD5 435d1f832643e1644d3acd0c07865b17
SHA1 c93c66cfc41b29b3b6b826809283f0826b652799
SHA256 996f52042a0a448e33a3688faa7b8e5493b0f51d95d5ec4ff3fb875f18dbea13
SHA512 dfdc4fcfea634a4d24351bc1c89cbe2e9b3ddd90d64bdda33d5edba84b5efba727b58814a206daf16b7e8349efb05212e1dc4d13ed3edf3979cd82f0bb35bfa5

\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe

MD5 435d1f832643e1644d3acd0c07865b17
SHA1 c93c66cfc41b29b3b6b826809283f0826b652799
SHA256 996f52042a0a448e33a3688faa7b8e5493b0f51d95d5ec4ff3fb875f18dbea13
SHA512 dfdc4fcfea634a4d24351bc1c89cbe2e9b3ddd90d64bdda33d5edba84b5efba727b58814a206daf16b7e8349efb05212e1dc4d13ed3edf3979cd82f0bb35bfa5

\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe

MD5 435d1f832643e1644d3acd0c07865b17
SHA1 c93c66cfc41b29b3b6b826809283f0826b652799
SHA256 996f52042a0a448e33a3688faa7b8e5493b0f51d95d5ec4ff3fb875f18dbea13
SHA512 dfdc4fcfea634a4d24351bc1c89cbe2e9b3ddd90d64bdda33d5edba84b5efba727b58814a206daf16b7e8349efb05212e1dc4d13ed3edf3979cd82f0bb35bfa5

C:\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe

MD5 435d1f832643e1644d3acd0c07865b17
SHA1 c93c66cfc41b29b3b6b826809283f0826b652799
SHA256 996f52042a0a448e33a3688faa7b8e5493b0f51d95d5ec4ff3fb875f18dbea13
SHA512 dfdc4fcfea634a4d24351bc1c89cbe2e9b3ddd90d64bdda33d5edba84b5efba727b58814a206daf16b7e8349efb05212e1dc4d13ed3edf3979cd82f0bb35bfa5

C:\Users\Admin\AppData\Local\Temp\is-LOSLD.tmp\setup.exe

MD5 435d1f832643e1644d3acd0c07865b17
SHA1 c93c66cfc41b29b3b6b826809283f0826b652799
SHA256 996f52042a0a448e33a3688faa7b8e5493b0f51d95d5ec4ff3fb875f18dbea13
SHA512 dfdc4fcfea634a4d24351bc1c89cbe2e9b3ddd90d64bdda33d5edba84b5efba727b58814a206daf16b7e8349efb05212e1dc4d13ed3edf3979cd82f0bb35bfa5

memory/1088-95-0x0000000000400000-0x00000000004D8000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp

MD5 f8a2f4a300c0655e6681f5b6b3a20c27
SHA1 e8a3971dca03c4be5cf483fcef04b14a32d22eba
SHA256 09413d7208f0b830bb7e7e4f8d421e6ca83c5336b7abfc8428e8ba756e87be22
SHA512 db7b946804f46e0dc03db2aa5c259caf893758f47dd5e7c2a6320081b3f52b44d6714fcfadc08f40f8f269cd0c5d458aaca7f35d1fb4e843b6424acf921f859c

C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp

MD5 f8a2f4a300c0655e6681f5b6b3a20c27
SHA1 e8a3971dca03c4be5cf483fcef04b14a32d22eba
SHA256 09413d7208f0b830bb7e7e4f8d421e6ca83c5336b7abfc8428e8ba756e87be22
SHA512 db7b946804f46e0dc03db2aa5c259caf893758f47dd5e7c2a6320081b3f52b44d6714fcfadc08f40f8f269cd0c5d458aaca7f35d1fb4e843b6424acf921f859c

C:\Users\Admin\AppData\Local\Temp\is-JDQHG.tmp\setup.tmp

MD5 f8a2f4a300c0655e6681f5b6b3a20c27
SHA1 e8a3971dca03c4be5cf483fcef04b14a32d22eba
SHA256 09413d7208f0b830bb7e7e4f8d421e6ca83c5336b7abfc8428e8ba756e87be22
SHA512 db7b946804f46e0dc03db2aa5c259caf893758f47dd5e7c2a6320081b3f52b44d6714fcfadc08f40f8f269cd0c5d458aaca7f35d1fb4e843b6424acf921f859c

\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\_isetup\_isdecmp.dll

MD5 077cb4461a2767383b317eb0c50f5f13
SHA1 584e64f1d162398b7f377ce55a6b5740379c4282
SHA256 8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64
SHA512 b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547

\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\idp.dll

MD5 55c310c0319260d798757557ab3bf636
SHA1 0892eb7ed31d8bb20a56c6835990749011a2d8de
SHA256 54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
SHA512 e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

memory/2084-110-0x0000000000240000-0x0000000000241000-memory.dmp

memory/908-112-0x0000000000400000-0x000000000071C000-memory.dmp

memory/1088-113-0x0000000000400000-0x00000000004D8000-memory.dmp

memory/2084-114-0x0000000000400000-0x000000000071C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab3EA.tmp

MD5 3ac860860707baaf32469fa7cc7c0192
SHA1 c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256 d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512 d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

C:\Users\Admin\AppData\Local\Temp\Tar535.tmp

MD5 4ff65ad929cd9a367680e0e5b1c08166
SHA1 c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256 c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512 f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5eef291b37b46917c5a0363e246817dc
SHA1 7b31880a5fa6850bf473208e0dfe266fb0583040
SHA256 17fc48174f42327773fce4e08da68840b541cca1af9891abeefa519b8e574eea
SHA512 0014414d558ffc5f4635f5439b338e7aa69a2197e00043b763f8847b3bda803dd330e7d950f2a85f3bfd0643419a4f3cd4282cc1fe9d68cc537f34dd0ba7abca

\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s0.exe

MD5 52742e7ca3ab70176f9e7797be655e1f
SHA1 46240ce20582f88513bf1fc86db6a749d97cb75d
SHA256 4ec6ccb79b66699a67b7df4275f4abc87421a2e1a75b15f528ed9964aa5fffb4
SHA512 41e77621d8f2911b316ce27636dc2ddf509f98ad3a17a60258e36599613131b20068050dcdc02c072a3d4d08ffb3396d6ae50aca2034c21dfc35db5bd825541d

memory/2084-207-0x0000000000400000-0x000000000071C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s0.exe

MD5 52742e7ca3ab70176f9e7797be655e1f
SHA1 46240ce20582f88513bf1fc86db6a749d97cb75d
SHA256 4ec6ccb79b66699a67b7df4275f4abc87421a2e1a75b15f528ed9964aa5fffb4
SHA512 41e77621d8f2911b316ce27636dc2ddf509f98ad3a17a60258e36599613131b20068050dcdc02c072a3d4d08ffb3396d6ae50aca2034c21dfc35db5bd825541d

memory/836-212-0x0000000000400000-0x00000000004D8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s0.exe

MD5 52742e7ca3ab70176f9e7797be655e1f
SHA1 46240ce20582f88513bf1fc86db6a749d97cb75d
SHA256 4ec6ccb79b66699a67b7df4275f4abc87421a2e1a75b15f528ed9964aa5fffb4
SHA512 41e77621d8f2911b316ce27636dc2ddf509f98ad3a17a60258e36599613131b20068050dcdc02c072a3d4d08ffb3396d6ae50aca2034c21dfc35db5bd825541d

\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp

MD5 35641ce29349e4ff8019362c2f1a6713
SHA1 4bde30eb8814b07ae39ad72516071b1abc9e4f70
SHA256 b09afb08306f1e125e35d0224ec3e33be32d6efc9691fe0803e9fdd87d440b83
SHA512 0c13469f714e7511f5f4f2cbca39e614ac65e8077683ed5a67153e81a02d9d7768e696981881f31ca02c23db9e961c0fe64ad1e01630a1ffb4f360bffd3915a2

C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp

MD5 35641ce29349e4ff8019362c2f1a6713
SHA1 4bde30eb8814b07ae39ad72516071b1abc9e4f70
SHA256 b09afb08306f1e125e35d0224ec3e33be32d6efc9691fe0803e9fdd87d440b83
SHA512 0c13469f714e7511f5f4f2cbca39e614ac65e8077683ed5a67153e81a02d9d7768e696981881f31ca02c23db9e961c0fe64ad1e01630a1ffb4f360bffd3915a2

\Users\Admin\AppData\Local\Temp\is-RB18J.tmp\_isetup\_iscrypt.dll

MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

memory/608-224-0x00000000001D0000-0x00000000001D1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-7ET86.tmp\s0.tmp

MD5 35641ce29349e4ff8019362c2f1a6713
SHA1 4bde30eb8814b07ae39ad72516071b1abc9e4f70
SHA256 b09afb08306f1e125e35d0224ec3e33be32d6efc9691fe0803e9fdd87d440b83
SHA512 0c13469f714e7511f5f4f2cbca39e614ac65e8077683ed5a67153e81a02d9d7768e696981881f31ca02c23db9e961c0fe64ad1e01630a1ffb4f360bffd3915a2

\??\c:\users\admin\appdata\local\temp\is-rb18j.tmp\{app}\cvysapfvmvsjevb.cab

MD5 311b9064d72279593f2e540468d02928
SHA1 3b48b75468fd479c618d94a1a9af4b30cfbc19f0
SHA256 43d5335af9a54cfec3bb22ab903066ee1415b85d8668975ffdb4e4e06962fd91
SHA512 054bd0d323dac576d8831e9049c695bca5b052ec33f03122995e0287fc9cf4b7547d794eca5214db11e8bc8582d27931d68e1bd7edfcaeee4fa161d23a130486

\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe

MD5 c0eb3eac96511077dafc0afa64c6388c
SHA1 33e81f25493eda3bbf0b7cdcddd523547fa6c31e
SHA256 eec4f18f3655f7eab0c08783ad42d2b3ce3ef21ecad7394e165f11acdb41c42a
SHA512 2632bef55323d9a272e1519e2b2792527d28cbd9fe6a9f9d253e5729978be0de6f36b8e3b2acee70449ba22a33efb41c82c82afe19dad14698b3ada0006ca7fc

C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe

MD5 c0eb3eac96511077dafc0afa64c6388c
SHA1 33e81f25493eda3bbf0b7cdcddd523547fa6c31e
SHA256 eec4f18f3655f7eab0c08783ad42d2b3ce3ef21ecad7394e165f11acdb41c42a
SHA512 2632bef55323d9a272e1519e2b2792527d28cbd9fe6a9f9d253e5729978be0de6f36b8e3b2acee70449ba22a33efb41c82c82afe19dad14698b3ada0006ca7fc

C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe

MD5 c0eb3eac96511077dafc0afa64c6388c
SHA1 33e81f25493eda3bbf0b7cdcddd523547fa6c31e
SHA256 eec4f18f3655f7eab0c08783ad42d2b3ce3ef21ecad7394e165f11acdb41c42a
SHA512 2632bef55323d9a272e1519e2b2792527d28cbd9fe6a9f9d253e5729978be0de6f36b8e3b2acee70449ba22a33efb41c82c82afe19dad14698b3ada0006ca7fc

C:\ProgramData\regid.1993-06.com.microsoft\PCICL32.dll

MD5 d3d39180e85700f72aaae25e40c125ff
SHA1 f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15
SHA256 38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5
SHA512 471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f

\ProgramData\regid.1993-06.com.microsoft\PCICL32.DLL

MD5 d3d39180e85700f72aaae25e40c125ff
SHA1 f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15
SHA256 38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5
SHA512 471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f

C:\ProgramData\regid.1993-06.com.microsoft\pcichek.dll

MD5 104b30fef04433a2d2fd1d5f99f179fe
SHA1 ecb08e224a2f2772d1e53675bedc4b2c50485a41
SHA256 956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd
SHA512 5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f

\ProgramData\regid.1993-06.com.microsoft\PCICHEK.DLL

MD5 104b30fef04433a2d2fd1d5f99f179fe
SHA1 ecb08e224a2f2772d1e53675bedc4b2c50485a41
SHA256 956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd
SHA512 5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f

C:\ProgramData\regid.1993-06.com.microsoft\MSVCR100.dll

MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

\ProgramData\regid.1993-06.com.microsoft\msvcr100.dll

MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

\ProgramData\regid.1993-06.com.microsoft\pcicapi.dll

MD5 34dfb87e4200d852d1fb45dc48f93cfc
SHA1 35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641
SHA256 2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703
SHA512 f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2

C:\ProgramData\regid.1993-06.com.microsoft\pcicapi.dll

MD5 34dfb87e4200d852d1fb45dc48f93cfc
SHA1 35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641
SHA256 2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703
SHA512 f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2

memory/608-300-0x0000000000400000-0x000000000071B000-memory.dmp

memory/836-303-0x0000000000400000-0x00000000004D8000-memory.dmp

C:\ProgramData\regid.1993-06.com.microsoft\NSM.LIC

MD5 e9609072de9c29dc1963be208948ba44
SHA1 03bbe27d0d1ba651ff43363587d3d6d2e170060f
SHA256 dc6a52ad6d637eb407cc060e98dfeedcca1167e7f62688fb1c18580dd1d05747
SHA512 f0e26aa63b0c7f1b31074b9d6eef88d0cfbc467f86b12205cb539a45b0352e77ce2f99f29baeab58960a197714e72289744143ba17975699d058fe75d978dfd0

C:\ProgramData\regid.1993-06.com.microsoft\client32.ini

MD5 ae72e7e3fcb4807d9b72e3797f7180d1
SHA1 d3891f3987b12221e7fdb44c61f6fcc808b8cf18
SHA256 bae70a72f9f759e748f04ee3241fd228775746823f4c912085fae4f63edb075c
SHA512 9aeda2de2970d07c09846da4533488e50c0c036dee88dac40cf19c556f59bf47cf65943d293b8299c254b73f8ff30f2a86176684a94cab6700dff2f3e5940a67

C:\ProgramData\regid.1993-06.com.microsoft\TCCTL32.DLL

MD5 2c88d947a5794cf995d2f465f1cb9d10
SHA1 c0ff9ea43771d712fe1878dbb6b9d7a201759389
SHA256 2b92ea2a7d2be8d64c84ea71614d0007c12d6075756313d61ddc40e4c4dd910e
SHA512 e55679ff66ded375a422a35d0f92b3ac825674894ae210dbef3642e4fc232c73114077e84eae45c6e99a60ef4811f4a900b680c3bf69214959fa152a3dfbe542

\ProgramData\regid.1993-06.com.microsoft\TCCTL32.DLL

MD5 2c88d947a5794cf995d2f465f1cb9d10
SHA1 c0ff9ea43771d712fe1878dbb6b9d7a201759389
SHA256 2b92ea2a7d2be8d64c84ea71614d0007c12d6075756313d61ddc40e4c4dd910e
SHA512 e55679ff66ded375a422a35d0f92b3ac825674894ae210dbef3642e4fc232c73114077e84eae45c6e99a60ef4811f4a900b680c3bf69214959fa152a3dfbe542

