Malware Analysis Report

2025-08-11 02:10

Sample ID 231003-cxvwlsfg7s
Target bd1094b0573e485411252dc35c934eae8f37219353c503d0109e8a83f5f2f0f6
SHA256 bd1094b0573e485411252dc35c934eae8f37219353c503d0109e8a83f5f2f0f6
Tags
amadey dcrat glupteba healer mystic redline smokeloader @ytlogsbot jordan larek up3 backdoor discovery dropper evasion infostealer loader persistence rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bd1094b0573e485411252dc35c934eae8f37219353c503d0109e8a83f5f2f0f6

Threat Level: Known bad

The file bd1094b0573e485411252dc35c934eae8f37219353c503d0109e8a83f5f2f0f6 was found to be: Known bad.

Malicious Activity Summary

amadey dcrat glupteba healer mystic redline smokeloader @ytlogsbot jordan larek up3 backdoor discovery dropper evasion infostealer loader persistence rat spyware stealer trojan

RedLine

RedLine payload

Mystic

Detects Healer an antivirus disabler dropper

Amadey

Glupteba

DcRat

SmokeLoader

Glupteba payload

Healer

Modifies Windows Defender Real-time Protection settings

Modifies Windows Firewall

Downloads MZ/PE file

Reads user/profile data of web browsers

Checks computer location settings

Loads dropped DLL

Uses the VBS compiler for execution

Windows security modification

Executes dropped EXE

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

Program crash

Enumerates physical storage devices

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Checks SCSI registry key(s)

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Runs net.exe

Uses Task Scheduler COM API

Modifies data under HKEY_USERS

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-03 02:27

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-03 02:27

Reported

2023-10-03 02:30

Platform

win10v2004-20230915-en

Max time kernel

98s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bd1094b0573e485411252dc35c934eae8f37219353c503d0109e8a83f5f2f0f6.exe"

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\bd1094b0573e485411252dc35c934eae8f37219353c503d0109e8a83f5f2f0f6.exe N/A

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1oS94UA3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1oS94UA3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1oS94UA3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Windows\SysWOW64\net.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Windows\SysWOW64\net.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1oS94UA3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1oS94UA3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1oS94UA3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Windows\SysWOW64\net.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Windows\SysWOW64\net.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Windows\SysWOW64\net.exe N/A

Mystic

stealer mystic

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\kos1.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\kos.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\PA Previewer\previewer.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\884C.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yG7UT80.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HC1IQ80.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Qk8hn82.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1oS94UA3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2op3709.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3RY26qW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4JR888ei.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5kd4rB0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6174.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vn8zv7Uh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\629E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\aY2kr8VV.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Rz9SE5IY.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mB2nO8vz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1mI85mj9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6772.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\690A.exe N/A
N/A N/A C:\Program Files (x86)\PA Previewer\previewer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\884C.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Dc044iF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ss41.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Windows\System32\Conhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\kos1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9369.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\set16.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\kos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-PKIHR.tmp\is-8S52T.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BA7A.exe N/A
N/A N/A C:\Program Files (x86)\PA Previewer\previewer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Program Files (x86)\PA Previewer\previewer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1oS94UA3.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vn8zv7Uh.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mB2nO8vz.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yG7UT80.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HC1IQ80.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\6174.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Rz9SE5IY.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\bd1094b0573e485411252dc35c934eae8f37219353c503d0109e8a83f5f2f0f6.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Qk8hn82.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\aY2kr8VV.exe N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\PA Previewer\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-PKIHR.tmp\is-8S52T.tmp N/A
File opened for modification C:\Program Files (x86)\PA Previewer\previewer.exe C:\Users\Admin\AppData\Local\Temp\is-PKIHR.tmp\is-8S52T.tmp N/A
File created C:\Program Files (x86)\PA Previewer\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-PKIHR.tmp\is-8S52T.tmp N/A
File created C:\Program Files (x86)\PA Previewer\is-7JG3R.tmp C:\Users\Admin\AppData\Local\Temp\is-PKIHR.tmp\is-8S52T.tmp N/A
File created C:\Program Files (x86)\PA Previewer\is-65IMS.tmp C:\Users\Admin\AppData\Local\Temp\is-PKIHR.tmp\is-8S52T.tmp N/A
File created C:\Program Files (x86)\PA Previewer\is-2C4DC.tmp C:\Users\Admin\AppData\Local\Temp\is-PKIHR.tmp\is-8S52T.tmp N/A
File created C:\Program Files (x86)\PA Previewer\is-G8SI1.tmp C:\Users\Admin\AppData\Local\Temp\is-PKIHR.tmp\is-8S52T.tmp N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1oS94UA3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1oS94UA3.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1oS94UA3.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\net.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4776 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\bd1094b0573e485411252dc35c934eae8f37219353c503d0109e8a83f5f2f0f6.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yG7UT80.exe
PID 4776 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\bd1094b0573e485411252dc35c934eae8f37219353c503d0109e8a83f5f2f0f6.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yG7UT80.exe
PID 4776 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\bd1094b0573e485411252dc35c934eae8f37219353c503d0109e8a83f5f2f0f6.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yG7UT80.exe
PID 1360 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yG7UT80.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HC1IQ80.exe
PID 1360 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yG7UT80.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HC1IQ80.exe
PID 1360 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yG7UT80.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HC1IQ80.exe
PID 3684 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HC1IQ80.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Qk8hn82.exe
PID 3684 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HC1IQ80.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Qk8hn82.exe
PID 3684 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HC1IQ80.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Qk8hn82.exe
PID 4872 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Qk8hn82.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1oS94UA3.exe
PID 4872 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Qk8hn82.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1oS94UA3.exe
PID 4872 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Qk8hn82.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2op3709.exe
PID 4872 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Qk8hn82.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2op3709.exe
PID 4872 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Qk8hn82.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2op3709.exe
PID 5072 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2op3709.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5072 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2op3709.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5072 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2op3709.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5072 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2op3709.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5072 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2op3709.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5072 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2op3709.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5072 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2op3709.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5072 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2op3709.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5072 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2op3709.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5072 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2op3709.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3684 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HC1IQ80.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3RY26qW.exe
PID 3684 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HC1IQ80.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3RY26qW.exe
PID 3684 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HC1IQ80.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3RY26qW.exe
PID 4412 wrote to memory of 5096 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3RY26qW.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4412 wrote to memory of 5096 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3RY26qW.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4412 wrote to memory of 5096 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3RY26qW.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4412 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3RY26qW.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4412 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3RY26qW.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4412 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3RY26qW.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4412 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3RY26qW.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4412 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3RY26qW.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4412 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3RY26qW.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4412 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3RY26qW.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4412 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3RY26qW.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4412 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3RY26qW.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4412 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3RY26qW.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4412 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3RY26qW.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4412 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3RY26qW.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1360 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yG7UT80.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4JR888ei.exe
PID 1360 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yG7UT80.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4JR888ei.exe
PID 1360 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yG7UT80.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4JR888ei.exe
PID 3492 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4JR888ei.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3492 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4JR888ei.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3492 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4JR888ei.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3492 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4JR888ei.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3492 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4JR888ei.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3492 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4JR888ei.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3492 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4JR888ei.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3492 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4JR888ei.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4776 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\bd1094b0573e485411252dc35c934eae8f37219353c503d0109e8a83f5f2f0f6.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5kd4rB0.exe
PID 4776 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\bd1094b0573e485411252dc35c934eae8f37219353c503d0109e8a83f5f2f0f6.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5kd4rB0.exe
PID 4776 wrote to memory of 544 N/A C:\Users\Admin\AppData\Local\Temp\bd1094b0573e485411252dc35c934eae8f37219353c503d0109e8a83f5f2f0f6.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5kd4rB0.exe
PID 544 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5kd4rB0.exe C:\Windows\system32\cmd.exe
PID 544 wrote to memory of 4572 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5kd4rB0.exe C:\Windows\system32\cmd.exe
PID 4572 wrote to memory of 1384 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4572 wrote to memory of 1384 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4572 wrote to memory of 4128 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4572 wrote to memory of 4128 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1384 wrote to memory of 428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1384 wrote to memory of 428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\bd1094b0573e485411252dc35c934eae8f37219353c503d0109e8a83f5f2f0f6.exe

