Malware Analysis Report

2025-08-05 22:18

Sample ID 231003-nmpgmaac3z
Target 4c8d4b5e39de12ecc40741e372f6f02de594a15942742231f879858305afbf3c
SHA256 4c8d4b5e39de12ecc40741e372f6f02de594a15942742231f879858305afbf3c
Tags
amadey dcrat glupteba healer mystic redline smokeloader @ytlogsbot gigant jordan up3 backdoor discovery dropper evasion infostealer loader persistence rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4c8d4b5e39de12ecc40741e372f6f02de594a15942742231f879858305afbf3c

Threat Level: Known bad

The file 4c8d4b5e39de12ecc40741e372f6f02de594a15942742231f879858305afbf3c was found to be: Known bad.

Malicious Activity Summary

amadey dcrat glupteba healer mystic redline smokeloader @ytlogsbot gigant jordan up3 backdoor discovery dropper evasion infostealer loader persistence rat spyware stealer trojan

Modifies Windows Defender Real-time Protection settings

RedLine payload

Detects Healer an antivirus disabler dropper

SmokeLoader

Glupteba payload

Healer

DcRat

Glupteba

Mystic

Amadey

RedLine

Downloads MZ/PE file

Modifies Windows Firewall

Loads dropped DLL

Reads user/profile data of web browsers

Windows security modification

Checks computer location settings

Uses the VBS compiler for execution

Executes dropped EXE

Adds Run key to start application

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Drops file in Program Files directory

Launches sc.exe

Unsigned PE

Program crash

Enumerates physical storage devices

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Runs net.exe

Uses Task Scheduler COM API

Enumerates system info in registry

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-03 11:31

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-03 11:31

Reported

2023-10-03 11:33

Platform

win10v2004-20230915-en

Max time kernel

80s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4c8d4b5e39de12ecc40741e372f6f02de594a15942742231f879858305afbf3c.exe"

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\4c8d4b5e39de12ecc40741e372f6f02de594a15942742231f879858305afbf3c.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1eW64tO2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1eW64tO2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\7F22.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\7F22.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\7F22.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\7F22.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1eW64tO2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1eW64tO2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1eW64tO2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1eW64tO2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\7F22.exe N/A

Mystic

stealer mystic

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\kos1.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8201.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\A1BF.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iu1fq99.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\PZ7MF02.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uD9sJ19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1eW64tO2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Me2984.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3EV54QP.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Lk126lq.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Fn9KO6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7971.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7A8B.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VR5us0ol.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Or4RX8cx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\oS1CF3Qn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Xy0vr1bG.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Ti66oF6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7E08.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7F22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8201.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Rb326Jw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\A1BF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-LS49D.tmp\is-3H6RH.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ss41.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\kos1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AD2A.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\set16.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B23C.exe N/A
N/A N/A C:\Windows\system32\backgroundTaskHost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-LS49D.tmp\is-3H6RH.tmp N/A
N/A N/A C:\Program Files (x86)\PA Previewer\previewer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C279.exe N/A
N/A N/A C:\Program Files (x86)\PA Previewer\previewer.exe N/A