C:\ProgramData\regid.1993-06.com.microsoft\HTCTL32.DLL

MD5 c94005d2dcd2a54e40510344e0bb9435
SHA1 55b4a1620c5d0113811242c20bd9870a1e31d542
SHA256 3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899
SHA512 2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a

\ProgramData\regid.1993-06.com.microsoft\HTCTL32.DLL

MD5 c94005d2dcd2a54e40510344e0bb9435
SHA1 55b4a1620c5d0113811242c20bd9870a1e31d542
SHA256 3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899
SHA512 2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a

memory/2084-326-0x0000000000400000-0x000000000071C000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s2.exe

MD5 2ecbc6fceedd9bfd44839faae82199cf
SHA1 19a11b40c111ed91648461f7a2ca2c04be286297
SHA256 20f525d938924dd451e9abbc3339fa0e5dbd4c062b1660ee9a40cde53626ab7f
SHA512 ebbc0f86e96e424c5da1d687075b13dc6c03fbc3354b878f146d3448fe8090dccf76b32e8c338f64deaae89007593b9cd746716126ecb4354b327a31d5e2f558

C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s2.exe

MD5 2ecbc6fceedd9bfd44839faae82199cf
SHA1 19a11b40c111ed91648461f7a2ca2c04be286297
SHA256 20f525d938924dd451e9abbc3339fa0e5dbd4c062b1660ee9a40cde53626ab7f
SHA512 ebbc0f86e96e424c5da1d687075b13dc6c03fbc3354b878f146d3448fe8090dccf76b32e8c338f64deaae89007593b9cd746716126ecb4354b327a31d5e2f558

C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s2.exe

MD5 2ecbc6fceedd9bfd44839faae82199cf
SHA1 19a11b40c111ed91648461f7a2ca2c04be286297
SHA256 20f525d938924dd451e9abbc3339fa0e5dbd4c062b1660ee9a40cde53626ab7f
SHA512 ebbc0f86e96e424c5da1d687075b13dc6c03fbc3354b878f146d3448fe8090dccf76b32e8c338f64deaae89007593b9cd746716126ecb4354b327a31d5e2f558

\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s2.exe

MD5 2ecbc6fceedd9bfd44839faae82199cf
SHA1 19a11b40c111ed91648461f7a2ca2c04be286297
SHA256 20f525d938924dd451e9abbc3339fa0e5dbd4c062b1660ee9a40cde53626ab7f
SHA512 ebbc0f86e96e424c5da1d687075b13dc6c03fbc3354b878f146d3448fe8090dccf76b32e8c338f64deaae89007593b9cd746716126ecb4354b327a31d5e2f558

memory/2304-336-0x0000000000220000-0x0000000000262000-memory.dmp

memory/2304-338-0x0000000000400000-0x0000000001B52000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\status.log

MD5 444bcb3a3fcf8389296c49467f27e1d6
SHA1 7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb
SHA256 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
SHA512 9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570

C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s2.exe

MD5 2ecbc6fceedd9bfd44839faae82199cf
SHA1 19a11b40c111ed91648461f7a2ca2c04be286297
SHA256 20f525d938924dd451e9abbc3339fa0e5dbd4c062b1660ee9a40cde53626ab7f
SHA512 ebbc0f86e96e424c5da1d687075b13dc6c03fbc3354b878f146d3448fe8090dccf76b32e8c338f64deaae89007593b9cd746716126ecb4354b327a31d5e2f558

\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe

MD5 fa24733f5a6a6f44d0e65d7d98b84aa6
SHA1 51a62beab55096e17f2e17f042f7bd7dedabf1ae
SHA256 da1b144b5f908cb7e811489dfe660e06aa6df9c9158c6972ec9c79c48afacb7e
SHA512 1953201d8cd448aa7d23c3e57665546ace835f97c8cc8d0f323573cef03a6f317f86c7c3841268ece1760b911c67845d7e6aa198a44f720dca02a5a8bcb8e21e

C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe

MD5 fa24733f5a6a6f44d0e65d7d98b84aa6
SHA1 51a62beab55096e17f2e17f042f7bd7dedabf1ae
SHA256 da1b144b5f908cb7e811489dfe660e06aa6df9c9158c6972ec9c79c48afacb7e
SHA512 1953201d8cd448aa7d23c3e57665546ace835f97c8cc8d0f323573cef03a6f317f86c7c3841268ece1760b911c67845d7e6aa198a44f720dca02a5a8bcb8e21e

C:\Users\Admin\AppData\Local\Temp\is-DJS1N.tmp\s3.exe

MD5 fa24733f5a6a6f44d0e65d7d98b84aa6
SHA1 51a62beab55096e17f2e17f042f7bd7dedabf1ae
SHA256 da1b144b5f908cb7e811489dfe660e06aa6df9c9158c6972ec9c79c48afacb7e
SHA512 1953201d8cd448aa7d23c3e57665546ace835f97c8cc8d0f323573cef03a6f317f86c7c3841268ece1760b911c67845d7e6aa198a44f720dca02a5a8bcb8e21e

\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\decoder.dll

MD5 8a3f1a0da39530dcb8962dd0fadb187f
SHA1 d5294f6be549ec1f779da78d903683bab2835d1a
SHA256 c6988e36b1e1d6ffc89d9fa77ad35f132f5aa89e680d0155e0b6aee1c524c99f
SHA512 1e0d5be3ee164fb16de629a975f3c3da61659b99a0fc766850ffeeddb2d32b7ee0d3b85c77f01d34d9fe2933bd7bd11c6dba7b35d30faed7ce09485fd706d49d

C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\decoder.dll

MD5 8a3f1a0da39530dcb8962dd0fadb187f
SHA1 d5294f6be549ec1f779da78d903683bab2835d1a
SHA256 c6988e36b1e1d6ffc89d9fa77ad35f132f5aa89e680d0155e0b6aee1c524c99f
SHA512 1e0d5be3ee164fb16de629a975f3c3da61659b99a0fc766850ffeeddb2d32b7ee0d3b85c77f01d34d9fe2933bd7bd11c6dba7b35d30faed7ce09485fd706d49d

\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\decoder.dll

MD5 8a3f1a0da39530dcb8962dd0fadb187f
SHA1 d5294f6be549ec1f779da78d903683bab2835d1a
SHA256 c6988e36b1e1d6ffc89d9fa77ad35f132f5aa89e680d0155e0b6aee1c524c99f
SHA512 1e0d5be3ee164fb16de629a975f3c3da61659b99a0fc766850ffeeddb2d32b7ee0d3b85c77f01d34d9fe2933bd7bd11c6dba7b35d30faed7ce09485fd706d49d

memory/2084-361-0x0000000000400000-0x000000000071C000-memory.dmp

memory/1108-362-0x00000000001B0000-0x00000000001B1000-memory.dmp

C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi

MD5 6024d8c2207fc4610416beaf8d360527
SHA1 793ab731b07bf86ecc3ba78e1b76dc2aa0b48f8a
SHA256 cb4cad56ea5391e44dc661513c4f021c5272db710cc1733251152d1cb0eb5829
SHA512 0bb9cd1ec8873137e654a94c21887b7d4c73a9e561563d52ddec18377552d1a33d256487362bb614ebb3d804047427977b3eb0070c92fc43d0dd656af13eeab4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a294b8e9ab6f220d7ebefc9f7f99a05c
SHA1 ac0a359d3ac85d602e16c9d6b300e00714818f89
SHA256 c75b3f80d70486fb0578e339d9b7725fa305fae7f600ab0d10897cb59ec97f27
SHA512 5fa696abc10f39e78a344b4265edd4f852fd6d7807ee0513e052fb8b8d628e10b2571f0ddef7afeed31c0968bfd49ebe096942b328101eac8759563343ff4538

\Users\Admin\AppData\Local\Temp\INA7AD8.tmp

MD5 dd1f93eb81e6c99ba9be55b0c12e8bb4
SHA1 1d767983aaa4eb5c9e19409cf529969142033850
SHA256 f55b853958f07b15f0dae7a871c1ebe2ec117ef54ba3811d31cec4c8ae471d9b
SHA512 7968839ca3e7337b2e7774d92c4a3666e9b7d8d76000475b39c2bda6db3320fc9b2100322505997798af5631a007787fbd8d0d6fe0b51949c545c67e696aaf1a

C:\Users\Admin\AppData\Local\Temp\MSI7B75.tmp

MD5 6ea65025106536eb75f026e46643b099
SHA1 d6f5801e370c92d8e5c2336b4022cc6cb6ec1f99
SHA256 dae76cce74d63e7935fde4383020659d75b68632f8a01f2053ec895e69bb4efb
SHA512 062aed4c7541346b7338e1d234a50aa9af76f103a65268ba65a42508a26c10cc27ccfce6131485403afa36d8a8cd69f3bf1e55cd1a1f675357b87228aacbb988

\Users\Admin\AppData\Local\Temp\MSI7B75.tmp

MD5 6ea65025106536eb75f026e46643b099
SHA1 d6f5801e370c92d8e5c2336b4022cc6cb6ec1f99
SHA256 dae76cce74d63e7935fde4383020659d75b68632f8a01f2053ec895e69bb4efb
SHA512 062aed4c7541346b7338e1d234a50aa9af76f103a65268ba65a42508a26c10cc27ccfce6131485403afa36d8a8cd69f3bf1e55cd1a1f675357b87228aacbb988

C:\Users\Admin\AppData\Local\Temp\MSI7C9F.tmp

MD5 91d4a8c2c296ef53dd8c01b9af69b735
SHA1 ad2e5311a0f2dbba988fbdb6fcf70034fda3920d
SHA256 a787e7a1ad12783fcbf3f853940590329e0ff0dddf17282324f2d95ed6408f23
SHA512 63c5506a55dea2b3bd1c99b79b5668f5afc0104564e92f07afb42f2f2b67eae9d0e0174cb36e6095a27a6c71496206042079b6e5a2b2ff787f3cb9ef20995e9e

\Users\Admin\AppData\Local\Temp\MSI7C9F.tmp

MD5 91d4a8c2c296ef53dd8c01b9af69b735
SHA1 ad2e5311a0f2dbba988fbdb6fcf70034fda3920d
SHA256 a787e7a1ad12783fcbf3f853940590329e0ff0dddf17282324f2d95ed6408f23
SHA512 63c5506a55dea2b3bd1c99b79b5668f5afc0104564e92f07afb42f2f2b67eae9d0e0174cb36e6095a27a6c71496206042079b6e5a2b2ff787f3cb9ef20995e9e

C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi

MD5 6024d8c2207fc4610416beaf8d360527
SHA1 793ab731b07bf86ecc3ba78e1b76dc2aa0b48f8a
SHA256 cb4cad56ea5391e44dc661513c4f021c5272db710cc1733251152d1cb0eb5829
SHA512 0bb9cd1ec8873137e654a94c21887b7d4c73a9e561563d52ddec18377552d1a33d256487362bb614ebb3d804047427977b3eb0070c92fc43d0dd656af13eeab4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 647660ba4abcd2a9bac2ba4a1db3e6e8
SHA1 0734cf164bab1353c3dcaf0a5975a1fe7229c5b4
SHA256 0295374bbdc36f17fc1beaf08dd58a9433ea4b5e6ec495f6c13e6964344343af
SHA512 6805387ef86a3659e93fff3e5509dd211600348268d30e711d1e4688a221548930c5c720aa274aef3a6d621043b74f56ad369d086a61219d9605cf003f017ffc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4

MD5 78f2fcaa601f2fb4ebc937ba532e7549
SHA1 ddfb16cd4931c973a2037d3fc83a4d7d775d05e4
SHA256 552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988
SHA512 bcad73a7a5afb7120549dd54ba1f15c551ae24c7181f008392065d1ed006e6fa4fa5a60538d52461b15a12f5292049e929cffde15cc400dec9cdfca0b36a68dd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4

MD5 f6e87204cd7e1a1afba502edbded9a18
SHA1 8412bece82f115d17ea2a3f1c4e2e6ec43021c46
SHA256 57d7feb2753026d3c113cdbc0119dce9c9582044a650f874be07e81d76b3a852
SHA512 184da1342fba2386c7f8326a6a8d30ef1b930de7d8e5a861cbce0d962b46eedbab8f1d08ee08b3cb9b8751b7606a54698709ed830728f8e8677a5253836b2f6f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C

MD5 f55da450a5fb287e1e0f0dcc965756ca
SHA1 7e04de896a3e666d00e687d33ffad93be83d349e
SHA256 31ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0
SHA512 19bd9a319dfdaad7c13a6b085e51c67c0f9cb1eb4babc4c2b5cdf921c13002ca324e62dfa05f344e340d0d100aa4d6fac0683552162ccc7c0321a8d146da0630

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C

MD5 b50850ff52e63cbc740fad677a670cb5
SHA1 aae40d7f8f975ba1cd031c659b33e2648212cb4e
SHA256 1f23441fec405921288bcd369d0be354792a92e3a393ec6c1e5d9ee2c7c3e445
SHA512 93937cbb0f493cdb4eafbf5e2e19b5a788ef1d4b8f9bcae0374e326635752251dbeaf877a5da36aa039f9e78c6df508f788b674e1e3cfff3035dbd708c4b500e

C:\Windows\Installer\MSI896B.tmp

MD5 dd1f93eb81e6c99ba9be55b0c12e8bb4
SHA1 1d767983aaa4eb5c9e19409cf529969142033850
SHA256 f55b853958f07b15f0dae7a871c1ebe2ec117ef54ba3811d31cec4c8ae471d9b
SHA512 7968839ca3e7337b2e7774d92c4a3666e9b7d8d76000475b39c2bda6db3320fc9b2100322505997798af5631a007787fbd8d0d6fe0b51949c545c67e696aaf1a

C:\Windows\Installer\MSI896B.tmp

MD5 dd1f93eb81e6c99ba9be55b0c12e8bb4
SHA1 1d767983aaa4eb5c9e19409cf529969142033850
SHA256 f55b853958f07b15f0dae7a871c1ebe2ec117ef54ba3811d31cec4c8ae471d9b
SHA512 7968839ca3e7337b2e7774d92c4a3666e9b7d8d76000475b39c2bda6db3320fc9b2100322505997798af5631a007787fbd8d0d6fe0b51949c545c67e696aaf1a

\Windows\Installer\MSI896B.tmp

MD5 dd1f93eb81e6c99ba9be55b0c12e8bb4
SHA1 1d767983aaa4eb5c9e19409cf529969142033850
SHA256 f55b853958f07b15f0dae7a871c1ebe2ec117ef54ba3811d31cec4c8ae471d9b
SHA512 7968839ca3e7337b2e7774d92c4a3666e9b7d8d76000475b39c2bda6db3320fc9b2100322505997798af5631a007787fbd8d0d6fe0b51949c545c67e696aaf1a