"C:\Users\Admin\AppData\Local\Temp\bd1094b0573e485411252dc35c934eae8f37219353c503d0109e8a83f5f2f0f6.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yG7UT80.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yG7UT80.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HC1IQ80.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HC1IQ80.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Qk8hn82.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Qk8hn82.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1oS94UA3.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1oS94UA3.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2op3709.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2op3709.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5072 -ip 5072

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3968 -ip 3968

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 156

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3RY26qW.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3RY26qW.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4412 -ip 4412

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 588

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4JR888ei.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4JR888ei.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3492 -ip 3492

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 152

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5kd4rB0.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5kd4rB0.exe

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5B8.tmp\5B9.tmp\5C9.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5kd4rB0.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ff9a52646f8,0x7ff9a5264708,0x7ff9a5264718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff9a52646f8,0x7ff9a5264708,0x7ff9a5264718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,5481134992946119268,12167567513840260340,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,13032746923003337301,4944911408874330906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,13032746923003337301,4944911408874330906,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,5481134992946119268,12167567513840260340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,13032746923003337301,4944911408874330906,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13032746923003337301,4944911408874330906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13032746923003337301,4944911408874330906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13032746923003337301,4944911408874330906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,13032746923003337301,4944911408874330906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,13032746923003337301,4944911408874330906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13032746923003337301,4944911408874330906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13032746923003337301,4944911408874330906,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13032746923003337301,4944911408874330906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13032746923003337301,4944911408874330906,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\6174.exe

C:\Users\Admin\AppData\Local\Temp\6174.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vn8zv7Uh.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vn8zv7Uh.exe

C:\Users\Admin\AppData\Local\Temp\629E.exe

C:\Users\Admin\AppData\Local\Temp\629E.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\aY2kr8VV.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\aY2kr8VV.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Rz9SE5IY.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Rz9SE5IY.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mB2nO8vz.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mB2nO8vz.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\659D.bat" "

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1mI85mj9.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1mI85mj9.exe

C:\Users\Admin\AppData\Local\Temp\6772.exe

C:\Users\Admin\AppData\Local\Temp\6772.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5496 -ip 5496

C:\Users\Admin\AppData\Local\Temp\690A.exe

C:\Users\Admin\AppData\Local\Temp\690A.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5496 -s 428

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5716 -ip 5716

C:\Users\Admin\AppData\Local\Temp\6B0E.exe

C:\Users\Admin\AppData\Local\Temp\6B0E.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5988 -ip 5988

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5716 -s 152

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5988 -s 540

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5804 -ip 5804

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5804 -s 248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a52646f8,0x7ff9a5264708,0x7ff9a5264718

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13032746923003337301,4944911408874330906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a52646f8,0x7ff9a5264708,0x7ff9a5264718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13032746923003337301,4944911408874330906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\884C.exe

C:\Users\Admin\AppData\Local\Temp\884C.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Dc044iF.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Dc044iF.exe

C:\Users\Admin\AppData\Local\Temp\ss41.exe

"C:\Users\Admin\AppData\Local\Temp\ss41.exe"

C:\Users\Admin\AppData\Local\Temp\8F71.exe

C:\Users\Admin\AppData\Local\Temp\8F71.exe

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\kos1.exe

"C:\Users\Admin\AppData\Local\Temp\kos1.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\9369.exe

C:\Users\Admin\AppData\Local\Temp\9369.exe

C:\Users\Admin\AppData\Local\Temp\set16.exe

"C:\Users\Admin\AppData\Local\Temp\set16.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Users\Admin\AppData\Local\Temp\kos.exe

"C:\Users\Admin\AppData\Local\Temp\kos.exe"

C:\Users\Admin\AppData\Local\Temp\is-PKIHR.tmp\is-8S52T.tmp

"C:\Users\Admin\AppData\Local\Temp\is-PKIHR.tmp\is-8S52T.tmp" /SL4 $90250 "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 52224

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Windows\SysWOW64\net.exe

"C:\Windows\system32\net.exe" helpmsg 8

C:\Program Files (x86)\PA Previewer\previewer.exe

"C:\Program Files (x86)\PA Previewer\previewer.exe" -i

C:\Users\Admin\AppData\Local\Temp\BA7A.exe

C:\Users\Admin\AppData\Local\Temp\BA7A.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6056 -ip 6056