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1eW64tO2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\7F22.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iu1fq99.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\7971.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VR5us0ol.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Or4RX8cx.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Xy0vr1bG.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\4c8d4b5e39de12ecc40741e372f6f02de594a15942742231f879858305afbf3c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\PZ7MF02.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uD9sJ19.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\oS1CF3Qn.exe N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\PA Previewer\is-B7GI4.tmp C:\Users\Admin\AppData\Local\Temp\is-LS49D.tmp\is-3H6RH.tmp N/A
File opened for modification C:\Program Files (x86)\PA Previewer\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-LS49D.tmp\is-3H6RH.tmp N/A
File opened for modification C:\Program Files (x86)\PA Previewer\previewer.exe C:\Users\Admin\AppData\Local\Temp\is-LS49D.tmp\is-3H6RH.tmp N/A
File created C:\Program Files (x86)\PA Previewer\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-LS49D.tmp\is-3H6RH.tmp N/A
File created C:\Program Files (x86)\PA Previewer\is-VV975.tmp C:\Users\Admin\AppData\Local\Temp\is-LS49D.tmp\is-3H6RH.tmp N/A
File created C:\Program Files (x86)\PA Previewer\is-3G6RV.tmp C:\Users\Admin\AppData\Local\Temp\is-LS49D.tmp\is-3H6RH.tmp N/A
File created C:\Program Files (x86)\PA Previewer\is-PKAD9.tmp C:\Users\Admin\AppData\Local\Temp\is-LS49D.tmp\is-3H6RH.tmp N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1eW64tO2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1eW64tO2.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1eW64tO2.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7F22.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2296 wrote to memory of 3800 N/A C:\Users\Admin\AppData\Local\Temp\4c8d4b5e39de12ecc40741e372f6f02de594a15942742231f879858305afbf3c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iu1fq99.exe
PID 2296 wrote to memory of 3800 N/A C:\Users\Admin\AppData\Local\Temp\4c8d4b5e39de12ecc40741e372f6f02de594a15942742231f879858305afbf3c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iu1fq99.exe
PID 2296 wrote to memory of 3800 N/A C:\Users\Admin\AppData\Local\Temp\4c8d4b5e39de12ecc40741e372f6f02de594a15942742231f879858305afbf3c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iu1fq99.exe
PID 3800 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iu1fq99.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\PZ7MF02.exe
PID 3800 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iu1fq99.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\PZ7MF02.exe
PID 3800 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iu1fq99.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\PZ7MF02.exe
PID 4056 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\PZ7MF02.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uD9sJ19.exe
PID 4056 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\PZ7MF02.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uD9sJ19.exe
PID 4056 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\PZ7MF02.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uD9sJ19.exe
PID 4588 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uD9sJ19.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1eW64tO2.exe
PID 4588 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uD9sJ19.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1eW64tO2.exe
PID 4588 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uD9sJ19.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Me2984.exe
PID 4588 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uD9sJ19.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Me2984.exe
PID 4588 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uD9sJ19.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Me2984.exe
PID 4484 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Me2984.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4484 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Me2984.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4484 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Me2984.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4484 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Me2984.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4484 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Me2984.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4484 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Me2984.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4484 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Me2984.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4484 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Me2984.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4484 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Me2984.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4484 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Me2984.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4056 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\PZ7MF02.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3EV54QP.exe
PID 4056 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\PZ7MF02.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3EV54QP.exe
PID 4056 wrote to memory of 4620 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\PZ7MF02.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3EV54QP.exe
PID 4620 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3EV54QP.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4620 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3EV54QP.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4620 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3EV54QP.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4620 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3EV54QP.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4620 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3EV54QP.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4620 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3EV54QP.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3800 wrote to memory of 4868 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iu1fq99.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Lk126lq.exe
PID 3800 wrote to memory of 4868 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iu1fq99.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Lk126lq.exe
PID 3800 wrote to memory of 4868 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iu1fq99.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Lk126lq.exe
PID 4868 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Lk126lq.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4868 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Lk126lq.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4868 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Lk126lq.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4868 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Lk126lq.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4868 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Lk126lq.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4868 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Lk126lq.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4868 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Lk126lq.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4868 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Lk126lq.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2296 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\4c8d4b5e39de12ecc40741e372f6f02de594a15942742231f879858305afbf3c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Fn9KO6.exe
PID 2296 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\4c8d4b5e39de12ecc40741e372f6f02de594a15942742231f879858305afbf3c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Fn9KO6.exe
PID 2296 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\4c8d4b5e39de12ecc40741e372f6f02de594a15942742231f879858305afbf3c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Fn9KO6.exe
PID 2480 wrote to memory of 4176 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Fn9KO6.exe C:\Windows\system32\cmd.exe
PID 2480 wrote to memory of 4176 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Fn9KO6.exe C:\Windows\system32\cmd.exe
PID 4176 wrote to memory of 4796 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4176 wrote to memory of 4796 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 3876 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 3876 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4176 wrote to memory of 1140 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4176 wrote to memory of 1140 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3880 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1140 wrote to memory of 3880 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 2608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 2608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 2608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 2608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 2608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 2608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4796 wrote to memory of 2608 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\4c8d4b5e39de12ecc40741e372f6f02de594a15942742231f879858305afbf3c.exe

"C:\Users\Admin\AppData\Local\Temp\4c8d4b5e39de12ecc40741e372f6f02de594a15942742231f879858305afbf3c.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iu1fq99.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iu1fq99.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\PZ7MF02.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\PZ7MF02.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uD9sJ19.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uD9sJ19.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1eW64tO2.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1eW64tO2.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Me2984.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Me2984.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4484 -ip 4484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1340 -ip 1340

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 596

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3EV54QP.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3EV54QP.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4620 -ip 4620

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 600

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Lk126lq.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Lk126lq.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4868 -ip 4868

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 152

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Fn9KO6.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Fn9KO6.exe