C:\Users\Admin\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\tracking.ini

MD5 e7b96d43fccd3bbb99dec405faedd435
SHA1 6a884a880bbccdfc941fcf6ad6d2df9353f74728
SHA256 96ce7575283d757baf8e711d81e2a12a3c6a93bc8032298a9b452e45439e484e
SHA512 47315b3ce2976a3e9616b0f28f5e95b082522998758ec7aef53ed07b12f2e0605a4c75f86923c548408f5f64f3648d9fd4514b07bab4ff6d14debcd053a4aa37

C:\Windows\Installer\MSI8C39.tmp

MD5 6ea65025106536eb75f026e46643b099
SHA1 d6f5801e370c92d8e5c2336b4022cc6cb6ec1f99
SHA256 dae76cce74d63e7935fde4383020659d75b68632f8a01f2053ec895e69bb4efb
SHA512 062aed4c7541346b7338e1d234a50aa9af76f103a65268ba65a42508a26c10cc27ccfce6131485403afa36d8a8cd69f3bf1e55cd1a1f675357b87228aacbb988

C:\Windows\Installer\MSI8CB7.tmp

MD5 6ea65025106536eb75f026e46643b099
SHA1 d6f5801e370c92d8e5c2336b4022cc6cb6ec1f99
SHA256 dae76cce74d63e7935fde4383020659d75b68632f8a01f2053ec895e69bb4efb
SHA512 062aed4c7541346b7338e1d234a50aa9af76f103a65268ba65a42508a26c10cc27ccfce6131485403afa36d8a8cd69f3bf1e55cd1a1f675357b87228aacbb988

C:\Users\Admin\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\{C1184B35-D799-409A-95BA-5131A070E14B}.session

MD5 66ee78175433867cccd03486a7e6febb
SHA1 2ea167035fec8828e49a4aa42b9d368ec71e9fda
SHA256 c40cba2992ce99cb515d795406fdddc73ec81aa3f876992c0c589686f532bf75
SHA512 6ffd37929b98f14afd190bada5427f7dbf3fd96bd3f89cec79c1dbd8e9fb9fc8871d698c682ed2d159be8b6b095d34eeb46bd0566915ca0f6eb2908f71b2d76d

C:\Users\Admin\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\tracking.ini

MD5 c04078433fc0c2c93cf3dfa9ebe569ea
SHA1 8c24226c4d6e7d5424e61ef11a6dd8f28c4bbd31
SHA256 cb72ccc72b3804d445df243c12060707ae4215ed1c38ad573910cc12804f42b7
SHA512 d4e9f0008d4adc23423251342f26b17e0121122119faee5c7524500fe7b2d01f19f309d59e9ebf4eeeb22c53c14466ae47338fb997bf549bb29f7dd42768e18d

C:\Config.Msi\6e8154.rbs

MD5 6dadeaddee599591350552df21b684b1
SHA1 2787b16d88f0d419ccadb5142129de6b892cf3d4
SHA256 44434a17a29d407806d4164e7501a2cf164792254923fe135019c0dd54a62210
SHA512 c748bd7c42323fbcdf8d86a4b20a93c5604e86e54dbff9b57912f26629fd9a3fe88235c242ff87df490f019c2c33cde6380985f515aa11e8d2176dd214eb8c41

C:\Users\Admin\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\tracking.ini

MD5 576bffbc2d76340bc51e1188f8240c92
SHA1 5ef03abdba90d8fc31339d1c747c56e4f811402d
SHA256 e69b0dff2198ba528d392ab7b1b97f51d9a1605d1e8f85f04505a8f78b183b16
SHA512 366c57f0282225809071827b7a898562b44b23c68f797a76f37d32711f2117af867302f51612518c85c4a23a302bcdb2aff72d8101991512925c75981c928b6a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9589cbfbef7eaca4573706991587f741
SHA1 2ae590458be707dc49977411ab203686c6f8a33e
SHA256 f2dfa968677712906d5dbadec9948cd90b9f7a6ec3d107396765c34332a8aef6
SHA512 1c3f161534d5a3077f9647503936961dbc9f966be115f4d158fb27efcd254be9f6faf76399c60b3985a75922b656378ebee7ba8ee6c3e55c7e06d0f31d8b456f

memory/1496-1069-0x0000000000840000-0x0000000000D3E000-memory.dmp

memory/1496-1070-0x0000000000840000-0x0000000000D3E000-memory.dmp

memory/1496-1071-0x0000000000840000-0x0000000000D3E000-memory.dmp

memory/1496-1074-0x0000000002960000-0x00000000029A0000-memory.dmp

memory/2084-1076-0x0000000000400000-0x000000000071C000-memory.dmp

memory/1496-1078-0x0000000000840000-0x0000000000D3E000-memory.dmp

memory/2052-1084-0x0000000000DA0000-0x0000000001224000-memory.dmp

memory/2052-1085-0x0000000000DA0000-0x0000000001224000-memory.dmp

memory/2052-1086-0x0000000000DA0000-0x0000000001224000-memory.dmp

memory/2052-1089-0x0000000007650000-0x0000000007690000-memory.dmp

memory/2052-1093-0x0000000000DA0000-0x0000000001224000-memory.dmp

memory/328-1104-0x0000000000CC0000-0x0000000000CE0000-memory.dmp

memory/328-1115-0x0000000000C70000-0x0000000000CB0000-memory.dmp

memory/2084-1122-0x0000000000400000-0x000000000071C000-memory.dmp

memory/2836-1125-0x0000000000400000-0x00000000004CF000-memory.dmp

memory/1120-1131-0x0000000000250000-0x0000000000251000-memory.dmp

C:\Users\Admin\Programs\Adblock\unins000.exe

MD5 48e2700a70ded263b75c45ca308ffbd5
SHA1 e2b337b3767477c562b60589a3fb457e6c228bc6
SHA256 178a134af5594ee4a5212a22fa63d0c48d754dd84342ed31217f9264ca1886b2
SHA512 1fea6838b8d8800db66ae4a1365c4999cf780be84ab0ffe998926c68e4e48f6737158df79a10d21d75bf639cec0bab2296c17fc6392c604dc92b464a92cd72e6

C:\Users\Admin\Programs\Adblock\Adblock.exe

MD5 c4fbe5f997df48686d0d3aea9b0ec2e1
SHA1 e59248b9ab8ad02cb304246cd72c1bf9cfa0eb3b
SHA256 75a7069d46bcbd824fc1315a5f34652fe508cedc1d5e4bf69568e35236be9046
SHA512 900b46caa32d7cb3025a97dc9cae2842f276d87a05c82400b36c55333106ab49eaf1bd709884920bbbad774ca354179b55eae1fa4efd63d1ce06e60a824dfdb8

memory/1120-1190-0x0000000000400000-0x000000000070A000-memory.dmp

memory/2836-1192-0x0000000000400000-0x00000000004CF000-memory.dmp

memory/2164-1201-0x0000000140000000-0x00000001405E8000-memory.dmp

memory/2164-1203-0x0000000140000000-0x00000001405E8000-memory.dmp

C:\Users\Admin\AppData\Roaming\Adblock Fast\Massive\usage\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Roaming\Adblock Fast\Massive\usage\CURRENT~RF6fbc9c.TMP

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

memory/328-1328-0x0000000000C70000-0x0000000000CB0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nskAB8E.tmp\inetc.dll

MD5 cab75d596adf6bac4ba6a8374dd71de9
SHA1 fb90d4f13331d0c9275fa815937a4ff22ead6fa3
SHA256 89e24e4124b607f3f98e4df508c4ddd2701d8f7fcf1dc6e2aba11d56c97c0c5a
SHA512 510786599289c8793526969cfe0a96e049436d40809c1c351642b2c67d5fb2394cb20887010727a5da35c52a20c5557ad940967053b1b59ad91ca1307208c391

memory/2164-1338-0x00000000026E0000-0x00000000026E1000-memory.dmp

memory/2164-1429-0x0000000140000000-0x00000001405E8000-memory.dmp

memory/2164-1430-0x0000000140000000-0x00000001405E8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ANFZKI5S\TapAction[1].htm

MD5 2e5751b7cfd7f053cd29e946fb2649a4
SHA1 1ee9183b1f737da4d348ea42281bd1dd682c5d52
SHA256 7daed43814b633951fa277cd01695574df6e05a9cb10523f1763e842b06be0ff
SHA512 3595817cf0e1f1852bc3d279f38df6f899ca963dedd143af810d3c50844a7ca3e0c25be6d3761e9a7010641756110c344ab57e6e5fe3e89a4cb6532705a8c47d

C:\Users\Admin\AppData\Local\Temp\nskAB8E.tmp\poinstaller.exe

MD5 1992fdcd482cb89c1f96dbfd12bb2e66
SHA1 9efadfa39617e62fbf49182c91a272689c211a5a
SHA256 8b53201f1914764f384c6ec5a7a5c5ab2924afaf382d2bbe79f68e43e5dfa3ba
SHA512 c4adc88eb7490c03c4b17a6d6502fae79fc098dd8db01c0c035b1d39dd543ea18ccc21a81100eb11d7cf0edb748f0af1d59d5e84aca2b5f2a2d3f4c192aac021

C:\Users\Admin\AppData\Local\Temp\nskAB8E.tmp\nsDialogs.dll

MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

C:\Users\Admin\AppData\Local\Temp\nskAB8E.tmp\xml.dll

MD5 42df1fbaa87567adf2b4050805a1a545
SHA1 b892a6efbb39b7144248e0c0d79e53da474a9373
SHA256 e900fcb9d598643eb0ee3e4005da925e73e70dbaa010edc4473e99ea0638b845
SHA512 4537d408e2f54d07b018907c787da6c7340f909a1789416de33d090055eda8918f338d8571bc3b438dd89e5e03e0ded70c86702666f12adb98523a91cbb1de1d

C:\Users\Admin\AppData\Local\Temp\nskAB8E.tmp\unicode.dll

MD5 51d0cb97e99ec2c7d39714d600377cdb
SHA1 0264565c9d67b6d95b2e9a9df0fccf11d1638b45
SHA256 ddbc0589401c65c4bcec03bd51c02cfdce40f2885f44846b36dd00bb57a88625
SHA512 b5513365b349474131b02a52317f51cfe8996e4fa51db5fcd1d34cbe9da86cab74f12e6fc79ad070a91a8802e1499b1252c5ded696aacc91b694440ed1c3c459

C:\Users\Admin\AppData\Local\Temp\nskAB8E.tmp\System.dll

MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

C:\Program Files (x86)\PremierOpinion\pmls.dll

MD5 0ba9ecf96bed0720b93c941809f5e315
SHA1 c80ca9d8e6a3cde9df5580fba9b3664f6d128d97
SHA256 ef5188707e91d8a8412129f69ca3b8204df3519c582e61d94074e3d5f644a7b5
SHA512 80feb15a693641d402f95f5082be27905b496419d364d0d54a8ba9085e34a1f43dea74df2429c76e7b9a12a6b363d59d99136b7127abb0cc0f5d137f136b7791

C:\Users\Admin\AppData\Local\Temp\~os3F72.tmp\pmservice.exe

MD5 7cfa0fd9a852db026ffe2d44c74ab533
SHA1 776e26c505fb349caf28897d2bf373131f699c1f
SHA256 4efb75b693e1c9e0d337e4203cf2e5003ab7ae2c4d60ca4095322da4f6586096
SHA512 1d9bc307c909523c553d1e707c28009d4d343b7ca3d561be80b8b85341089fa4da5ede9c445e4ecce18a48e0d0e12c134c6dc95a8475c98e430e4c6ef9683315

C:\Program Files (x86)\PremierOpinion\pmls64.dll

MD5 c038c7a5f9320242300bd7c435dc0dcd
SHA1 e65f83fb724238207d55301b6ebc73aed86b1aa7
SHA256 dd0f6f7a1b72daab980c51ae654dd80831cbee5bbfd6eed09224a76513c0c12c
SHA512 db6f5410abc9ad15f2f1f03d8f53c9da2f66b9db9e6f782991df68ddc4602cc8ecb33c9a76e62ecc06460c9a4efa6acb1399b6ecd867cd4c56d53c1613a311ed

C:\Program Files (x86)\PremierOpinion\pmropn64.exe

MD5 543ad9de900fb7363c16e5f6dddc2bc9
SHA1 3373f88285ab603e71f91155cb3099bac583608b
SHA256 9085c6d73cbf769924f2116b1824dd4f1a14ce03d5658587d10dfbbc24d49a19
SHA512 1fde395263b936d445a49655dad18f52b3af2c20b1e46005d2e27f33427ae14cd3f6b270664df018576288eb953211ab5007e8065898f07519a44ef4a6b19afe

C:\Program Files (x86)\PremierOpinion\pmropn32.exe

MD5 873e1d723a8f52a0c775eacec02fcc4e
SHA1 263291dee3b33b0fa0dba2234ace7780c95dba84
SHA256 4003b56e19ff2ef868ec228f8ade7717654743fd7674e4849cc561f57fcaf81a
SHA512 fb2c0edc7a1de2c6f6cf4ea9dee183b7ea9b9211f94fd34860ed9bdf705324f1a25ffbf05dae46c56220660abeeca71a3e81c6e9dbacf0830ee8f1943a513c06

C:\Program Files (x86)\PremierOpinion\pmropn.exe

MD5 dc4501a9f1ac246caa8998c8fe1002eb
SHA1 b81a460cd947f685ff8cee251ba7808523152552
SHA256 2f04cdd89ae79b81070ed7ca5b3851a8ef4df59fd41e83dde24c87da5464c78d
SHA512 184b6a6126b9aa240b4c56002e9e8dec925d8457bd1150cf8de86d47a12baed1383d75afc4d51c72b456abe0134e4c7f0641b3132a16e7c4f17a51a4e2300bd7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ca1c0c3ce2b18026f332b7981fd301a3
SHA1 1c0bf5ebaeabb47d949997b42e875a30d076ebe0
SHA256 b9be8f1b560cc6571fff7cfab58848bb0e035422faddaf60a36fdde56b7f3172
SHA512 a047dbe7a40ed5d7591fe4d273a80a949cd37ee0340c7e3e2bc599289c5a62dfe064823a5ba8175bc3564a0bec13555fff62603a1faec56411c625a14fd29f16

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ca1c0c3ce2b18026f332b7981fd301a3
SHA1 1c0bf5ebaeabb47d949997b42e875a30d076ebe0
SHA256 b9be8f1b560cc6571fff7cfab58848bb0e035422faddaf60a36fdde56b7f3172
SHA512 a047dbe7a40ed5d7591fe4d273a80a949cd37ee0340c7e3e2bc599289c5a62dfe064823a5ba8175bc3564a0bec13555fff62603a1faec56411c625a14fd29f16