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 helpmsg 8

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6056 -s 640

C:\Program Files (x86)\PA Previewer\previewer.exe

"C:\Program Files (x86)\PA Previewer\previewer.exe" -s

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\BA7A.exe

C:\Users\Admin\AppData\Local\Temp\BA7A.exe

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Roaming\wggwaed

C:\Users\Admin\AppData\Roaming\wggwaed

C:\Users\Admin\AppData\Roaming\jigwaed

C:\Users\Admin\AppData\Roaming\jigwaed

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,13032746923003337301,4944911408874330906,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5260 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 www.facebook.com udp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 35.201.240.157.in-addr.arpa udp
US 8.8.8.8:53 15.201.240.157.in-addr.arpa udp
US 8.8.8.8:53 facebook.com udp
US 8.8.8.8:53 fbcdn.net udp
NL 157.240.201.35:443 fbcdn.net tcp
US 8.8.8.8:53 fbsbx.com udp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 131.179.250.142.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
NL 142.251.36.14:443 play.google.com udp
US 8.8.8.8:53 14.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 196.168.217.172.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 29.68.91.77.in-addr.arpa udp
FI 77.91.68.52:80 77.91.68.52 tcp
US 8.8.8.8:53 52.68.91.77.in-addr.arpa udp
RU 5.42.65.80:80 5.42.65.80 tcp
RU 5.42.92.211:80 5.42.92.211 tcp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
US 8.8.8.8:53 211.92.42.5.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 1.124.91.77.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
FI 77.91.68.78:80 77.91.68.78 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 78.68.91.77.in-addr.arpa udp
US 95.214.25.204:80 95.214.25.204 tcp
US 8.8.8.8:53 z.nnnaajjjgc.com udp
NL 89.208.107.31:80 89.208.107.31 tcp
US 8.8.8.8:53 204.25.214.95.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
MU 156.236.72.121:443 z.nnnaajjjgc.com tcp
US 8.8.8.8:53 31.107.208.89.in-addr.arpa udp
US 8.8.8.8:53 121.72.236.156.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 iplogger.com udp
DE 148.251.234.93:443 iplogger.com tcp
US 8.8.8.8:53 147.174.42.23.in-addr.arpa udp
MD 176.123.9.142:37637 tcp
US 8.8.8.8:53 93.234.251.148.in-addr.arpa udp
US 8.8.8.8:53 68.121.18.2.in-addr.arpa udp
MD 176.123.4.46:33783 tcp
US 8.8.8.8:53 142.9.123.176.in-addr.arpa udp
US 8.8.8.8:53 46.4.123.176.in-addr.arpa udp
US 8.8.8.8:53 app.nnnaajjjgc.com udp
HK 154.221.26.108:80 app.nnnaajjjgc.com tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 108.26.221.154.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
NL 142.251.36.14:443 play.google.com udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 host-host-file8.com udp
NL 194.169.175.127:80 host-host-file8.com tcp
US 8.8.8.8:53 127.175.169.194.in-addr.arpa udp
FI 77.91.124.1:80 77.91.124.1 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 f7fff583-cb6a-404b-8769-cc2013e3b7a1.uuid.ramboclub.net udp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 26.73.42.20.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yG7UT80.exe

MD5 7d783f161b8405fc4e27963152e3fc0e
SHA1 7c5cce0de9c80f0c57e1aea463702d60d71ef415
SHA256 5ab08a130ab7b86d1df9f37d707a3fb084278b9e65eb41cff9b5dfbd25d7e936
SHA512 92f0f52d0db479dce4542d9894ae823e634ec8d80402df489cfce15ee0e2eb402fcfc52a0a60a35d90f09bcf2baf18a11941a29287005aa0445901afe586e387

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yG7UT80.exe

MD5 7d783f161b8405fc4e27963152e3fc0e
SHA1 7c5cce0de9c80f0c57e1aea463702d60d71ef415
SHA256 5ab08a130ab7b86d1df9f37d707a3fb084278b9e65eb41cff9b5dfbd25d7e936
SHA512 92f0f52d0db479dce4542d9894ae823e634ec8d80402df489cfce15ee0e2eb402fcfc52a0a60a35d90f09bcf2baf18a11941a29287005aa0445901afe586e387

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HC1IQ80.exe

MD5 f1ef1abb11bf53c4e81e79d5187e4ac0
SHA1 760b41d7c9a668fdb72b7b32f4243ae24af83d61
SHA256 15076983e8a9df991af81dbe27d4903801bc9601e0ae572e09d56dd83c587796
SHA512 9b3347fa438f7b8adc4fa27d7cd76593139276e539072fa4905ed221177168f32c93f59e000312b3e5dfb9cb6e859850ec22c3e6cc79229afca4559c77853d18

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\HC1IQ80.exe

MD5 f1ef1abb11bf53c4e81e79d5187e4ac0
SHA1 760b41d7c9a668fdb72b7b32f4243ae24af83d61
SHA256 15076983e8a9df991af81dbe27d4903801bc9601e0ae572e09d56dd83c587796
SHA512 9b3347fa438f7b8adc4fa27d7cd76593139276e539072fa4905ed221177168f32c93f59e000312b3e5dfb9cb6e859850ec22c3e6cc79229afca4559c77853d18

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Qk8hn82.exe

MD5 3dc80e1356ae88e896ffaa787d776323
SHA1 d1c4652ed0b4e6401e2801dc59b5266467c943f6
SHA256 147143051a31c6f8f087422b391766cde5b4a3c7805e6185f4cec590e46f7526
SHA512 5a95f5e6ba188bb0991ae1b8c128abd88d8cd02ea21baba51b51b27cb7947c229c15a9c32665d6aa3f3db303a66ccf2c65883b400dbf151e308dc984e0694602

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Qk8hn82.exe

MD5 3dc80e1356ae88e896ffaa787d776323
SHA1 d1c4652ed0b4e6401e2801dc59b5266467c943f6
SHA256 147143051a31c6f8f087422b391766cde5b4a3c7805e6185f4cec590e46f7526
SHA512 5a95f5e6ba188bb0991ae1b8c128abd88d8cd02ea21baba51b51b27cb7947c229c15a9c32665d6aa3f3db303a66ccf2c65883b400dbf151e308dc984e0694602

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1oS94UA3.exe

MD5 ce6b758e6bdae9d20bb505cc40bf8add
SHA1 1a0074aaff837670722498ad183628aa58eeede5
SHA256 1d3fb624aebaaf79cab555e28e1b1941de973907222ed76e6c484433d539b53a
SHA512 655c0cf56c4a0327ea2a42acbabd7227d43fe125eade8e2ebbe6640fd1bb4324fcd19297668d5abe7ba39559a17c54854b0060e0bc0992b122e29818ea9301cc

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1oS94UA3.exe

MD5 ce6b758e6bdae9d20bb505cc40bf8add
SHA1 1a0074aaff837670722498ad183628aa58eeede5
SHA256 1d3fb624aebaaf79cab555e28e1b1941de973907222ed76e6c484433d539b53a
SHA512 655c0cf56c4a0327ea2a42acbabd7227d43fe125eade8e2ebbe6640fd1bb4324fcd19297668d5abe7ba39559a17c54854b0060e0bc0992b122e29818ea9301cc

memory/1816-28-0x00000000005A0000-0x00000000005AA000-memory.dmp

memory/1816-29-0x00007FF9A5470000-0x00007FF9A5F31000-memory.dmp

memory/1816-31-0x00007FF9A5470000-0x00007FF9A5F31000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2op3709.exe

MD5 f6a19f6efe90d000de0ce179dd3d58fc
SHA1 dca53e82369d1ba99a451cdf7171ce171a4dc6b6
SHA256 0ec99a55d52702f52727c753b7023d0f8b74c11856d4369eca76a047414cdc73
SHA512 4aa5446cee67724b1b9071694f84b2ff1c61eb098c6b9a52af7c67e0a163231749963e1238906ac1669dd8060e792dafb17ba2df78c0ce294dc65896bcfa9bc2

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2op3709.exe

MD5 f6a19f6efe90d000de0ce179dd3d58fc
SHA1 dca53e82369d1ba99a451cdf7171ce171a4dc6b6
SHA256 0ec99a55d52702f52727c753b7023d0f8b74c11856d4369eca76a047414cdc73
SHA512 4aa5446cee67724b1b9071694f84b2ff1c61eb098c6b9a52af7c67e0a163231749963e1238906ac1669dd8060e792dafb17ba2df78c0ce294dc65896bcfa9bc2

memory/3968-35-0x0000000000400000-0x0000000000428000-memory.dmp

memory/3968-36-0x0000000000400000-0x0000000000428000-memory.dmp

memory/3968-37-0x0000000000400000-0x0000000000428000-memory.dmp

memory/3968-39-0x0000000000400000-0x0000000000428000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3RY26qW.exe