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1EFD.tmp\1F0D.tmp\1F0E.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Fn9KO6.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffa491d46f8,0x7ffa491d4708,0x7ffa491d4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x84,0x16c,0x7ffa491d46f8,0x7ffa491d4708,0x7ffa491d4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,6376031097865341840,11867730579579407154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,1578637027411526223,2174434091045563944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,1578637027411526223,2174434091045563944,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,6376031097865341840,11867730579579407154,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,1578637027411526223,2174434091045563944,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1578637027411526223,2174434091045563944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1578637027411526223,2174434091045563944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1578637027411526223,2174434091045563944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1578637027411526223,2174434091045563944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1578637027411526223,2174434091045563944,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,1578637027411526223,2174434091045563944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,1578637027411526223,2174434091045563944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1578637027411526223,2174434091045563944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1578637027411526223,2174434091045563944,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\7971.exe

C:\Users\Admin\AppData\Local\Temp\7971.exe

C:\Users\Admin\AppData\Local\Temp\7A8B.exe

C:\Users\Admin\AppData\Local\Temp\7A8B.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VR5us0ol.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VR5us0ol.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Or4RX8cx.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Or4RX8cx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7BC5.bat" "

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\oS1CF3Qn.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\oS1CF3Qn.exe

C:\Users\Admin\AppData\Local\Temp\7E08.exe

C:\Users\Admin\AppData\Local\Temp\7E08.exe

C:\Users\Admin\AppData\Local\Temp\7F22.exe

C:\Users\Admin\AppData\Local\Temp\7F22.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Ti66oF6.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Ti66oF6.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Xy0vr1bG.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Xy0vr1bG.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\8201.exe

C:\Users\Admin\AppData\Local\Temp\8201.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2336 -ip 2336

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 160

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5140 -ip 5140

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5140 -s 592

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5440 -ip 5440

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5160 -ip 5160

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5440 -s 540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5160 -s 148

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa491d46f8,0x7ffa491d4708,0x7ffa491d4718

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Rb326Jw.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Rb326Jw.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1578637027411526223,2174434091045563944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa491d46f8,0x7ffa491d4708,0x7ffa491d4718

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1578637027411526223,2174434091045563944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\A1BF.exe

C:\Users\Admin\AppData\Local\Temp\A1BF.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\ss41.exe

"C:\Users\Admin\AppData\Local\Temp\ss41.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\kos1.exe

"C:\Users\Admin\AppData\Local\Temp\kos1.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\AD2A.exe

C:\Users\Admin\AppData\Local\Temp\AD2A.exe

C:\Users\Admin\AppData\Local\Temp\set16.exe

"C:\Users\Admin\AppData\Local\Temp\set16.exe"

C:\Users\Admin\AppData\Local\Temp\B23C.exe

C:\Users\Admin\AppData\Local\Temp\B23C.exe

C:\Users\Admin\AppData\Local\Temp\kos.exe

"C:\Users\Admin\AppData\Local\Temp\kos.exe"

C:\Users\Admin\AppData\Local\Temp\is-LS49D.tmp\is-3H6RH.tmp

"C:\Users\Admin\AppData\Local\Temp\is-LS49D.tmp\is-3H6RH.tmp" /SL4 $B024E "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 52224

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Windows\SysWOW64\net.exe

"C:\Windows\system32\net.exe" helpmsg 8

C:\Program Files (x86)\PA Previewer\previewer.exe

"C:\Program Files (x86)\PA Previewer\previewer.exe" -i

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 helpmsg 8

C:\Users\Admin\AppData\Local\Temp\C279.exe

C:\Users\Admin\AppData\Local\Temp\C279.exe

C:\Program Files (x86)\PA Previewer\previewer.exe

"C:\Program Files (x86)\PA Previewer\previewer.exe" -s

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 6136 -s 2268

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1578637027411526223,2174434091045563944,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1578637027411526223,2174434091045563944,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\C279.exe