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 366cfd01f36d2a91c76648a114321c1e
SHA1 c739ee44e18d5b9e81c0e01bd4ba613318e983bb
SHA256 d5a933883fbe84e151eda049d0b9e9fc6e7309de1c4ea1c27ff0b836f8a96655
SHA512 d4ee40919f90227c4b245e41eae9814bded8681e35923a67b1d6bcfebaaae62d445fe75155a25fcd8771751c41f0dd804e8ba5a0b0f4effbc6c61143ec7182c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b5c76e7a54d9bb2ce79d0baf3db3295c
SHA1 7ad2f41145d6d45d175ce2a8c390d87a1be96fa8
SHA256 ad6c5802879eb1299b232e6c959a11308451e1fc2c4230b015663760794b906d
SHA512 cb2b5bbd1126d9eecac1ce003106aa051c58be03613292f85b17edca6be2c95212fb76f7b4d8b0cf2f87f0f29190e6ffeb481dc0043be6b393655e902859ab32

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ANFZKI5S\suggestions[1].en-US

MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

memory/1544-2089-0x0000000002900000-0x0000000002901000-memory.dmp

memory/3044-2090-0x0000000002820000-0x0000000002821000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-07-09 23:50

Reported

2023-07-09 23:58

Platform

win10v2004-20230703-en

Max time kernel

499s

Max time network

503s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Air Cluster Pro 130.exe"

Signatures

GCleaner

loader gcleaner

NetSupport

rat netsupport

RedLine

infostealer redline

Vidar

stealer vidar

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\289924744.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\meroplex.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A

Downloads MZ/PE file

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\Programs\Adblock\DnsService.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\289924744.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\289924744.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\meroplex.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\meroplex.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s2.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s4.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\is-372R5.tmp\s5.tmp N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adblock Fast.lnk C:\Users\Admin\Programs\Adblock\Adblock.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-SJFE1.tmp\Air Cluster Pro 130.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RO421.tmp\setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-COCDP.tmp\setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp N/A
N/A N/A C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\289924744.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\meroplex.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\rahmatlukum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\researchprevailing.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lukumrahmat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-372R5.tmp\s5.tmp N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\crashpad_handler.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\DnsService.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s6.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\MassiveExtension.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\researchprevailiing.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\289924744.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\meroplex.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-COCDP.tmp\setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-COCDP.tmp\setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-COCDP.tmp\setup.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp N/A
N/A N/A C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe N/A
N/A N/A C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe N/A
N/A N/A C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe N/A
N/A N/A C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe N/A
N/A N/A C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe N/A
N/A N/A C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe N/A
N/A N/A C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-372R5.tmp\s5.tmp N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\DnsService.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s6.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\MassiveExtension.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s6.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Reads user/profile data of web browsers

spyware stealer

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 9.9.9.9 N/A N/A

Accesses 2FA software files, possible credential harvesting

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\rahmatlukum.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\rahmatlukum.exe N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\289924744.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\meroplex.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1376 set thread context of 4260 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\researchprevailing.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\dl2AaL24LxDSqSJOJLa LLC\is-1OA6R.tmp C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp N/A
File created C:\Program Files (x86)\Air Cluster Pro 130.exe\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-SJFE1.tmp\Air Cluster Pro 130.tmp N/A
File opened for modification C:\Program Files (x86)\dl2AaL24LxDSqSJOJLa LLC\cnpacnoc.dll C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp N/A
File opened for modification C:\Program Files (x86)\dl2AaL24LxDSqSJOJLa LLC\mpnfimp.dll C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp N/A
File opened for modification C:\Program Files (x86)\dl2AaL24LxDSqSJOJLa LLC\ODISSDK.dll C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp N/A
File opened for modification C:\Program Files (x86)\dl2AaL24LxDSqSJOJLa LLC\DMReportSnapshot.dll C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp N/A
File opened for modification C:\Program Files (x86)\dl2AaL24LxDSqSJOJLa LLC\mfcm140.dll C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp N/A
File created C:\Program Files (x86)\dl2AaL24LxDSqSJOJLa LLC\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp N/A
File created C:\Program Files (x86)\dl2AaL24LxDSqSJOJLa LLC\is-LMS20.tmp C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp N/A
File opened for modification C:\Program Files (x86)\dl2AaL24LxDSqSJOJLa LLC\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp N/A
File created C:\Program Files (x86)\Air Cluster Pro 130.exe\is-26KPI.tmp C:\Users\Admin\AppData\Local\Temp\is-COCDP.tmp\setup.tmp N/A
File opened for modification C:\Program Files (x86)\Air Cluster Pro 130.exe\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-SJFE1.tmp\Air Cluster Pro 130.tmp N/A
File created C:\Program Files (x86)\dl2AaL24LxDSqSJOJLa LLC\is-SDDSH.tmp C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp N/A
File created C:\Program Files (x86)\dl2AaL24LxDSqSJOJLa LLC\is-6FJ0V.tmp C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp N/A
File created C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\AW Manager\Windows Manager\Uninstall.lnk C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\Air Cluster Pro 130.exe\is-9O41N.tmp C:\Users\Admin\AppData\Local\Temp\is-SJFE1.tmp\Air Cluster Pro 130.tmp N/A
File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\EULA.url C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\Privacy.url C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\dl2AaL24LxDSqSJOJLa LLC\is-D3N3L.tmp C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp N/A
File created C:\Program Files (x86)\dl2AaL24LxDSqSJOJLa LLC\is-GN502.tmp C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp N/A
File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ini C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Program Files (x86)\Air Cluster Pro 130.exe\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-COCDP.tmp\setup.tmp N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\MSIDC63.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIDCB3.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIDC93.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIDD13.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE6F0.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIEA0E.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e5bd629.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE43C.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE613.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIDD24.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62} C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5bd62d.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIEA1E.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE2A5.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\LOGS\DPX\setupact.log C:\Windows\SysWOW64\expand.exe N/A
File opened for modification C:\Windows\LOGS\DPX\setuperr.log C:\Windows\SysWOW64\expand.exe N/A
File opened for modification C:\Windows\Installer\MSIDCE3.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE237.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5bd629.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSID917.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE4E9.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE633.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE10D.tmp C:\Windows\system32\msiexec.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A
N/A N/A C:\Windows\SYSTEM32\taskkill.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "178" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e C:\Windows\system32\msiexec.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C414548CC3098124D97E31A29BF7FD26\MainFeature C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\ProductName = "Windows Manager" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\AdvertiseFlags = "388" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\InstanceType = "0" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\AuthorizedLUAApp = "0" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Media\1 = ";" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C414548CC3098124D97E31A29BF7FD26 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\AW Manager\\Windows Manager 1.0.0\\install\\97FDF62\\" C:\Windows\system32\msiexec.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Clients = 3a0000000000 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5785CBDF4ABB5AD409841A692AF14EA9\C414548CC3098124D97E31A29BF7FD26 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\AW Manager\\Windows Manager 1.0.0\\install\\97FDF62\\" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Media C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Media\DiskPrompt = "[1]" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\DeploymentFlags = "3" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5785CBDF4ABB5AD409841A692AF14EA9 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\PackageName = "Windows Manager - Postback Johan.msi" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Version = "16777216" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Language = "1033" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Assignment = "1" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\ProductIcon = "C:\\Windows\\Installer\\{C845414C-903C-4218-9DE7-132AB97FDF62}\\logo.exe" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Net C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\PackageCode = "B8DDBE5C483C5BC4A933A9E42F81D915" C:\Windows\system32\msiexec.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E\Blob = 040000000100000010000000f55da450a5fb287e1e0f0dcc965756ca0f000000010000003000000082c80199397722b57ad473ea266b93d47ffc77fe07f09388345f20dab6addd087672f988b4bbfd154c4b133c70c9ecff0300000001000000140000007e04de896a3e666d00e687d33ffad93be83d349e1d0000000100000010000000d0ab39edd1a4d89a5512882deb09cb13140000000100000014000000b3db48a4f9a1c5d8ae3641cc1163696229bc4bc662000000010000002000000031ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d00b000000010000003000000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f0074002000470033000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c05c000000010000000400000080010000190000000100000010000000b009e99a5cfc928a173190106dbb32a92000000001000000430200003082023f308201c5a0030201020210055556bcf25ea43535c3a40fd5ab4572300a06082a8648ce3d0403033061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204733301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f742047333076301006072a8648ce3d020106052b8104002203620004dda7d9bb8ab80bfb0b7f21d2f0bebe73f3335d1abc34eadec69bbcd095f6f0ccd00bba615b51467e9e2d9fee8e630c17ec0770f5cf842e40839ce83f416d3badd3a4145936789d0343ee10136c72deae88a7a16bb543ce67dc23ff031ca3e23ea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b3db48a4f9a1c5d8ae3641cc1163696229bc4bc6300a06082a8648ce3d0403030368003065023100adbcf26c3f124ad12d39c30a099773f488368c8827bbe6888d5085a763f99e32de66930ff1ccb1098fdd6cabfa6b7fa0023039665bc2648db89e50dca8d549a2edc7dcd1497f1701b8c8868f4e8c882ba89aa98ac5d100bdf854e29ae55b7cb32717 C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-SJFE1.tmp\Air Cluster Pro 130.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-SJFE1.tmp\Air Cluster Pro 130.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\289924744.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\289924744.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\289924744.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\289924744.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\meroplex.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\meroplex.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\meroplex.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-SJFE1.tmp\Air Cluster Pro 130.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp N/A
N/A N/A C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-372R5.tmp\s5.tmp N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A
N/A N/A C:\Users\Admin\Programs\Adblock\Adblock.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 912 wrote to memory of 436 N/A C:\Users\Admin\AppData\Local\Temp\Air Cluster Pro 130.exe C:\Users\Admin\AppData\Local\Temp\is-SJFE1.tmp\Air Cluster Pro 130.tmp
PID 912 wrote to memory of 436 N/A C:\Users\Admin\AppData\Local\Temp\Air Cluster Pro 130.exe C:\Users\Admin\AppData\Local\Temp\is-SJFE1.tmp\Air Cluster Pro 130.tmp
PID 912 wrote to memory of 436 N/A C:\Users\Admin\AppData\Local\Temp\Air Cluster Pro 130.exe C:\Users\Admin\AppData\Local\Temp\is-SJFE1.tmp\Air Cluster Pro 130.tmp
PID 436 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Local\Temp\is-SJFE1.tmp\Air Cluster Pro 130.tmp C:\Users\Admin\AppData\Local\Temp\is-RO421.tmp\setup.exe
PID 436 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Local\Temp\is-SJFE1.tmp\Air Cluster Pro 130.tmp C:\Users\Admin\AppData\Local\Temp\is-RO421.tmp\setup.exe
PID 436 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Local\Temp\is-SJFE1.tmp\Air Cluster Pro 130.tmp C:\Users\Admin\AppData\Local\Temp\is-RO421.tmp\setup.exe
PID 3808 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\is-RO421.tmp\setup.exe C:\Users\Admin\AppData\Local\Temp\is-COCDP.tmp\setup.tmp
PID 3808 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\is-RO421.tmp\setup.exe C:\Users\Admin\AppData\Local\Temp\is-COCDP.tmp\setup.tmp
PID 3808 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\is-RO421.tmp\setup.exe C:\Users\Admin\AppData\Local\Temp\is-COCDP.tmp\setup.tmp
PID 1256 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\is-COCDP.tmp\setup.tmp C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s0.exe
PID 1256 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\is-COCDP.tmp\setup.tmp C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s0.exe
PID 1256 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\is-COCDP.tmp\setup.tmp C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s0.exe
PID 5044 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s0.exe C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp
PID 5044 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s0.exe C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp
PID 5044 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s0.exe C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp
PID 2948 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp C:\Windows\SysWOW64\cmd.exe
PID 2948 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp C:\Windows\SysWOW64\cmd.exe
PID 2948 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp C:\Windows\SysWOW64\cmd.exe
PID 5040 wrote to memory of 2856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 5040 wrote to memory of 2856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 5040 wrote to memory of 2856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\expand.exe
PID 2948 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp C:\Windows\SysWOW64\cmd.exe
PID 2948 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp C:\Windows\SysWOW64\cmd.exe
PID 2948 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp C:\Windows\SysWOW64\cmd.exe
PID 1120 wrote to memory of 1248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1120 wrote to memory of 1248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1120 wrote to memory of 1248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2948 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe
PID 2948 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe
PID 2948 wrote to memory of 1068 N/A C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe
PID 2948 wrote to memory of 3520 N/A C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp C:\Windows\SysWOW64\cmd.exe
PID 2948 wrote to memory of 3520 N/A C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp C:\Windows\SysWOW64\cmd.exe
PID 2948 wrote to memory of 3520 N/A C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp C:\Windows\SysWOW64\cmd.exe
PID 3520 wrote to memory of 4920 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3520 wrote to memory of 4920 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 2548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 2548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4920 wrote to memory of 4868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Air Cluster Pro 130.exe

"C:\Users\Admin\AppData\Local\Temp\Air Cluster Pro 130.exe"

C:\Users\Admin\AppData\Local\Temp\is-SJFE1.tmp\Air Cluster Pro 130.tmp

"C:\Users\Admin\AppData\Local\Temp\is-SJFE1.tmp\Air Cluster Pro 130.tmp" /SL5="$B004A,833540,832512,C:\Users\Admin\AppData\Local\Temp\Air Cluster Pro 130.exe"

C:\Users\Admin\AppData\Local\Temp\is-RO421.tmp\setup.exe

"C:\Users\Admin\AppData\Local\Temp\is-RO421.tmp\setup.exe"

C:\Users\Admin\AppData\Local\Temp\is-COCDP.tmp\setup.tmp

"C:\Users\Admin\AppData\Local\Temp\is-COCDP.tmp\setup.tmp" /SL5="$601EE,938139,832512,C:\Users\Admin\AppData\Local\Temp\is-RO421.tmp\setup.exe"

C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s0.exe

"C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s0.exe" /VERYSILENT /PASSWORD=NtIRVUpMK9ZD30Nf98220 -token mtn1co3fo4gs5vwq -subid 2217

C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp

"C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp" /SL5="$1027A,9877208,832512,C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s0.exe" /VERYSILENT /PASSWORD=NtIRVUpMK9ZD30Nf98220 -token mtn1co3fo4gs5vwq -subid 2217

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-AUKLN.tmp\{app}\cvysapfvmvsjevb.cab -F:* %ProgramData%

C:\Windows\SysWOW64\expand.exe

expand C:\Users\Admin\AppData\Local\Temp\is-AUKLN.tmp\{app}\cvysapfvmvsjevb.cab -F:* C:\ProgramData