MD5 3df7b767fbfb779b05c58b2c36b5bb03
SHA1 ecb2b6da02d65242086cb603b04799d0ed0ecfe0
SHA256 853b7a16ff0473f8360fbeaa821ca163894f7b7d13324ffe41eb82ba5d47149c
SHA512 4319eb58f9d35f51fd434ead59af0dd029893db932cceae21c0c81000cf252edb2183d8290678f9938929fa1a0de5b2730b859fedc54ebbc0718d4cc620bdc6e

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3RY26qW.exe

MD5 3df7b767fbfb779b05c58b2c36b5bb03
SHA1 ecb2b6da02d65242086cb603b04799d0ed0ecfe0
SHA256 853b7a16ff0473f8360fbeaa821ca163894f7b7d13324ffe41eb82ba5d47149c
SHA512 4319eb58f9d35f51fd434ead59af0dd029893db932cceae21c0c81000cf252edb2183d8290678f9938929fa1a0de5b2730b859fedc54ebbc0718d4cc620bdc6e

memory/3352-43-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3352-44-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4JR888ei.exe

MD5 95b61d0f35e50cef50a76611f88e118e
SHA1 324cbf43bbde95f86a32991f92cd3029fb5ff05c
SHA256 1ba91a9857b9557385bd600b5b4a058a316f96671f31f8be8ec11b7633628377
SHA512 a03ce4bf4f0dfe13c008a5b46d04e121570a2e4a8f27a4a56e56ac1ea82a206d9464a4e2407ee15cc691841fef1ac951d342372cbf17ceac68e090e04631b0d9

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4JR888ei.exe

MD5 95b61d0f35e50cef50a76611f88e118e
SHA1 324cbf43bbde95f86a32991f92cd3029fb5ff05c
SHA256 1ba91a9857b9557385bd600b5b4a058a316f96671f31f8be8ec11b7633628377
SHA512 a03ce4bf4f0dfe13c008a5b46d04e121570a2e4a8f27a4a56e56ac1ea82a206d9464a4e2407ee15cc691841fef1ac951d342372cbf17ceac68e090e04631b0d9

memory/3280-48-0x0000000000400000-0x000000000043E000-memory.dmp

memory/3280-49-0x0000000073F10000-0x00000000746C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5kd4rB0.exe

MD5 89d389d44893b0ecec61e6b9fc277271
SHA1 431c6f8d79100255991f038eb56cc0e64b8170d9
SHA256 561140ba53935e765497f163fef58868877c94bd339ed83bc11ce90ac34d4925
SHA512 f4288da794bf4bf11f773d4458026df6f4c2fc56dff338865de81a7bed47af33f6a21fea0d08f6573621dbaaa09741caa4557e9c588ae9243e6ef38212d55ea5

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5kd4rB0.exe

MD5 89d389d44893b0ecec61e6b9fc277271
SHA1 431c6f8d79100255991f038eb56cc0e64b8170d9
SHA256 561140ba53935e765497f163fef58868877c94bd339ed83bc11ce90ac34d4925
SHA512 f4288da794bf4bf11f773d4458026df6f4c2fc56dff338865de81a7bed47af33f6a21fea0d08f6573621dbaaa09741caa4557e9c588ae9243e6ef38212d55ea5

C:\Users\Admin\AppData\Local\Temp\5B8.tmp\5B9.tmp\5C9.bat

MD5 5a115a88ca30a9f57fdbb545490c2043
SHA1 67e90f37fc4c1ada2745052c612818588a5595f4
SHA256 52c4113e7f308faa933ae6e8ff5d1b955ba62d1edac0eb7c972caa26e1ae4e2d
SHA512 17c399dad7b7343d5b16156e4d83de78ff5755d12add358bd2987ed4216dd13d24cfec9ecdb92d9d6723bb1d20d8874c0bad969dbec69eed95beb7a2817eb4fe

memory/3280-55-0x00000000080F0000-0x0000000008694000-memory.dmp

memory/3280-56-0x0000000007C20000-0x0000000007CB2000-memory.dmp

memory/3280-57-0x0000000007DD0000-0x0000000007DE0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 451fddf78747a5a4ebf64cabb4ac94e7
SHA1 6925bd970418494447d800e213bfd85368ac8dc9
SHA256 64d12f59d409aa1b03f0b2924e0b2419b65c231de9e04fce15cc3a76e1b9894d
SHA512 edb85a2a94c207815360820731d55f6b4710161551c74008df0c2ae10596e1886c8a9e11d43ddf121878ae35ac9f06fc66b4c325b01ed4e7bf4d3841b27e0864

memory/3280-61-0x0000000007DE0000-0x0000000007DEA000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

\??\pipe\LOCAL\crashpad_4128_GANNQKEOXAWIXTVU

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/3352-87-0x0000000000400000-0x0000000000409000-memory.dmp

\??\pipe\LOCAL\crashpad_1384_UOFOCFNCDFWPUJYV

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/3144-82-0x00000000032E0000-0x00000000032F6000-memory.dmp

memory/3280-88-0x0000000008CC0000-0x00000000092D8000-memory.dmp

memory/3280-92-0x0000000007FE0000-0x00000000080EA000-memory.dmp

memory/3280-96-0x0000000007EB0000-0x0000000007EC2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 fb106cb45f879ee91db3591db1a0c92e
SHA1 2e6457ffcd9f17224414db4f5779814aa2e44cdc
SHA256 888fc90df7e1ad871105c277df14a6f47c1cdff75287a72a1f66e6cec51565cb
SHA512 0699ea9f6e70ea5ff53c1a570b72beccc57413fd709ed83c6bf12190a9aa1c245340e9397a29bea1aed24266604f3ab0420b026677e534dd51a4dd07e9c8524a

memory/3280-112-0x0000000007F10000-0x0000000007F4C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 6ab96651245010da817c22da1d1cf311
SHA1 b7aa6094db497eb7bf1861578a8b9264a05b3571
SHA256 fc6dd6c5e24c2cf682911770f1b3d3ceee9315cee9a52304915eb898c4d426ec
SHA512 5dc79c7919e64003df2905ee34fb6355b402b408d8f83d99f86259acd5bfaa06cabd481d36a9cd08a7d7293cb766c0d4c892bc4538f68b016ac1d72fa73b7a1c

memory/3280-127-0x0000000007F50000-0x0000000007F9C000-memory.dmp

memory/3280-210-0x0000000073F10000-0x00000000746C0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 fb106cb45f879ee91db3591db1a0c92e
SHA1 2e6457ffcd9f17224414db4f5779814aa2e44cdc
SHA256 888fc90df7e1ad871105c277df14a6f47c1cdff75287a72a1f66e6cec51565cb
SHA512 0699ea9f6e70ea5ff53c1a570b72beccc57413fd709ed83c6bf12190a9aa1c245340e9397a29bea1aed24266604f3ab0420b026677e534dd51a4dd07e9c8524a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 3b9b0554e6eb34e716cfd9cb6dfd9d95
SHA1 974cda02a36319bd8e7fb2b068a1a0a4c94c5572
SHA256 df2f0b7d07c684d20dce4201cbda9d76a9a4e60aa7df4bf4f987571a7c2a1c38
SHA512 0096ad01958998223b3bdb5a5240391acf43cd7e35b0515b294b4c110e690857df0feacd929eb975c3f8428892a5fb516fdb77fdd0b7fb83ebacaee2151a85c5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 fe21ea17cc8845a88735a27ee632b1e6
SHA1 e9396189a2474d94e85215f230a816bb43db7981
SHA256 1ba7ebd5c9800e398a4ad38ac6eb37c9434eda5926fee4ca33109d86477fad2b
SHA512 f65b26d79e2c785888939701dc0bbfec8320fcd31e4f5436e1917934fc3f29e934670b8cc05b3a83f60a581327451300fdee1ded2e7494342035d352668183cf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 d985875547ce8936a14b00d1e571365f
SHA1 040d8e5bd318357941fca03b49f66a1470824cb3
SHA256 8455a012296a7f4b10ade39e1300cda1b04fd0fc1832ffc043e66f48c6aecfbf
SHA512 ca31d3d6c44d52a1f817731da2e7ac98402cd19eeb4b48906950a2f22f961c8b1f665c3eaa62bf73cd44eb94ea377f7e2ceff9ef682a543771344dab9dbf5a38

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6608dacd32a6739fc9a185571754dc93
SHA1 d96bf0f29a29c2cccd41a026d04143fea8bf687b
SHA256 aba8e6d3d9f36c8d570a32dbd314ce371e9b354d8da00a2928bce985caf6c595
SHA512 b325fa8044a1415f9a75241fb510d13a8fc9ad1f86946fc4166181f4ae4b052b68c50b7b3a15e6606d5940a0744897d7b36d03f015ed5afd9143cbaabac1a60c

C:\Users\Admin\AppData\Local\Temp\6174.exe

MD5 909384c7ef81db1527d9cb6cbd8c8d7d
SHA1 6ab955c83ea48bf53b8f11078112a5b28688c30b
SHA256 ac8001de55e1a4a06142ad8d837f53409472f68bb146557e0fdcfccc7a32423d
SHA512 66be360c9c0895c7d4609f673b2c6822fd45ae1b6c6904e9dd0f5cb69ed4885126392b37d4e035f1f3a16fb2ac61e1d3e0fdc8a4b8cffdd8379fccc7dfe174ed

C:\Users\Admin\AppData\Local\Temp\6174.exe

MD5 909384c7ef81db1527d9cb6cbd8c8d7d
SHA1 6ab955c83ea48bf53b8f11078112a5b28688c30b
SHA256 ac8001de55e1a4a06142ad8d837f53409472f68bb146557e0fdcfccc7a32423d
SHA512 66be360c9c0895c7d4609f673b2c6822fd45ae1b6c6904e9dd0f5cb69ed4885126392b37d4e035f1f3a16fb2ac61e1d3e0fdc8a4b8cffdd8379fccc7dfe174ed

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6by93GN.exe

MD5 9c46d9382e13e4af151690bc11a1549b
SHA1 9b1f5cff12fe100302c8cb6d5cedc73b98d5ec7d
SHA256 c3c48bea2d57adbd90cfbbdc23927c95834471819fa1bc371779b75b08048e8c
SHA512 07d235969d353629b5e04fcabe88988f4d3cb1938b1c2a14c04013e3d4cdabd8f4a77009eb2d7d100797349b39ea5f23237df72262f4b790bc87615ff132a4cc

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vn8zv7Uh.exe

MD5 a9b08e94fc90554bd84d182c57e2196c
SHA1 e55cdab307dd8d0235b503b3786c7b263b781027
SHA256 6c95645f753aa3e8ae9226e136159062bf46c46e4876e879e87f4d8287d116f4
SHA512 d40e38f189fc9596419009b12b5c911d033e4625a070114bda5214dc0f3c39511737602f21fa123fdbc9a5b3be93a197ac52b2bb8fbe53bd399a7e17f271b5dd

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vn8zv7Uh.exe

MD5 a9b08e94fc90554bd84d182c57e2196c
SHA1 e55cdab307dd8d0235b503b3786c7b263b781027
SHA256 6c95645f753aa3e8ae9226e136159062bf46c46e4876e879e87f4d8287d116f4
SHA512 d40e38f189fc9596419009b12b5c911d033e4625a070114bda5214dc0f3c39511737602f21fa123fdbc9a5b3be93a197ac52b2bb8fbe53bd399a7e17f271b5dd

C:\Users\Admin\AppData\Local\Temp\629E.exe

MD5 5940df80cc0ffbb340e1d0165c0143ae
SHA1 895fce0d888aee0fdd28b95d3784ab3bb58ac4c9
SHA256 2c1fd1969c29699f2787dffe166c2225b028e7acd4efd2d83b9528825813d669
SHA512 3ab655fd14bb222558abb2c128bb21fa2b1adb0510cc1b3ec8400102d1a85af33c96c208db5c514346f0562806aaa35e37afc8840990284f2492d6a3f450b7d7

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\aY2kr8VV.exe

MD5 b4f1d87ae6c7a45f3bceadc6737af426
SHA1 f925c6efe9388a3f8699c415e28626b21407c9a0
SHA256 460094d3170a050b32d594c27fdcff23ec94b09852d00c3f61363f414650986c
SHA512 136a0c1989d674acb8e44157de49fb6bfa773723027b27c0a520cee88bdcc8c8d181850525aa9086002453373a03fdfadd7d5b60a81ffe61672078d29ab7c2bd

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\aY2kr8VV.exe

MD5 b4f1d87ae6c7a45f3bceadc6737af426
SHA1 f925c6efe9388a3f8699c415e28626b21407c9a0
SHA256 460094d3170a050b32d594c27fdcff23ec94b09852d00c3f61363f414650986c
SHA512 136a0c1989d674acb8e44157de49fb6bfa773723027b27c0a520cee88bdcc8c8d181850525aa9086002453373a03fdfadd7d5b60a81ffe61672078d29ab7c2bd

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Rz9SE5IY.exe

MD5 9bd55fe1a9594ee2269332cdfd3c35de
SHA1 9bbb7d6d0bd0221e13942820f9fc14cfd5c1a5c6
SHA256 1ddd2c24bedbb000cbbf2033b8ad90f0c003b6043c3ce010f138d6bd89cc76cd
SHA512 e9ffbeab7a76c8e3d499ea0625ce774fb8e8f0dc3844b62352846354a619d8a1ffa659a19b9527e65805e2911a78f9642c29131c7b13590387850185962a4865