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\wmiprvse.exe" /f

C:\Windows\SysWOW64\reg.exe

reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe" /f

C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe

"C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c start https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i^&c=5306757^&pl=0x00^&pb=1^&px=2217

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://axsboe-campaign.com/pixel?pmhzmq=fhoohvpn6e7i&c=5306757&pl=0x00&pb=1&px=2217

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffab1d846f8,0x7ffab1d84708,0x7ffab1d84718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,5373035993659675156,14418999688694686908,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,5373035993659675156,14418999688694686908,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,5373035993659675156,14418999688694686908,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5373035993659675156,14418999688694686908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5373035993659675156,14418999688694686908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5373035993659675156,14418999688694686908,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5373035993659675156,14418999688694686908,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2248 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5373035993659675156,14418999688694686908,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s2.exe

"C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s2.exe" /usten SUB=2217

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1892 -ip 1892

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 452

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,5373035993659675156,14418999688694686908,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3676 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,5373035993659675156,14418999688694686908,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3676 /prefetch:8

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1892 -ip 1892

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5373035993659675156,14418999688694686908,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5373035993659675156,14418999688694686908,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1892 -ip 1892

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 764

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1892 -ip 1892

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 796

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1892 -ip 1892

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 804

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1892 -ip 1892

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5373035993659675156,14418999688694686908,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5373035993659675156,14418999688694686908,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1892 -ip 1892

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5373035993659675156,14418999688694686908,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5373035993659675156,14418999688694686908,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5373035993659675156,14418999688694686908,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5373035993659675156,14418999688694686908,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5373035993659675156,14418999688694686908,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5373035993659675156,14418999688694686908,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5373035993659675156,14418999688694686908,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5373035993659675156,14418999688694686908,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5373035993659675156,14418999688694686908,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5373035993659675156,14418999688694686908,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5373035993659675156,14418999688694686908,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3720 /prefetch:1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1892 -ip 1892

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 1348

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c taskkill /im "s2.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s2.exe" & exit

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1892 -ip 1892

C:\Windows\SysWOW64\taskkill.exe

taskkill /im "s2.exe" /f

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 1380

C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe

"C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe" /qn CAMPAIGN="2217"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 6BD48A6CD838EA8F4F51381F73981AE9 C

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi" /qn CAMPAIGN=2217 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1688706008 /qn CAMPAIGN=""2217"" " CAMPAIGN="2217"

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 095BEFD07D1DFDB4AA7B12779EA7D818

C:\Windows\SysWOW64\taskkill.exe

"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 324AE650F7645967AD35FBE3EF89C503 E Global\MSI0000

C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s4.exe

"C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s4.exe"

C:\Users\Admin\AppData\Local\Temp\289924744.exe

C:\Users\Admin\AppData\Local\Temp\289924744.exe

C:\Users\Admin\AppData\Local\Temp\meroplex.exe

C:\Users\Admin\AppData\Local\Temp\meroplex.exe

C:\Users\Admin\AppData\Local\Temp\rahmatlukum.exe

C:\Users\Admin\AppData\Local\Temp\rahmatlukum.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\researchprevailing.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\researchprevailing.exe

C:\Users\Admin\AppData\Local\Temp\lukumrahmat.exe

C:\Users\Admin\AppData\Local\Temp\lukumrahmat.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s4.exe & exit

C:\Windows\system32\PING.EXE

ping 0

C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s5.exe

"C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s5.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /INSTALLERSHOWNELSEWHERE /sid=2217

C:\Users\Admin\AppData\Local\Temp\is-372R5.tmp\s5.tmp

"C:\Users\Admin\AppData\Local\Temp\is-372R5.tmp\s5.tmp" /SL5="$A0294,16940999,792064,C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s5.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /INSTALLERSHOWNELSEWHERE /sid=2217

C:\Windows\SysWOW64\ipconfig.exe

"C:\Windows\System32\ipconfig.exe" /flushdns

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /f /im "Adblock.exe"

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /f /im "MassiveEngine.exe"

C:\Windows\SYSTEM32\taskkill.exe

"taskkill.exe" /f /im "MassiveExtension.exe"

C:\Users\Admin\Programs\Adblock\Adblock.exe

"C:\Users\Admin\Programs\Adblock\Adblock.exe" --installerSessionId=ecc702961688946962 --downloadDate=2023-07-09T23:55:59 --distId=marketator2 --sid=2217

C:\Users\Admin\Programs\Adblock\crashpad_handler.exe

C:\Users\Admin\Programs\Adblock\crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps" "--metrics-dir=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps" --url=https://o428832.ingest.sentry.io:443/api/5420194/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=06798e99d7ee416faaf4e01cd2f1faaf "--attachment=C:\Users\Admin\AppData\Roaming\Adblock Fast\log.txt" "--attachment=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\e249cc04-373e-4ffe-1870-19f113de489d.run\__sentry-event" "--attachment=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\e249cc04-373e-4ffe-1870-19f113de489d.run\__sentry-breadcrumb1" "--attachment=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\e249cc04-373e-4ffe-1870-19f113de489d.run\__sentry-breadcrumb2" --initial-client-data=0x43c,0x440,0x444,0x418,0x448,0x7ff73d97d340,0x7ff73d97d358,0x7ff73d97d370

C:\Windows\system32\netsh.exe

C:\Windows\system32\netsh.exe firewall add allowedprogram "C:\Users\Admin\Programs\Adblock\DnsService.exe" AdBlockFast ENABLE

C:\Users\Admin\Programs\Adblock\DnsService.exe

C:\Users\Admin\Programs\Adblock\DnsService.exe /abfpid:2664

C:\Windows\system32\cmd.exe

"cmd.exe" /c "reg copy HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /s /f"

C:\Windows\system32\reg.exe

reg copy HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /s /f

C:\Windows\system32\cmd.exe

"cmd.exe" /c "reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /f"

C:\Windows\system32\reg.exe

reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /f

C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s6.exe

"C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s6.exe"

C:\Users\Admin\Programs\Adblock\MassiveExtension.exe

C:\Users\Admin\Programs\Adblock\MassiveExtension.exe proxy --dumps_path "C:\Users\Admin\AppData\Roaming\Adblock Fast\Massive\crashdumps" --h_path "C:\Users\Admin\Programs\Adblock\crashpad_handler.exe" --log_path "C:\Users\Admin\AppData\Roaming\Adblock Fast\Massive\logs" --src https://[email protected]/5375291 --allow_reporting true --version 0.16.0 --env prod --product_id massivesdk

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\researchprevailiing.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\researchprevailiing.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 6

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://da26gklo05t50.cloudfront.net/tracker/thank_you.php?trk=2217

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab1d846f8,0x7ffab1d84708,0x7ffab1d84718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,3879106814100748721,1362616489608259832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,3879106814100748721,1362616489608259832,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,3879106814100748721,1362616489608259832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,3879106814100748721,1362616489608259832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,3879106814100748721,1362616489608259832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,3879106814100748721,1362616489608259832,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,3879106814100748721,1362616489608259832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,3879106814100748721,1362616489608259832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,3879106814100748721,1362616489608259832,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,3879106814100748721,1362616489608259832,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4332 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,3879106814100748721,1362616489608259832,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa3908055 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 126.21.238.8.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 177.17.30.184.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 64.13.109.52.in-addr.arpa udp
US 8.8.8.8:53 85.65.42.20.in-addr.arpa udp
US 8.8.8.8:53 assets.msn.com udp
GB 95.101.143.120:443 assets.msn.com tcp
US 8.8.8.8:53 yearcoal.online udp
US 172.67.220.175:80 yearcoal.online tcp
US 8.8.8.8:53 120.143.101.95.in-addr.arpa udp
US 8.8.8.8:53 geesemonth.xyz udp
US 104.21.29.144:80 geesemonth.xyz tcp
US 8.8.8.8:53 175.220.67.172.in-addr.arpa udp
US 8.8.8.8:53 144.29.21.104.in-addr.arpa udp
US 8.8.8.8:53 www.cobaltshoesx.com udp
US 149.102.225.29:443 www.cobaltshoesx.com tcp
US 8.8.8.8:53 29.225.102.149.in-addr.arpa udp
US 8.8.8.8:53 142.33.222.23.in-addr.arpa udp
US 8.8.8.8:53 68.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 koppertrain.top udp
US 8.8.8.8:53 str.skymiddle.host udp
DE 45.15.157.190:1203 koppertrain.top tcp
US 188.114.97.0:80 str.skymiddle.host tcp
US 8.8.8.8:53 act.reactionharbor.xyz udp
US 188.114.97.0:80 act.reactionharbor.xyz tcp
US 8.8.8.8:53 www.mildstat.com udp
US 8.8.8.8:53 geo.netsupportsoftware.com udp
GB 23.106.59.52:80 www.mildstat.com tcp
GB 51.142.119.24:80 geo.netsupportsoftware.com tcp
US 8.8.8.8:53 www.mminnn.com udp
GB 23.106.59.45:80 www.mminnn.com tcp
US 8.8.8.8:53 0.97.114.188.in-addr.arpa udp
US 8.8.8.8:53 190.157.15.45.in-addr.arpa udp
US 8.8.8.8:53 52.59.106.23.in-addr.arpa udp
US 8.8.8.8:53 24.119.142.51.in-addr.arpa udp
US 8.8.8.8:53 axsboe-campaign.com udp
US 104.21.37.216:443 axsboe-campaign.com tcp
US 8.8.8.8:53 45.59.106.23.in-addr.arpa udp
US 8.8.8.8:53 216.37.21.104.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
NL 95.101.74.134:443 www.bing.com tcp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 aefd.nelreports.net udp
US 8.8.8.8:53 bing.com udp
US 13.107.21.200:443 bing.com tcp
NL 95.101.74.134:443 r.bing.com tcp
US 2.18.121.139:443 aefd.nelreports.net tcp
US 8.8.8.8:53 134.74.101.95.in-addr.arpa udp
US 8.8.8.8:53 200.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 139.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 assets.msn.com udp
GB 95.101.143.240:443 assets.msn.com tcp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 login.microsoftonline.com udp
NL 40.126.32.68:443 login.microsoftonline.com tcp
NL 45.12.253.74:80 45.12.253.74 tcp
US 8.8.8.8:53 240.143.101.95.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 74.253.12.45.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
NL 45.12.253.56:80 45.12.253.56 tcp
US 8.8.8.8:53 56.253.12.45.in-addr.arpa udp
US 8.8.8.8:53 londontownlink.com udp
DE 164.92.247.217:80 londontownlink.com tcp
US 8.8.8.8:53 217.247.92.164.in-addr.arpa udp
US 8.8.8.8:53 collect.installeranalytics.com udp
US 8.8.8.8:53 pstbbk.com udp
US 52.205.130.115:443 collect.installeranalytics.com tcp
DE 157.230.96.32:80 pstbbk.com tcp
US 8.8.8.8:53 ocsp.r2m01.amazontrust.com udp
US 18.239.100.55:80 ocsp.r2m01.amazontrust.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 8.8.8.8:53 32.96.230.157.in-addr.arpa udp
US 8.8.8.8:53 115.130.205.52.in-addr.arpa udp
US 8.8.8.8:53 136.61.156.108.in-addr.arpa udp
US 8.8.8.8:53 112.250.222.52.in-addr.arpa udp
US 8.8.8.8:53 50.102.239.18.in-addr.arpa udp
US 8.8.8.8:53 55.100.239.18.in-addr.arpa udp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 52.205.130.115:443 collect.installeranalytics.com tcp
US 8.8.8.8:53 ambasoft.info udp
NL 193.42.110.193:80 ambasoft.info tcp
US 8.8.8.8:53 carambasti.info udp
NL 193.42.110.193:80 carambasti.info tcp
US 8.8.8.8:53 193.110.42.193.in-addr.arpa udp
US 8.8.8.8:53 iplogger.com udp
DE 148.251.234.93:443 iplogger.com tcp
US 8.8.8.8:53 93.234.251.148.in-addr.arpa udp
US 8.8.8.8:53 b47n300.info udp
LV 94.140.112.52:80 b47n300.info tcp
US 8.8.8.8:53 52.112.140.94.in-addr.arpa udp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.13.31:443 api.ip.sb tcp
US 8.8.8.8:53 31.13.26.104.in-addr.arpa udp
US 8.8.8.8:53 n57b30a.info udp
LV 94.140.112.52:81 n57b30a.info tcp
US 104.26.13.31:443 api.ip.sb tcp
US 8.8.8.8:53 files.catbox.moe udp
CA 108.181.20.35:443 files.catbox.moe tcp
US 188.114.97.0:80 act.reactionharbor.xyz tcp
US 8.8.8.8:53 downloads.adblockfast.com udp
US 172.67.214.46:443 downloads.adblockfast.com tcp
US 8.8.8.8:53 35.20.181.108.in-addr.arpa udp
US 8.8.8.8:53 46.214.67.172.in-addr.arpa udp
US 8.8.8.8:53 api.joinmassive.com udp
NL 65.9.86.23:443 api.joinmassive.com tcp
US 8.8.8.8:53 23.86.9.65.in-addr.arpa udp
US 8.8.8.8:53 downloads.joinmassive.com udp
US 9.9.9.9:53 www.msftncsi.com udp
US 18.65.39.36:443 downloads.joinmassive.com tcp
US 18.65.39.36:443 downloads.joinmassive.com tcp
US 18.65.39.36:443 downloads.joinmassive.com tcp
US 18.65.39.36:443 downloads.joinmassive.com tcp
US 8.8.8.8:53 9.9.9.9.in-addr.arpa udp
US 8.8.8.8:53 36.39.65.18.in-addr.arpa udp
US 18.65.39.36:443 downloads.joinmassive.com tcp
US 18.65.39.36:443 downloads.joinmassive.com tcp
US 8.8.8.8:53 api.joinmassive.com udp
NL 65.9.86.117:443 api.joinmassive.com tcp
NL 65.9.86.117:443 api.joinmassive.com tcp
US 8.8.8.8:53 117.86.9.65.in-addr.arpa udp
US 18.65.39.36:443 downloads.joinmassive.com tcp
US 18.65.39.36:443 downloads.joinmassive.com tcp
US 8.8.8.8:53 d1ql3z8u1oo390.cloudfront.net udp
NL 52.222.137.39:80 d1ql3z8u1oo390.cloudfront.net tcp
US 8.8.8.8:53 ocsp.r2m02.amazontrust.com udp
US 18.239.100.55:80 ocsp.r2m02.amazontrust.com tcp
US 8.8.8.8:53 39.137.222.52.in-addr.arpa udp
US 8.8.8.8:53 41.102.239.18.in-addr.arpa udp
US 8.8.8.8:53 post.securestudies.com udp
US 165.193.78.234:443 post.securestudies.com tcp
NL 65.9.86.23:443 api.joinmassive.com tcp
US 8.8.8.8:53 234.78.193.165.in-addr.arpa udp
NL 65.9.86.23:443 api.joinmassive.com tcp
NL 65.9.86.117:443 api.joinmassive.com tcp
NL 65.9.86.117:443 api.joinmassive.com tcp
NL 65.9.86.23:443 api.joinmassive.com tcp
NL 65.9.86.23:443 api.joinmassive.com tcp
US 8.8.8.8:53 api.joinmassive.com udp
NL 65.9.86.117:443 api.joinmassive.com tcp
US 8.8.8.8:53 101.15.18.104.in-addr.arpa udp
US 8.8.8.8:53 101.14.18.104.in-addr.arpa udp
US 8.8.8.8:53 geo-network.joinmassive.com udp
US 44.241.114.175:8017 geo-network.joinmassive.com tcp
N/A 127.0.0.1:53482 tcp
N/A 127.0.0.1:53496 tcp
N/A 127.0.0.1:53511 tcp
N/A 127.0.0.1:53530 tcp
N/A 127.0.0.1:53537 tcp
N/A 127.0.0.1:53555 tcp
N/A 127.0.0.1:53557 tcp
N/A 127.0.0.1:53605 tcp
US 8.8.8.8:53 175.114.241.44.in-addr.arpa udp
N/A 127.0.0.1:53712 tcp
N/A 127.0.0.1:54031 tcp
N/A 127.0.0.1:54083 tcp
N/A 127.0.0.1:54125 tcp
N/A 127.0.0.1:54732 tcp
N/A 127.0.0.1:54734 tcp
US 8.8.8.8:53 files.catbox.moe udp
CA 108.181.20.35:443 files.catbox.moe tcp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
DE 167.235.204.174:27016 167.235.204.174 tcp
US 8.8.8.8:53 99.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 22.249.124.192.in-addr.arpa udp
US 8.8.8.8:53 174.204.235.167.in-addr.arpa udp
US 8.8.8.8:53 da26gklo05t50.cloudfront.net udp
NL 108.156.61.166:443 da26gklo05t50.cloudfront.net tcp
US 8.8.8.8:53 save.enabledstats.com udp
US 8.8.8.8:53 stackpath.bootstrapcdn.com udp
US 104.18.11.207:443 stackpath.bootstrapcdn.com tcp
US 52.6.255.126:443 save.enabledstats.com tcp
US 8.8.8.8:53 166.61.156.108.in-addr.arpa udp
US 8.8.8.8:53 207.11.18.104.in-addr.arpa udp
US 8.8.8.8:53 126.255.6.52.in-addr.arpa udp