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Rz9SE5IY.exe

MD5 9bd55fe1a9594ee2269332cdfd3c35de
SHA1 9bbb7d6d0bd0221e13942820f9fc14cfd5c1a5c6
SHA256 1ddd2c24bedbb000cbbf2033b8ad90f0c003b6043c3ce010f138d6bd89cc76cd
SHA512 e9ffbeab7a76c8e3d499ea0625ce774fb8e8f0dc3844b62352846354a619d8a1ffa659a19b9527e65805e2911a78f9642c29131c7b13590387850185962a4865

C:\Users\Admin\AppData\Local\Temp\629E.exe

MD5 5940df80cc0ffbb340e1d0165c0143ae
SHA1 895fce0d888aee0fdd28b95d3784ab3bb58ac4c9
SHA256 2c1fd1969c29699f2787dffe166c2225b028e7acd4efd2d83b9528825813d669
SHA512 3ab655fd14bb222558abb2c128bb21fa2b1adb0510cc1b3ec8400102d1a85af33c96c208db5c514346f0562806aaa35e37afc8840990284f2492d6a3f450b7d7

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mB2nO8vz.exe

MD5 79d64b0a10fdc66eddeea9b88b2ecc63
SHA1 2981bfe928f4cccb01d67ef15d87581c57235236
SHA256 0e864b45df18a1e00f77abe9005c087d3a393b6d99c80aa556249c2a12f1387c
SHA512 f1552d58154bd618f287f79cc49cca5ac59dfafde5e34933203b93348d766c40990ee4c8390b54205d961ab0b3c4b8a8133ac31f329468fe4e52a08d2ef0f799

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mB2nO8vz.exe

MD5 79d64b0a10fdc66eddeea9b88b2ecc63
SHA1 2981bfe928f4cccb01d67ef15d87581c57235236
SHA256 0e864b45df18a1e00f77abe9005c087d3a393b6d99c80aa556249c2a12f1387c
SHA512 f1552d58154bd618f287f79cc49cca5ac59dfafde5e34933203b93348d766c40990ee4c8390b54205d961ab0b3c4b8a8133ac31f329468fe4e52a08d2ef0f799

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1mI85mj9.exe

MD5 5940df80cc0ffbb340e1d0165c0143ae
SHA1 895fce0d888aee0fdd28b95d3784ab3bb58ac4c9
SHA256 2c1fd1969c29699f2787dffe166c2225b028e7acd4efd2d83b9528825813d669
SHA512 3ab655fd14bb222558abb2c128bb21fa2b1adb0510cc1b3ec8400102d1a85af33c96c208db5c514346f0562806aaa35e37afc8840990284f2492d6a3f450b7d7

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1mI85mj9.exe

MD5 5940df80cc0ffbb340e1d0165c0143ae
SHA1 895fce0d888aee0fdd28b95d3784ab3bb58ac4c9
SHA256 2c1fd1969c29699f2787dffe166c2225b028e7acd4efd2d83b9528825813d669
SHA512 3ab655fd14bb222558abb2c128bb21fa2b1adb0510cc1b3ec8400102d1a85af33c96c208db5c514346f0562806aaa35e37afc8840990284f2492d6a3f450b7d7

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1mI85mj9.exe

MD5 5940df80cc0ffbb340e1d0165c0143ae
SHA1 895fce0d888aee0fdd28b95d3784ab3bb58ac4c9
SHA256 2c1fd1969c29699f2787dffe166c2225b028e7acd4efd2d83b9528825813d669
SHA512 3ab655fd14bb222558abb2c128bb21fa2b1adb0510cc1b3ec8400102d1a85af33c96c208db5c514346f0562806aaa35e37afc8840990284f2492d6a3f450b7d7

C:\Users\Admin\AppData\Local\Temp\6772.exe

MD5 dd08f0cd460c196d6083e8d2fb76de29
SHA1 7e7b2f2dc1f035cdc9ea637cd1f8795ab1d48a6e
SHA256 143c070f9595a87a72e28d8a64b14cb6ec73a62eff911a1c5d3ebbfa99803100
SHA512 ca52df2798bc9f16faea6212675f22335dfd13a5fc79d929faa384d13a63606728cfbd5f4aad6cb749b9fce962607e931e76b3e40fb7d082ab90eb228af2c3f6

C:\Users\Admin\AppData\Local\Temp\659D.bat

MD5 403991c4d18ac84521ba17f264fa79f2
SHA1 850cc068de0963854b0fe8f485d951072474fd45
SHA256 ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512 a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

memory/5840-319-0x0000000000400000-0x0000000000428000-memory.dmp

memory/5840-320-0x0000000000400000-0x0000000000428000-memory.dmp

memory/5840-321-0x0000000000400000-0x0000000000428000-memory.dmp

memory/5908-326-0x0000000000EE0000-0x0000000000EEA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\690A.exe

MD5 cb71132b03f15b037d3e8a5e4d9e0285
SHA1 95963fba539b45eb6f6acbd062c48976733519a1
SHA256 7f7d4ba0b7b46eff509b3aa2105d10d25f79e13ef3c1b1ec9c889cf2f0f1d373
SHA512 d140809bcac5b6b47f710c18ca1df1a3dd9b9adb95dbc368049cdc91874070c9a9f67137941ab17147143ebfabb81de7f1e697e42b0a28d51776b2f9c48cba4a

C:\Users\Admin\AppData\Local\Temp\690A.exe

MD5 cb71132b03f15b037d3e8a5e4d9e0285
SHA1 95963fba539b45eb6f6acbd062c48976733519a1
SHA256 7f7d4ba0b7b46eff509b3aa2105d10d25f79e13ef3c1b1ec9c889cf2f0f1d373
SHA512 d140809bcac5b6b47f710c18ca1df1a3dd9b9adb95dbc368049cdc91874070c9a9f67137941ab17147143ebfabb81de7f1e697e42b0a28d51776b2f9c48cba4a

memory/5908-327-0x00007FF9A1FB0000-0x00007FF9A2A71000-memory.dmp

memory/5988-329-0x0000000000400000-0x0000000000428000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6772.exe

MD5 dd08f0cd460c196d6083e8d2fb76de29
SHA1 7e7b2f2dc1f035cdc9ea637cd1f8795ab1d48a6e
SHA256 143c070f9595a87a72e28d8a64b14cb6ec73a62eff911a1c5d3ebbfa99803100
SHA512 ca52df2798bc9f16faea6212675f22335dfd13a5fc79d929faa384d13a63606728cfbd5f4aad6cb749b9fce962607e931e76b3e40fb7d082ab90eb228af2c3f6

memory/5988-332-0x0000000000400000-0x0000000000428000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 4bd59a6b3207f99fc3435baf3c22bc4e
SHA1 ae90587beed289f177f4143a8380ba27109d0a6f
SHA256 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512 ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

C:\Users\Admin\AppData\Local\Temp\6B0E.exe

MD5 4bd59a6b3207f99fc3435baf3c22bc4e
SHA1 ae90587beed289f177f4143a8380ba27109d0a6f
SHA256 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512 ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

C:\Users\Admin\AppData\Local\Temp\6B0E.exe

MD5 4bd59a6b3207f99fc3435baf3c22bc4e
SHA1 ae90587beed289f177f4143a8380ba27109d0a6f
SHA256 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512 ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

memory/5988-339-0x0000000000400000-0x0000000000428000-memory.dmp

memory/5840-341-0x0000000000400000-0x0000000000428000-memory.dmp

memory/3628-342-0x0000000073F10000-0x00000000746C0000-memory.dmp

memory/3628-343-0x00000000074C0000-0x00000000074D0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 4bd59a6b3207f99fc3435baf3c22bc4e
SHA1 ae90587beed289f177f4143a8380ba27109d0a6f
SHA256 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512 ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 4bd59a6b3207f99fc3435baf3c22bc4e
SHA1 ae90587beed289f177f4143a8380ba27109d0a6f
SHA256 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512 ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 023e2b0acc6ee655599a325f2e7d8651
SHA1 388988eca8fe16a8a5936ac7d5ef73a00a0fb88a
SHA256 59a0f3e07cb7eb402addbe548fc0ce7a765373e6231f161852f7e937aa4e9e1d
SHA512 75860cf5f93d80e8fd9916f6246c8de19834b335ff41a0a39fcec11dbce703664d0c61f3d6dd79052a653db5d45ce6dce7cb58a190c04b2bb4dbed017c3d1eb2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58844e.TMP

MD5 2df6ec69e5ff80816a09a546c6272acc
SHA1 09378ec0326a2887f07a829ac91da02b728d98c0
SHA256 789f34805dbbdd0eb0d3e85ca2978cb10bbf76ca106e79e6157cb807572e8330
SHA512 fc17b6363f999bebdb270cac3e2f3d2a930342c9df669998e8d54f85f1ebebc762a6ad05bc05b0263e9f183457d1478395ad550346e0a6a28b5020d67e09c7f4

C:\Users\Admin\AppData\Local\Temp\884C.exe

MD5 3c81534d635fbe4bfab2861d98422f70
SHA1 9cc995fa42313cd82eacaad9e3fe818cd3805f58
SHA256 88921dad96a51ff9f15a1d93b51910b2ac75589020fbb75956b6f090381d4d4f
SHA512 132fa532fad96b512b795cf4786245cc24bbdbbab433bf34925cf20401a819cab7bed92771e7f0b4c970535804d42f7f1d2887765ed8f999c99a0e15d93a0136

C:\Users\Admin\AppData\Local\Temp\884C.exe

MD5 3c81534d635fbe4bfab2861d98422f70
SHA1 9cc995fa42313cd82eacaad9e3fe818cd3805f58
SHA256 88921dad96a51ff9f15a1d93b51910b2ac75589020fbb75956b6f090381d4d4f
SHA512 132fa532fad96b512b795cf4786245cc24bbdbbab433bf34925cf20401a819cab7bed92771e7f0b4c970535804d42f7f1d2887765ed8f999c99a0e15d93a0136

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Dc044iF.exe

MD5 d864744ea23807cf528a1a508c2bdc3e
SHA1 a6c19194b0bdac075563109000c3e182f86f6155
SHA256 426a88a033bd62b047fd132f323987c440c10881e4c2843adbf59c1ce43f87ff
SHA512 7e06a9f47ca41272981cf6d17d9025497bea27769ca0535c684463d450595c9c728a8832ea7ebdf262efaf0fe6d4ce1622e9cc205afe72b52e7b6b04f38533a0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 225bfa54a627ef8c9cb2b036b2a57205
SHA1 ed959834111a163de21b90d2c2f92c99077c532e
SHA256 c451c4c467610ef733734db51199072e4eceddb59494aa63c166e1504685484c
SHA512 bf44990d7d62240c47f736a095bb9bc3c165a0a45d7428ff35a80ba24a89a6349e0c549a700279291c263968a17b99bf55eb102669053e7684eee8ee540758e3

memory/5564-493-0x0000000000D80000-0x0000000000DBE000-memory.dmp

memory/5564-494-0x0000000073F10000-0x00000000746C0000-memory.dmp

memory/5908-495-0x00007FF9A1FB0000-0x00007FF9A2A71000-memory.dmp

memory/3628-496-0x0000000073F10000-0x00000000746C0000-memory.dmp

memory/5564-497-0x0000000007C80000-0x0000000007C90000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ss41.exe

MD5 83330cf6e88ad32365183f31b1fd3bda
SHA1 1c5b47be2b8713746de64b39390636a81626d264
SHA256 7ce942cdc58ba5fa628d97f991c8a794294c2acfb724efbf0ac887c47942a31e
SHA512 e28a9c47f690b0b0f0dd3b946d9cd59c761803f3826a382208a5b92be1293067b37a39f1141ddda13247b96138a108ce2f85b83de0143d48d4acc94f69a11908

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 528b5dc5ede359f683b73a684b9c19f6
SHA1 8bff4feae6dbdaafac1f9f373f15850d08e0a206
SHA256 3a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9
SHA512 87cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 7ea584dc49967de03bebdacec829b18d
SHA1 3d47f0e88c7473bedeed2f14d7a8db1318b93852
SHA256 79232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53
SHA512 ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0

memory/5660-517-0x00007FF623180000-0x00007FF6231EA000-memory.dmp

memory/3628-523-0x00000000074C0000-0x00000000074D0000-memory.dmp

memory/3596-525-0x00000000004D0000-0x000000000068D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\kos1.exe

MD5 85b698363e74ba3c08fc16297ddc284e
SHA1 171cfea4a82a7365b241f16aebdb2aad29f4f7c0
SHA256 78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe
SHA512 7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

memory/6108-536-0x0000000002630000-0x0000000002730000-memory.dmp

memory/6108-538-0x00000000025F0000-0x00000000025F9000-memory.dmp

memory/3724-537-0x00000000001A0000-0x0000000000314000-memory.dmp

memory/4652-545-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3724-544-0x0000000073F10000-0x00000000746C0000-memory.dmp

memory/4652-543-0x0000000000400000-0x0000000000409000-memory.dmp

memory/5908-547-0x00007FF9A1FB0000-0x00007FF9A2A71000-memory.dmp

memory/4696-548-0x0000000004850000-0x0000000004C4F000-memory.dmp

memory/4696-549-0x0000000004C50000-0x000000000553B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\set16.exe

MD5 22d5269955f256a444bd902847b04a3b
SHA1 41a83de3273270c3bd5b2bd6528bdc95766aa268
SHA256 ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd
SHA512 d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

memory/1040-558-0x0000000000400000-0x0000000000413000-memory.dmp

memory/2476-561-0x0000000000930000-0x000000000098A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\kos.exe