Files

memory/912-133-0x0000000000400000-0x00000000004D8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-SJFE1.tmp\Air Cluster Pro 130.tmp

MD5 c1186d360e7b3db56757bc78a428f486
SHA1 2018c76fa571ce86c8beddc70589aab0a380e3e4
SHA256 999b0adc768a8a974e04fa9fe6c44abf026b0847ba1926b2513236ef90334ab5
SHA512 af2e6084f25ca2745421f227868f214d5e12c3ee23f7ee52d35b57705d1b7c3adb5863549738e673288b7fd5ac959a6e47f52f7397af374fa8a04080cfc9e502

memory/436-139-0x0000000000D10000-0x0000000000D11000-memory.dmp

memory/912-140-0x0000000000400000-0x00000000004D8000-memory.dmp

memory/436-141-0x0000000000400000-0x000000000071C000-memory.dmp

memory/436-142-0x0000000000D10000-0x0000000000D11000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-SJFE1.tmp\Air Cluster Pro 130.tmp

MD5 c1186d360e7b3db56757bc78a428f486
SHA1 2018c76fa571ce86c8beddc70589aab0a380e3e4
SHA256 999b0adc768a8a974e04fa9fe6c44abf026b0847ba1926b2513236ef90334ab5
SHA512 af2e6084f25ca2745421f227868f214d5e12c3ee23f7ee52d35b57705d1b7c3adb5863549738e673288b7fd5ac959a6e47f52f7397af374fa8a04080cfc9e502

C:\Users\Admin\AppData\Local\Temp\is-RO421.tmp\setup.exe

MD5 505b118aac3589ead2c668773107bf9f
SHA1 86304f33b7ac40ac4e83782882190af92864ad5a
SHA256 8a252e0856514c1cd83c1ee44b601ba497289c84e5c04f3930265a9c70ae3ece
SHA512 5c0950f37a6a899240e8c22adde6f49f5b625ccdd41416c3733e9ecb2a4fcc7a08e96f9dd91a5e3da514a3ac79d58231ca4cf2440a59a347165297fba35de37b

C:\Users\Admin\AppData\Local\Temp\is-RO421.tmp\setup.exe

MD5 505b118aac3589ead2c668773107bf9f
SHA1 86304f33b7ac40ac4e83782882190af92864ad5a
SHA256 8a252e0856514c1cd83c1ee44b601ba497289c84e5c04f3930265a9c70ae3ece
SHA512 5c0950f37a6a899240e8c22adde6f49f5b625ccdd41416c3733e9ecb2a4fcc7a08e96f9dd91a5e3da514a3ac79d58231ca4cf2440a59a347165297fba35de37b

C:\Users\Admin\AppData\Local\Temp\is-RO421.tmp\setup.exe

MD5 505b118aac3589ead2c668773107bf9f
SHA1 86304f33b7ac40ac4e83782882190af92864ad5a
SHA256 8a252e0856514c1cd83c1ee44b601ba497289c84e5c04f3930265a9c70ae3ece
SHA512 5c0950f37a6a899240e8c22adde6f49f5b625ccdd41416c3733e9ecb2a4fcc7a08e96f9dd91a5e3da514a3ac79d58231ca4cf2440a59a347165297fba35de37b

memory/3808-208-0x0000000000400000-0x00000000004D8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-COCDP.tmp\setup.tmp

MD5 f8a2f4a300c0655e6681f5b6b3a20c27
SHA1 e8a3971dca03c4be5cf483fcef04b14a32d22eba
SHA256 09413d7208f0b830bb7e7e4f8d421e6ca83c5336b7abfc8428e8ba756e87be22
SHA512 db7b946804f46e0dc03db2aa5c259caf893758f47dd5e7c2a6320081b3f52b44d6714fcfadc08f40f8f269cd0c5d458aaca7f35d1fb4e843b6424acf921f859c

C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\_isetup\_isdecmp.dll

MD5 077cb4461a2767383b317eb0c50f5f13
SHA1 584e64f1d162398b7f377ce55a6b5740379c4282
SHA256 8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64
SHA512 b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547

C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\_isetup\_isdecmp.dll

MD5 077cb4461a2767383b317eb0c50f5f13
SHA1 584e64f1d162398b7f377ce55a6b5740379c4282
SHA256 8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64
SHA512 b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547

C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\idp.dll

MD5 55c310c0319260d798757557ab3bf636
SHA1 0892eb7ed31d8bb20a56c6835990749011a2d8de
SHA256 54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
SHA512 e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

memory/436-224-0x0000000000400000-0x000000000071C000-memory.dmp

memory/1256-225-0x00000000026B0000-0x00000000026B1000-memory.dmp

memory/3808-226-0x0000000000400000-0x00000000004D8000-memory.dmp

memory/1256-228-0x0000000000400000-0x000000000071C000-memory.dmp

memory/1256-238-0x0000000000400000-0x000000000071C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s0.exe

MD5 52742e7ca3ab70176f9e7797be655e1f
SHA1 46240ce20582f88513bf1fc86db6a749d97cb75d
SHA256 4ec6ccb79b66699a67b7df4275f4abc87421a2e1a75b15f528ed9964aa5fffb4
SHA512 41e77621d8f2911b316ce27636dc2ddf509f98ad3a17a60258e36599613131b20068050dcdc02c072a3d4d08ffb3396d6ae50aca2034c21dfc35db5bd825541d

memory/5044-242-0x0000000000400000-0x00000000004D8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s0.exe

MD5 52742e7ca3ab70176f9e7797be655e1f
SHA1 46240ce20582f88513bf1fc86db6a749d97cb75d
SHA256 4ec6ccb79b66699a67b7df4275f4abc87421a2e1a75b15f528ed9964aa5fffb4
SHA512 41e77621d8f2911b316ce27636dc2ddf509f98ad3a17a60258e36599613131b20068050dcdc02c072a3d4d08ffb3396d6ae50aca2034c21dfc35db5bd825541d

C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp

MD5 35641ce29349e4ff8019362c2f1a6713
SHA1 4bde30eb8814b07ae39ad72516071b1abc9e4f70
SHA256 b09afb08306f1e125e35d0224ec3e33be32d6efc9691fe0803e9fdd87d440b83
SHA512 0c13469f714e7511f5f4f2cbca39e614ac65e8077683ed5a67153e81a02d9d7768e696981881f31ca02c23db9e961c0fe64ad1e01630a1ffb4f360bffd3915a2

C:\Users\Admin\AppData\Local\Temp\is-AUKLN.tmp\_isetup\_iscrypt.dll

MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

memory/2948-253-0x00000000008D0000-0x00000000008D1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-M7SVI.tmp\s0.tmp

MD5 35641ce29349e4ff8019362c2f1a6713
SHA1 4bde30eb8814b07ae39ad72516071b1abc9e4f70
SHA256 b09afb08306f1e125e35d0224ec3e33be32d6efc9691fe0803e9fdd87d440b83
SHA512 0c13469f714e7511f5f4f2cbca39e614ac65e8077683ed5a67153e81a02d9d7768e696981881f31ca02c23db9e961c0fe64ad1e01630a1ffb4f360bffd3915a2

\??\c:\users\admin\appdata\local\temp\is-aukln.tmp\{app}\cvysapfvmvsjevb.cab

MD5 311b9064d72279593f2e540468d02928
SHA1 3b48b75468fd479c618d94a1a9af4b30cfbc19f0
SHA256 43d5335af9a54cfec3bb22ab903066ee1415b85d8668975ffdb4e4e06962fd91
SHA512 054bd0d323dac576d8831e9049c695bca5b052ec33f03122995e0287fc9cf4b7547d794eca5214db11e8bc8582d27931d68e1bd7edfcaeee4fa161d23a130486

C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe

MD5 c0eb3eac96511077dafc0afa64c6388c
SHA1 33e81f25493eda3bbf0b7cdcddd523547fa6c31e
SHA256 eec4f18f3655f7eab0c08783ad42d2b3ce3ef21ecad7394e165f11acdb41c42a
SHA512 2632bef55323d9a272e1519e2b2792527d28cbd9fe6a9f9d253e5729978be0de6f36b8e3b2acee70449ba22a33efb41c82c82afe19dad14698b3ada0006ca7fc

C:\ProgramData\regid.1993-06.com.microsoft\wmiprvse.exe

MD5 c0eb3eac96511077dafc0afa64c6388c
SHA1 33e81f25493eda3bbf0b7cdcddd523547fa6c31e
SHA256 eec4f18f3655f7eab0c08783ad42d2b3ce3ef21ecad7394e165f11acdb41c42a
SHA512 2632bef55323d9a272e1519e2b2792527d28cbd9fe6a9f9d253e5729978be0de6f36b8e3b2acee70449ba22a33efb41c82c82afe19dad14698b3ada0006ca7fc

C:\ProgramData\regid.1993-06.com.microsoft\PCICL32.dll

MD5 d3d39180e85700f72aaae25e40c125ff
SHA1 f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15
SHA256 38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5
SHA512 471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f

C:\ProgramData\regid.1993-06.com.microsoft\PCICL32.DLL

MD5 d3d39180e85700f72aaae25e40c125ff
SHA1 f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15
SHA256 38684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5
SHA512 471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f

C:\ProgramData\regid.1993-06.com.microsoft\pcicapi.dll

MD5 34dfb87e4200d852d1fb45dc48f93cfc
SHA1 35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641
SHA256 2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703
SHA512 f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2

C:\ProgramData\regid.1993-06.com.microsoft\pcichek.dll

MD5 104b30fef04433a2d2fd1d5f99f179fe
SHA1 ecb08e224a2f2772d1e53675bedc4b2c50485a41
SHA256 956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd
SHA512 5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f

C:\ProgramData\regid.1993-06.com.microsoft\MSVCR100.dll

MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

C:\ProgramData\regid.1993-06.com.microsoft\msvcr100.dll

MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

memory/2948-332-0x0000000000400000-0x000000000071B000-memory.dmp

C:\ProgramData\regid.1993-06.com.microsoft\client32.ini

MD5 ae72e7e3fcb4807d9b72e3797f7180d1
SHA1 d3891f3987b12221e7fdb44c61f6fcc808b8cf18
SHA256 bae70a72f9f759e748f04ee3241fd228775746823f4c912085fae4f63edb075c
SHA512 9aeda2de2970d07c09846da4533488e50c0c036dee88dac40cf19c556f59bf47cf65943d293b8299c254b73f8ff30f2a86176684a94cab6700dff2f3e5940a67

C:\ProgramData\regid.1993-06.com.microsoft\NSM.LIC

MD5 e9609072de9c29dc1963be208948ba44
SHA1 03bbe27d0d1ba651ff43363587d3d6d2e170060f
SHA256 dc6a52ad6d637eb407cc060e98dfeedcca1167e7f62688fb1c18580dd1d05747
SHA512 f0e26aa63b0c7f1b31074b9d6eef88d0cfbc467f86b12205cb539a45b0352e77ce2f99f29baeab58960a197714e72289744143ba17975699d058fe75d978dfd0

memory/5044-335-0x0000000000400000-0x00000000004D8000-memory.dmp

C:\ProgramData\regid.1993-06.com.microsoft\HTCTL32.DLL

MD5 c94005d2dcd2a54e40510344e0bb9435
SHA1 55b4a1620c5d0113811242c20bd9870a1e31d542
SHA256 3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899
SHA512 2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a

C:\ProgramData\regid.1993-06.com.microsoft\HTCTL32.DLL

MD5 c94005d2dcd2a54e40510344e0bb9435
SHA1 55b4a1620c5d0113811242c20bd9870a1e31d542
SHA256 3c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899
SHA512 2e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a

C:\ProgramData\regid.1993-06.com.microsoft\TCCTL32.DLL

MD5 2c88d947a5794cf995d2f465f1cb9d10
SHA1 c0ff9ea43771d712fe1878dbb6b9d7a201759389
SHA256 2b92ea2a7d2be8d64c84ea71614d0007c12d6075756313d61ddc40e4c4dd910e
SHA512 e55679ff66ded375a422a35d0f92b3ac825674894ae210dbef3642e4fc232c73114077e84eae45c6e99a60ef4811f4a900b680c3bf69214959fa152a3dfbe542