MD5 076ab7d1cc5150a5e9f8745cc5f5fb6c
SHA1 7b40783a27a38106e2cc91414f2bc4d8b484c578
SHA256 d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90
SHA512 75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

memory/5792-573-0x0000000000280000-0x0000000000288000-memory.dmp

memory/4696-585-0x0000000000400000-0x000000000298D000-memory.dmp

memory/3724-587-0x0000000073F10000-0x00000000746C0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 b15173e4d8505fc0c7ed8488928a3f2f
SHA1 2791eb7712b374d77aa7632912d96924e709bf94
SHA256 255798ab0385bd815399e3c02b0f7004094d3422ef19a90208ee99b519456b28
SHA512 ed24a279f3a5a9522f9f698ba6431e7337d83923305fa80003fc01e85c1c064cacf2a896a637d1d0d2499a74252bc68af24e1d7278d9f7ed59088e927c8fe438

memory/5728-586-0x0000000000400000-0x0000000000430000-memory.dmp

memory/3596-601-0x00000000004D0000-0x000000000068D000-memory.dmp

memory/2476-600-0x0000000000400000-0x0000000000467000-memory.dmp

memory/5792-604-0x00007FF9A2240000-0x00007FF9A2D01000-memory.dmp

memory/4652-618-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3144-605-0x0000000008DC0000-0x0000000008DD6000-memory.dmp

memory/5728-622-0x00000000017B0000-0x00000000017B6000-memory.dmp

memory/3596-627-0x00000000004D0000-0x000000000068D000-memory.dmp

memory/3040-649-0x0000000000B20000-0x0000000000E64000-memory.dmp

memory/4696-621-0x0000000000400000-0x000000000298D000-memory.dmp

memory/2476-651-0x0000000073F10000-0x00000000746C0000-memory.dmp

memory/3040-652-0x0000000005670000-0x000000000574C000-memory.dmp

memory/2476-654-0x0000000007670000-0x0000000007680000-memory.dmp

memory/3040-655-0x00000000057C0000-0x0000000005898000-memory.dmp

memory/5728-656-0x0000000073F10000-0x00000000746C0000-memory.dmp

memory/3040-657-0x0000000005AE0000-0x0000000005BA8000-memory.dmp

memory/3040-661-0x0000000005BB0000-0x0000000005BFC000-memory.dmp

memory/5564-660-0x0000000073F10000-0x00000000746C0000-memory.dmp

memory/3040-662-0x0000000073F10000-0x00000000746C0000-memory.dmp

memory/6056-665-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/5728-667-0x0000000005610000-0x0000000005620000-memory.dmp

memory/3040-668-0x0000000005DB0000-0x0000000005E16000-memory.dmp

memory/5792-674-0x000000001AF70000-0x000000001AF80000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

MD5 ec6aae2bb7d8781226ea61adca8f0586
SHA1 d82b3bad240f263c1b887c7c0cc4c2ff0e86dfe3
SHA256 b02fffaba9e664ff7840c82b102d6851ec0bb148cec462cef40999545309e599
SHA512 aa62a8cd02a03e4f462f76ae6ff2e43849052ce77cca3a2ccf593f6669425830d0910afac3cf2c46dd385454a6fb3b4bd604ae13b9586087d6f22de644f9dfc7

memory/1040-664-0x0000000000400000-0x0000000000413000-memory.dmp

memory/6044-675-0x0000000000540000-0x0000000000541000-memory.dmp

memory/6044-677-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/5564-678-0x0000000007C80000-0x0000000007C90000-memory.dmp

memory/6056-680-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/1852-682-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/1852-683-0x0000000000400000-0x00000000005F1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 8888669276a7cea0dfe325ba321fadff
SHA1 c37a92cac2f87e945b4cc336ae4dcf89b860d029
SHA256 409b1161cc9015de511d1ac35edff4dcd97e140beddbf6aa7c5982754b368d56
SHA512 a5b6b4105168309d6639edab64fc6b2213b86d399c027a563813128e3083640d6d9edcd2e1db1e81f37e06401b2c1749744ce8226a2f4e84767fd07733bc83cc

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n3hy5q1s.p2j.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 5f92fcdc5c4481975a35e522614a1542
SHA1 d25cf107b624fd8a17ccde89a741e6863811e4da
SHA256 b7f9d12fe9daa90368eb0c72f793f6ee96156cc676bc9e9a2600584376d8a990
SHA512 42a1f4929c2dd59335daa665b6382144800eba309cf2b23ef6267735bf73f8e016dde612a8977d5ff5c9ff720641c2cc3ce013d3baa187ed573955fa930c7f27

memory/4696-729-0x0000000000400000-0x000000000298D000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 e9b1258bd1b21258606a700dac11401a
SHA1 c9f874f4b2cd22b0579acf6bb4133ab5104f5277
SHA256 b3cc6b2583a39cd888085404654eab4cb9496154e03d37aa37d9a194d14e9663
SHA512 2574b648fec943051c7195b6d41bd16b013a60a83313ad3d72331d1e713e0585c4d4484f261e180fafa38c0ee0b74cafef1ef57e5d49700ea67c08cba23fd043

memory/4696-791-0x0000000000400000-0x000000000298D000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 854599db7601268d2144ef1515db0784
SHA1 e7803ce8b95af0067e0e5060bd09397b6b5b7a54
SHA256 64e5423ef8aedf49edcbffa085735acb442063566952aa1203c426ee655e4e07
SHA512 8c9edb7300f98be97e09c74dc7a8d54f2543f6a16e957bd141d4c233fa4c9c6ed898da1e5f3dff3f6cdeefdd583138d85a320a14d39b2def2b18638d047e16a2

memory/1852-820-0x0000000000400000-0x00000000005F1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\58f1cc62-6594-4059-bc03-bc1b19859aa8.tmp

MD5 2ec0786e5d8999d483e78f7135b33516
SHA1 a2b5cc937ff1a5aab9cf6ae7b4ada23ae4fa9ab5
SHA256 64b50cb29ee329810b4b001c1cd5a0c0ba6fe0e79864f10cb955c07340ac7b30
SHA512 97ff3131b5d12c70b223f24e7825f18a5e6ee81b36a14a764da2be0a6b885f2d20312f9d38f8c3b6ccdf7aac463017925cdc57d5c425170943805979672e05ab

memory/2260-864-0x0000000000400000-0x000000000298D000-memory.dmp

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

memory/1852-906-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/2260-932-0x0000000000400000-0x000000000298D000-memory.dmp

memory/5776-936-0x0000000000400000-0x00000000004AC000-memory.dmp

memory/5776-944-0x0000000005630000-0x0000000005711000-memory.dmp

memory/5776-942-0x0000000005630000-0x0000000005711000-memory.dmp

memory/5776-947-0x0000000005630000-0x0000000005711000-memory.dmp

memory/5776-949-0x0000000005630000-0x0000000005711000-memory.dmp

memory/5776-952-0x0000000005630000-0x0000000005711000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 28492d64200fd2c975e872ee26f4fed4
SHA1 0d096db95b0e287a91c0e5971e105df41925e0a5
SHA256 0ae8318aa3d195c8770051d0d0166eea897a9ac8b3b92f06db28bef46259f157
SHA512 2343d9064d56a4ed72738b69dbbe7b735c368c571095087bab08ea138b452f7c4bcd5d3886bd22f2005c7bc43020738e975af036bc528cd08ca35e33ca35e206