C:\ProgramData\regid.1993-06.com.microsoft\TCCTL32.DLL

MD5 2c88d947a5794cf995d2f465f1cb9d10
SHA1 c0ff9ea43771d712fe1878dbb6b9d7a201759389
SHA256 2b92ea2a7d2be8d64c84ea71614d0007c12d6075756313d61ddc40e4c4dd910e
SHA512 e55679ff66ded375a422a35d0f92b3ac825674894ae210dbef3642e4fc232c73114077e84eae45c6e99a60ef4811f4a900b680c3bf69214959fa152a3dfbe542

C:\ProgramData\regid.1993-06.com.microsoft\PCICHEK.DLL

MD5 104b30fef04433a2d2fd1d5f99f179fe
SHA1 ecb08e224a2f2772d1e53675bedc4b2c50485a41
SHA256 956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd
SHA512 5efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f

C:\ProgramData\regid.1993-06.com.microsoft\pcicapi.dll

MD5 34dfb87e4200d852d1fb45dc48f93cfc
SHA1 35b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641
SHA256 2d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703
SHA512 f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2

C:\ProgramData\regid.1993-06.com.microsoft\msvcr100.dll

MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 b5f5369274e3bfbc449588bbb57bd383
SHA1 58bb46d57bd70c1c0bcbad619353cbe185f34c3b
SHA256 4190bd2ec2c0c65a2b8b97782cd3ae1d6cead80242f3595f06ebc6648c3e3464
SHA512 04a3816af6c5a335cde99d97019a3f68ade65eba70e4667c4d7dd78f78910481549f1dad23a46ccf9efa2e25c6e7a7c78c592b6ace951e1aab106ba06a10fcd6

\??\pipe\LOCAL\crashpad_4920_SKCJFYWUCPBOMROE

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ee92225994112923f2c446b671860189
SHA1 8ed3835c00909fb86f79dce88d7243bed1185e66
SHA256 e232315eeb386f19c460bc6d160ea41d604df12a04002a869e8cb507e8aab3ef
SHA512 6c6cf2433a6bc829af0cae4619f6aedfff673658162df65174b70862171e9cf2c1289f629b552c359903244e5c98e85a8497ea61aa7cd3445450366ba63e8231

C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s2.exe

MD5 2ecbc6fceedd9bfd44839faae82199cf
SHA1 19a11b40c111ed91648461f7a2ca2c04be286297
SHA256 20f525d938924dd451e9abbc3339fa0e5dbd4c062b1660ee9a40cde53626ab7f
SHA512 ebbc0f86e96e424c5da1d687075b13dc6c03fbc3354b878f146d3448fe8090dccf76b32e8c338f64deaae89007593b9cd746716126ecb4354b327a31d5e2f558

C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s2.exe

MD5 2ecbc6fceedd9bfd44839faae82199cf
SHA1 19a11b40c111ed91648461f7a2ca2c04be286297
SHA256 20f525d938924dd451e9abbc3339fa0e5dbd4c062b1660ee9a40cde53626ab7f
SHA512 ebbc0f86e96e424c5da1d687075b13dc6c03fbc3354b878f146d3448fe8090dccf76b32e8c338f64deaae89007593b9cd746716126ecb4354b327a31d5e2f558

memory/1892-437-0x0000000003760000-0x00000000037A2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 9743020b7066c1d97d4c3631985bcaa4
SHA1 b34ec16d1aea41fd81e25b2aba761efdf6cc473b
SHA256 355c6a8d0f626b9ab2866831bf38ca01569b52b935f216b59a17a518cee698e8
SHA512 8f83273ea685bf9a77b4c4e81bb1233247ad372befc0b3a896d55b3d59201685591f2133240f7b7b81778d66e859846af3406da6277b1c6da9077873ca763a9f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 cce5f5926ddc5f223dfc962c6b1e550c
SHA1 ff2a5cf5513f7d2fd3f3d66995782854b47565d5
SHA256 8e55ae82818215ce42739b4731b4cad497624688ec43156d232810cb426ae3e9
SHA512 f01fc648d00b37239d84a1ef6db660f7c249e2719a4f70ea6489ad13566642d0cadc52acd4aaab16242bc9c9bb75d7c009d3c3e1e8774b49596ffd5efcdde099

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 29213338df67d29d6454ee5d61ad3970
SHA1 8c69ca76a2e639060d5ce835a9600e6ea3764a83
SHA256 d29fc0d97fa74d382d0f557ecea4e42b7d50dbce43915bfc0c114c16e532aa51
SHA512 14db25eba8a863d390b97fce4315402ed7c249598ff6c31d5a191b0f71c274eead42ba0658403e744110de072e6ff1cac3bccee1e48875bde6b1fe39a60d2407

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 8080ba7f0d0776afcc772b876a325ca6
SHA1 4bc98eb66cbe31252e2f04c193d87de8cb5c671a
SHA256 2021d988dd55b36d05a135d1983ed137c8c622c79cea9e85ebd75c39c28ceb2c
SHA512 52fea3c7b14fe6008f1796f1733a6be3a87c979ca2a65364ec23b5da4e9cd4d8ceb67872c9a1b40bb9e4a928ee4235e29683af236312566489e03afc017cbac4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c059bb4a5c239bffac8b975448533090
SHA1 2949d29752ca9285f553faba06cafef44766d8a6
SHA256 76cdbcee6568df8af8f26e8b776b5af93eac1a2ed35e274a709f251cfaf20adf
SHA512 e34e7d8faaf94aae126b84b8807cfe955c4e75b7568c9c1926767606160bdbc413be1ac535437b460c0e4617c7f24571c2073f4220b46153f6e5cf8fc1154dd6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 7ab81c76732542afaedc124540196b5c
SHA1 b3233f51be7df6d8d3eea7001f50011bae44450f
SHA256 ac2879120ca14a1e1733a70e81b5ab6dd5056327e6101c7d5ab912bceb592f6b
SHA512 7d1cb60bd100e0b25962b1a1f8604cd98ea3e82cce11400168008889eab8baf07ccff5b3847423a131462a43f90f453f6061fdc1172b25c197aa6d7a47a563f9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\status.log

MD5 444bcb3a3fcf8389296c49467f27e1d6
SHA1 7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb
SHA256 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
SHA512 9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570

C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe

MD5 fa24733f5a6a6f44d0e65d7d98b84aa6
SHA1 51a62beab55096e17f2e17f042f7bd7dedabf1ae
SHA256 da1b144b5f908cb7e811489dfe660e06aa6df9c9158c6972ec9c79c48afacb7e
SHA512 1953201d8cd448aa7d23c3e57665546ace835f97c8cc8d0f323573cef03a6f317f86c7c3841268ece1760b911c67845d7e6aa198a44f720dca02a5a8bcb8e21e

C:\Users\Admin\AppData\Local\Temp\is-48F1J.tmp\s3.exe

MD5 fa24733f5a6a6f44d0e65d7d98b84aa6
SHA1 51a62beab55096e17f2e17f042f7bd7dedabf1ae
SHA256 da1b144b5f908cb7e811489dfe660e06aa6df9c9158c6972ec9c79c48afacb7e
SHA512 1953201d8cd448aa7d23c3e57665546ace835f97c8cc8d0f323573cef03a6f317f86c7c3841268ece1760b911c67845d7e6aa198a44f720dca02a5a8bcb8e21e

C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\decoder.dll

MD5 8a3f1a0da39530dcb8962dd0fadb187f
SHA1 d5294f6be549ec1f779da78d903683bab2835d1a
SHA256 c6988e36b1e1d6ffc89d9fa77ad35f132f5aa89e680d0155e0b6aee1c524c99f
SHA512 1e0d5be3ee164fb16de629a975f3c3da61659b99a0fc766850ffeeddb2d32b7ee0d3b85c77f01d34d9fe2933bd7bd11c6dba7b35d30faed7ce09485fd706d49d

C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\decoder.dll

MD5 8a3f1a0da39530dcb8962dd0fadb187f
SHA1 d5294f6be549ec1f779da78d903683bab2835d1a
SHA256 c6988e36b1e1d6ffc89d9fa77ad35f132f5aa89e680d0155e0b6aee1c524c99f
SHA512 1e0d5be3ee164fb16de629a975f3c3da61659b99a0fc766850ffeeddb2d32b7ee0d3b85c77f01d34d9fe2933bd7bd11c6dba7b35d30faed7ce09485fd706d49d

C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\decoder.dll

MD5 8a3f1a0da39530dcb8962dd0fadb187f
SHA1 d5294f6be549ec1f779da78d903683bab2835d1a
SHA256 c6988e36b1e1d6ffc89d9fa77ad35f132f5aa89e680d0155e0b6aee1c524c99f
SHA512 1e0d5be3ee164fb16de629a975f3c3da61659b99a0fc766850ffeeddb2d32b7ee0d3b85c77f01d34d9fe2933bd7bd11c6dba7b35d30faed7ce09485fd706d49d

C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi

MD5 6024d8c2207fc4610416beaf8d360527
SHA1 793ab731b07bf86ecc3ba78e1b76dc2aa0b48f8a
SHA256 cb4cad56ea5391e44dc661513c4f021c5272db710cc1733251152d1cb0eb5829
SHA512 0bb9cd1ec8873137e654a94c21887b7d4c73a9e561563d52ddec18377552d1a33d256487362bb614ebb3d804047427977b3eb0070c92fc43d0dd656af13eeab4

C:\Users\Admin\AppData\Local\Temp\INACD20.tmp

MD5 dd1f93eb81e6c99ba9be55b0c12e8bb4
SHA1 1d767983aaa4eb5c9e19409cf529969142033850
SHA256 f55b853958f07b15f0dae7a871c1ebe2ec117ef54ba3811d31cec4c8ae471d9b
SHA512 7968839ca3e7337b2e7774d92c4a3666e9b7d8d76000475b39c2bda6db3320fc9b2100322505997798af5631a007787fbd8d0d6fe0b51949c545c67e696aaf1a

C:\Users\Admin\AppData\Local\Temp\MSICE1C.tmp

MD5 6ea65025106536eb75f026e46643b099
SHA1 d6f5801e370c92d8e5c2336b4022cc6cb6ec1f99
SHA256 dae76cce74d63e7935fde4383020659d75b68632f8a01f2053ec895e69bb4efb
SHA512 062aed4c7541346b7338e1d234a50aa9af76f103a65268ba65a42508a26c10cc27ccfce6131485403afa36d8a8cd69f3bf1e55cd1a1f675357b87228aacbb988

C:\Users\Admin\AppData\Local\Temp\MSICE1C.tmp

MD5 6ea65025106536eb75f026e46643b099
SHA1 d6f5801e370c92d8e5c2336b4022cc6cb6ec1f99
SHA256 dae76cce74d63e7935fde4383020659d75b68632f8a01f2053ec895e69bb4efb
SHA512 062aed4c7541346b7338e1d234a50aa9af76f103a65268ba65a42508a26c10cc27ccfce6131485403afa36d8a8cd69f3bf1e55cd1a1f675357b87228aacbb988

C:\Users\Admin\AppData\Local\Temp\MSICF94.tmp

MD5 91d4a8c2c296ef53dd8c01b9af69b735
SHA1 ad2e5311a0f2dbba988fbdb6fcf70034fda3920d
SHA256 a787e7a1ad12783fcbf3f853940590329e0ff0dddf17282324f2d95ed6408f23
SHA512 63c5506a55dea2b3bd1c99b79b5668f5afc0104564e92f07afb42f2f2b67eae9d0e0174cb36e6095a27a6c71496206042079b6e5a2b2ff787f3cb9ef20995e9e

C:\Users\Admin\AppData\Local\Temp\MSICF94.tmp

MD5 91d4a8c2c296ef53dd8c01b9af69b735
SHA1 ad2e5311a0f2dbba988fbdb6fcf70034fda3920d
SHA256 a787e7a1ad12783fcbf3f853940590329e0ff0dddf17282324f2d95ed6408f23
SHA512 63c5506a55dea2b3bd1c99b79b5668f5afc0104564e92f07afb42f2f2b67eae9d0e0174cb36e6095a27a6c71496206042079b6e5a2b2ff787f3cb9ef20995e9e

C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi

MD5 6024d8c2207fc4610416beaf8d360527
SHA1 793ab731b07bf86ecc3ba78e1b76dc2aa0b48f8a
SHA256 cb4cad56ea5391e44dc661513c4f021c5272db710cc1733251152d1cb0eb5829
SHA512 0bb9cd1ec8873137e654a94c21887b7d4c73a9e561563d52ddec18377552d1a33d256487362bb614ebb3d804047427977b3eb0070c92fc43d0dd656af13eeab4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF

MD5 985e274aa437a9c85927eed8660d7f41
SHA1 b9293c46911855640b82971c63670abc6964cebc
SHA256 254a63b0867289bf1180660fc53956ccee889a15b9227620e28e7bebc4f73e3f
SHA512 6140890845510218dd83bd2c84af26cc8532d901e4b97560fc24432dae60da323b75e5427c7a16f03ecd45aa9eeb989a06a1a88408a35fb4fccaa9070e16221e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC49180A59F0C351C30F112AD97CFA5_6F016B9B077397225160EB6AE2AD9F44

MD5 3e6a6622470e4ac3a74c140e5043a72a
SHA1 169ef64f5923b5f0688cfc35b0a8670414cab03e
SHA256 84978b198f8d5aa439f55703757476d74b9c94d1e8b1925c5a4f336f39ee6321
SHA512 492aed0ba07c19c9dfd5430a60bbbecc9999de13387096f76f522c72b59509df8c69ff98422172efd87329e7277a5ad919be320b0d765596d01498a8affb47dd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC49180A59F0C351C30F112AD97CFA5_6F016B9B077397225160EB6AE2AD9F44

MD5 fe855f8e8caadc7efdf8caa37343b776
SHA1 0c75808e59ddfeb4053c07a04ec5be725f97246d
SHA256 77ca919778fd4f5a62d002f08b6d6920cc200119a2cc82594c5a359096d10528
SHA512 2e2e2a97c9a91c68c79887fa52fe92773f300b7db152042e5454eaf9aaf89e9afcbf33e359a0c06db21137d6ff14f62cf712c14cc0f53d6006ee09293fb7a6eb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF

MD5 b0b3e9bf4e253e4e172bf68d4f60cd33
SHA1 489f7f66c8c1b5505eb540aee816753e3c522609
SHA256 74f090915ac5dd5856c604de7155337961d786f7b1db1469d814ae3bcf4635ee
SHA512 21299cf0ee94775ee62880a52494c051b7815775fc0851867c000e34a34ca78a6534f3ccbbb790ea7b2cf6bba00195e145e41d6873a24d6fcc4bbd9d731fa120

C:\Windows\Installer\MSID917.tmp

MD5 dd1f93eb81e6c99ba9be55b0c12e8bb4
SHA1 1d767983aaa4eb5c9e19409cf529969142033850
SHA256 f55b853958f07b15f0dae7a871c1ebe2ec117ef54ba3811d31cec4c8ae471d9b
SHA512 7968839ca3e7337b2e7774d92c4a3666e9b7d8d76000475b39c2bda6db3320fc9b2100322505997798af5631a007787fbd8d0d6fe0b51949c545c67e696aaf1a

C:\Windows\Installer\MSID917.tmp

MD5 dd1f93eb81e6c99ba9be55b0c12e8bb4
SHA1 1d767983aaa4eb5c9e19409cf529969142033850
SHA256 f55b853958f07b15f0dae7a871c1ebe2ec117ef54ba3811d31cec4c8ae471d9b
SHA512 7968839ca3e7337b2e7774d92c4a3666e9b7d8d76000475b39c2bda6db3320fc9b2100322505997798af5631a007787fbd8d0d6fe0b51949c545c67e696aaf1a

C:\Windows\Installer\MSID917.tmp

MD5 dd1f93eb81e6c99ba9be55b0c12e8bb4
SHA1 1d767983aaa4eb5c9e19409cf529969142033850
SHA256 f55b853958f07b15f0dae7a871c1ebe2ec117ef54ba3811d31cec4c8ae471d9b
SHA512 7968839ca3e7337b2e7774d92c4a3666e9b7d8d76000475b39c2bda6db3320fc9b2100322505997798af5631a007787fbd8d0d6fe0b51949c545c67e696aaf1a

C:\Windows\Installer\MSIDC93.tmp

MD5 6ea65025106536eb75f026e46643b099
SHA1 d6f5801e370c92d8e5c2336b4022cc6cb6ec1f99
SHA256 dae76cce74d63e7935fde4383020659d75b68632f8a01f2053ec895e69bb4efb
SHA512 062aed4c7541346b7338e1d234a50aa9af76f103a65268ba65a42508a26c10cc27ccfce6131485403afa36d8a8cd69f3bf1e55cd1a1f675357b87228aacbb988

C:\Users\Admin\AppData\Local\Temp\shiDD5D.tmp

MD5 125b0f6bf378358e4f9c837ff6682d94
SHA1 8715beb626e0f4bd79a14819cc0f90b81a2e58ad
SHA256 e99eab3c75989b519f7f828373042701329acbd8ceadf4f3ff390f346ac76193
SHA512 b63bb6bfda70d42472868b5a1d3951cf9b2e00a7fadb08c1f599151a1801a19f5a75cfc3ace94c952cfd284eb261c7d6f11be0ebbcaa701b75036d3a6b442db2

C:\Users\Admin\AppData\Local\Temp\shiDD3D.tmp

MD5 6c7cdd25c2cb0073306eb22aebfc663f
SHA1 a1eba8ab49272b9852fe6a543677e8af36271248
SHA256 58280e3572333f97a7cf9f33e8d31dc26a98b6535965ebd0bde82249fc9bf705
SHA512 17344e07b9e9b2cd6ae4237d7f310732462f9cbb8656883607d7a1a4090e869265f92a6da1718dee50b1375b91583de60c6bd9e7e8db6b6e45e33f4b894365d6

C:\Users\Admin\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\{DCD9E27B-8AF6-4D32-B78F-8CA8EF7C0DB2}.session

MD5 09d9afaf404bdd1c088e6b3978d47c05
SHA1 16e00c80112985ceebe873317f0c450a31567317
SHA256 47688ed14c1fa3204adda82beede3aa70b92db415011fcd657e3336043e2d70b
SHA512 48d8c3a96b22446be216260b9990ab81b70dbd4fadda09a5bcc4cf789157bea90d2dedbf1db62bb53a18ada2bb1c04985f3f5d33365d08daa3145f8cf66a5a45

C:\Users\Admin\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\{DCD9E27B-8AF6-4D32-B78F-8CA8EF7C0DB2}.session

MD5 d641b01bd9066a340c1a6e2e80bc43cb
SHA1 af6689e743fa8a7573a615c8882a48d3b58dc788
SHA256 a584154b05645eeee160fb7d128afdb7cfff44aaa9291f49fb85415c7c4130e9
SHA512 3feefc7da5bae2709e0fef054dc6f071000b977375d5e1b8b39631ef8d4654ef65dcd55f3476af503155d45d9a70e90a52304f4a355c4d5f206ce52c9b600059

C:\Users\Admin\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\tracking.ini

MD5 02d1d6f01a83809c30bad4ef882269bb
SHA1 9a7059732f8debd6406cad795d9c3312b41f4571
SHA256 eda0b19537df2070d0a8aac17f52d951e4b739c03256495ac886c48c69ce2649
SHA512 943133aa517f3c8730cc9aecfc882f38117ec810ebacd8c4386a2fe4086f00b914acf8afec0f14e3db1f9b12a1b19c7fdadda861561ecb6d1dd369ec4166a7a8

C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ini

MD5 2c01c8e1183c52fad1a3d6b836302aee
SHA1 f1f022a839c20513eee76f5d12449625ef387f01
SHA256 f7f43a12f0fdafe6449a27b396f97aad2a7d5611c2604b2eb1f63e6c76cfa719
SHA512 ad7ecc9662eca037aeb88f31c0dc6572a80419e07cf0fd407422a15e6ec42afc5ea4944ac409dc41c7ef4d4e604446615da24821637ee5cb41abf72885d8d93e

C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ini

MD5 426fafdc8036ab61ddd25d3027c4f192
SHA1 370496efd4916099c4b2b9441bf89eb0eefdc6e9
SHA256 4671edbba3f050a9233f4dadd1e83e74a3e9f077de1dba6e8c2b76d0404ef37c
SHA512 3d49f912f72701ea3cf62d42a2f1d828ba0459996da08cf5fce0ffdf0edc843ff6bd3ae747969677624d69ddb2b48cd41f64eee892d58340ffc97c025385ce73

C:\Config.Msi\e5bd62c.rbs

MD5 c7e38b327d990355f942e328fc8170da
SHA1 9aa990c678b322217cd25d78906569511d4897fb
SHA256 be7434bb6c8bf1600c73bf60eaf6394f3de129a97cb7a26d7aa4378e156416c0
SHA512 abc2932a6f1db1405bf76ccaf19b50dd86b7e73e5f0de94ca3d23ee2639231c4f317e19506f0480fb01f3133c0840e13dd06b4ba652b627f7b9d4e91b8ef5db6

C:\Users\Admin\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\tracking.ini

MD5 966e7319169928f32a8ffbbbef9bcd74
SHA1 5fbda270f9c4aa04b647ed5b6f1f65449731bc5a
SHA256 225ffb5a602be9d15476645d9e9a848b7fb0275dbf6387fb9fc34ae0eb332c49
SHA512 e50b337a57bb15e3bd52c080c0da1f5944c70238be873d0e57814e73ea73e7f6f8735b61f7e184cf32724e00fb971aa4476c5604b656f5dc1ff9f26637050571

memory/2684-940-0x00000000006B0000-0x0000000000BAE000-memory.dmp

memory/2684-941-0x00000000006B0000-0x0000000000BAE000-memory.dmp

memory/2684-942-0x00000000006B0000-0x0000000000BAE000-memory.dmp

memory/2684-945-0x0000000007C50000-0x0000000008268000-memory.dmp

memory/2684-947-0x00000000076C0000-0x00000000076D2000-memory.dmp

memory/2684-948-0x00000000077F0000-0x00000000078FA000-memory.dmp

memory/2684-949-0x0000000007750000-0x000000000778C000-memory.dmp

memory/2684-951-0x0000000007740000-0x0000000007750000-memory.dmp

memory/2684-952-0x0000000007A60000-0x0000000007AC6000-memory.dmp

memory/2684-953-0x0000000009380000-0x0000000009924000-memory.dmp

memory/2684-954-0x0000000008ED0000-0x0000000008F62000-memory.dmp

memory/2684-955-0x0000000008FF0000-0x0000000009066000-memory.dmp

memory/2684-956-0x0000000009930000-0x0000000009AF2000-memory.dmp

memory/2684-957-0x000000000A030000-0x000000000A55C000-memory.dmp

memory/2684-958-0x0000000009110000-0x000000000912E000-memory.dmp

memory/2684-959-0x0000000009230000-0x0000000009280000-memory.dmp

memory/2684-962-0x00000000006B0000-0x0000000000BAE000-memory.dmp

memory/4276-968-0x0000000000FB0000-0x0000000001434000-memory.dmp

memory/4276-969-0x0000000000FB0000-0x0000000001434000-memory.dmp

memory/4276-972-0x0000000000FB0000-0x0000000001434000-memory.dmp

memory/4276-974-0x0000000007200000-0x0000000007210000-memory.dmp

memory/4276-977-0x0000000000FB0000-0x0000000001434000-memory.dmp

memory/1376-987-0x0000000000900000-0x0000000000920000-memory.dmp

memory/1376-997-0x0000000005090000-0x00000000050A0000-memory.dmp

memory/1416-1014-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

memory/1376-1018-0x00000000064E0000-0x0000000006502000-memory.dmp

C:\Users\Admin\Programs\Adblock\Adblock.exe

MD5 c4fbe5f997df48686d0d3aea9b0ec2e1
SHA1 e59248b9ab8ad02cb304246cd72c1bf9cfa0eb3b
SHA256 75a7069d46bcbd824fc1315a5f34652fe508cedc1d5e4bf69568e35236be9046
SHA512 900b46caa32d7cb3025a97dc9cae2842f276d87a05c82400b36c55333106ab49eaf1bd709884920bbbad774ca354179b55eae1fa4efd63d1ce06e60a824dfdb8

C:\Users\Admin\AppData\Roaming\Adblock Fast\Massive\usage\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Roaming\Adblock Fast\Massive\usage\000002.dbtmp

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Temp\nsvCA2F.tmp\System.dll

MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

memory/1376-2507-0x0000000005AB0000-0x0000000005AB1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsvCA2F.tmp\inetc.dll

MD5 cab75d596adf6bac4ba6a8374dd71de9
SHA1 fb90d4f13331d0c9275fa815937a4ff22ead6fa3
SHA256 89e24e4124b607f3f98e4df508c4ddd2701d8f7fcf1dc6e2aba11d56c97c0c5a
SHA512 510786599289c8793526969cfe0a96e049436d40809c1c351642b2c67d5fb2394cb20887010727a5da35c52a20c5557ad940967053b1b59ad91ca1307208c391

memory/3552-2534-0x0000018CCAA70000-0x0000018CCAA8A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsvCA2F.tmp\nsDialogs.dll

MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

memory/4260-2549-0x0000000000400000-0x00000000004A1000-memory.dmp

memory/3552-2550-0x0000018CE5050000-0x0000018CE5060000-memory.dmp

C:\ProgramData\62442120711374714065465538

MD5 2011584c02c54d5bf407add4eaf2217b
SHA1 19bfd995e5794d5d51fa267de72aeb1fc724c872
SHA256 65d61945cd7a193122c26369ed22a3abd44e807d3157dff3050843f7505408b2
SHA512 bee9f82fce9b3bd8bdad7f944999a1300e89818e3ac053a0f8ca875b6a9d63d61fbe2e0e7b631d716f8b2b323c13a3f834baf13da85fc828bed183d12da8f942

memory/4260-2640-0x0000000000400000-0x00000000004A1000-memory.dmp

memory/3552-2641-0x0000018CCC780000-0x0000018CCC7A2000-memory.dmp

memory/3552-2660-0x0000018CE5050000-0x0000018CE5060000-memory.dmp

memory/3552-3969-0x0000018CCC750000-0x0000018CCC751000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 9c11cb3689ba25fca35ae6ddb875241a
SHA1 5556cb2295042070eb90c01319f747036836fb13
SHA256 5e8af3c4bb2427244049aa132568035b407c0dd97588742088bc81f09178da54
SHA512 3b0b70a257364f92d013a404389d8971a0f3f6e20d9a814f65bff7f180d29b9cc1c6846b4c0ceb0d23a7fe34b0d41b98a0d7d2afdf876a9680702ec77927db82

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4241b79e09c253bb5d3e715bbebdcd4c
SHA1 b317d494a1455871967042c2e65e27122cee5a42
SHA256 da10a7d27a50ffff56ef9e2a4fbb354ce61faa9fb29f404e31a1e13795c76ae6
SHA512 b95ec54b91dda130f473947eae56bca4587061d4804e7ea3b4eb5d58b9e12cb15429da2a8dc7feae2f146d66b0abde8f60cb85cea9ec00ad153156241e199228

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 bfe029f96319e38a625e25c24e156060
SHA1 edd9f2af3453fa88326b849757d8539ae61a7e7d
SHA256 a9a3781311cdf5e56261fc64653196f1ec057359d3387a62523be29c07a18635
SHA512 d17ff65fe7bab36663a274374f78fb5ac099f008d9255a199298fd3832a57963cf82596cb5b38326be2d1067bc8519ca863d8b90fcfcf3b2c679444ee71bb988

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 fd845be37ea53acc1996b06d596fd3b3
SHA1 5c901dbf1675aed748bcc3e30930677534f97060
SHA256 ae42bdcd5a1371c1fe77a5c467053eb181f276ad78b323e9cc2332a0d8c6830f
SHA512 2db9110348a4529fbda8c3ef0ee89f55dc6279d8f9dba6675da7fd05e2dc354f223e5ca9124a64d0c40a0204d838f51f4e29496ed5140a8bfb21db89ed305429

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 d31240ae2a255e2f258f94add2f8a1a9
SHA1 8c8fadb2c8fbcf0eba47c9e15861a23321cd612e
SHA256 f935f2f89d61bef1edb9fc097d393a2326592e73ca36aa33f1b8101c27578a77
SHA512 1fd2b1a3393a39b21f0e254f403cc215dc333386201ce41c0b479e7e1e89b2cadc8d70649c0e7a6bd284509d6cf1b0ab95287ec42007485ea2c56f763c050314

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 3888d3adf7515f206057d48dcc3979cf
SHA1 90a45d3485b78d3a6944d8da6f71a41c9f5ede1b
SHA256 873a607879129472dec2b707f2400843fceab7d72a2546b5ce64a177f1a0f942
SHA512 a9709d65bc056e1e6edf0c3acf2d029cf352fc369f5612c4f4fcc3809f7317f29b7c8f608d9020c482f0fe12fcd599722fff66ed32b75ab99632744b233e2379

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 f20771e28c1e503f6b5f37e8987b8917
SHA1 3cfed5d83fc46c21fe44348b77f7104fd8bffdbc
SHA256 20395c501b2a8401a5d4e4de8fa234fec395fd3524f397eeaa9686dfcd4f2c55
SHA512 0d3a1c6f063a474edb020d6a4ddda38c01f4994c18810971aef02bb51fbb2cc74abe20c148a2dd62dbc10043173729447f569f9dede4751bab7ed131da461e82