C:\Users\Admin\AppData\Local\Temp\C279.exe

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.179.141:443 accounts.google.com tcp
US 8.8.8.8:53 www.facebook.com udp
NL 157.240.247.35:443 www.facebook.com tcp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.247.240.157.in-addr.arpa udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 facebook.com udp
NL 157.240.201.35:443 facebook.com tcp
US 8.8.8.8:53 15.201.240.157.in-addr.arpa udp
US 8.8.8.8:53 35.201.240.157.in-addr.arpa udp
US 8.8.8.8:53 fbcdn.net udp
NL 157.240.201.35:443 fbcdn.net tcp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
NL 142.251.36.14:443 play.google.com udp
US 8.8.8.8:53 196.168.217.172.in-addr.arpa udp
US 8.8.8.8:53 14.36.251.142.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 29.68.91.77.in-addr.arpa udp
FI 77.91.68.52:80 77.91.68.52 tcp
US 8.8.8.8:53 52.68.91.77.in-addr.arpa udp
RU 5.42.65.80:80 5.42.65.80 tcp
RU 5.42.92.211:80 5.42.92.211 tcp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
US 8.8.8.8:53 211.92.42.5.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 1.124.91.77.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.68.29:80 77.91.68.29 tcp
FI 77.91.68.78:80 77.91.68.78 tcp
US 8.8.8.8:53 78.68.91.77.in-addr.arpa udp
US 8.8.8.8:53 z.nnnaajjjgc.com udp
MU 156.236.72.121:443 z.nnnaajjjgc.com tcp
US 95.214.25.204:80 95.214.25.204 tcp
US 8.8.8.8:53 121.72.236.156.in-addr.arpa udp
US 8.8.8.8:53 204.25.214.95.in-addr.arpa udp
AT 185.106.94.250:80 185.106.94.250 tcp
US 8.8.8.8:53 250.94.106.185.in-addr.arpa udp
US 8.8.8.8:53 147.174.42.23.in-addr.arpa udp
US 8.8.8.8:53 iplogger.com udp
DE 148.251.234.93:443 iplogger.com tcp
US 8.8.8.8:53 68.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 93.234.251.148.in-addr.arpa udp
MD 176.123.4.46:33783 tcp
MD 176.123.9.142:37637 tcp
US 8.8.8.8:53 46.4.123.176.in-addr.arpa udp
US 8.8.8.8:53 142.9.123.176.in-addr.arpa udp
US 8.8.8.8:53 app.nnnaajjjgc.com udp
HK 154.221.26.108:80 app.nnnaajjjgc.com tcp
US 8.8.8.8:53 108.26.221.154.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 host-host-file8.com udp
NL 194.169.175.127:80 host-host-file8.com tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 127.175.169.194.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 20c977b0-7909-4c2a-8040-34fa3affdb6f.uuid.ramboclub.net udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 stun4.l.google.com udp
US 8.8.8.8:53 server7.ramboclub.net udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.135.233:443 cdn.discordapp.com tcp
BG 185.82.216.48:443 server7.ramboclub.net tcp
US 74.125.204.127:19302 stun4.l.google.com udp
US 8.8.8.8:53 mastertryprice.com udp
US 172.67.212.103:443 mastertryprice.com tcp
US 8.8.8.8:53 233.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 127.204.125.74.in-addr.arpa udp
US 8.8.8.8:53 48.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 103.212.67.172.in-addr.arpa udp
US 8.8.8.8:53 datasheet.fun udp
US 172.67.166.109:80 datasheet.fun tcp
US 8.8.8.8:53 109.166.67.172.in-addr.arpa udp
US 8.8.8.8:53 8.179.89.13.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iu1fq99.exe

MD5 80b27434d05e89e3d573e4f732185e18
SHA1 7eabbe6794140851dc79725e1d8e1e763607c293
SHA256 d265a63050a005f1fc010db2a4f456cde216e2ea3fdf225577fa57b864ed5454
SHA512 29c5883a468f1e29a019e0b9be23502a7f6795646f4ae4a51fa10104a438043f10fb588347009235e4703e08f5e8c317e81572b75805abae386b2100cb62f5ab

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\iu1fq99.exe

MD5 80b27434d05e89e3d573e4f732185e18
SHA1 7eabbe6794140851dc79725e1d8e1e763607c293
SHA256 d265a63050a005f1fc010db2a4f456cde216e2ea3fdf225577fa57b864ed5454
SHA512 29c5883a468f1e29a019e0b9be23502a7f6795646f4ae4a51fa10104a438043f10fb588347009235e4703e08f5e8c317e81572b75805abae386b2100cb62f5ab

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\PZ7MF02.exe

MD5 f33f4c0302e6b4daa68ec0ce4d053f28
SHA1 0258a8050fa4f6ae4f89fc10d8854da79b3c0a2a
SHA256 9ab471bb819a6a7bf30c94ff14bf8985a7d062fae20b8b9a0936915f1eff66d8
SHA512 75a000ae860cefb36c451b0ce01b4564dc4fc7a80c67093b6978b6b1f8a709a40020650fcfc91f4470dbbd84e42a43cdd065da0aef49f9835a3c2ce1e043f782

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\PZ7MF02.exe

MD5 f33f4c0302e6b4daa68ec0ce4d053f28
SHA1 0258a8050fa4f6ae4f89fc10d8854da79b3c0a2a
SHA256 9ab471bb819a6a7bf30c94ff14bf8985a7d062fae20b8b9a0936915f1eff66d8
SHA512 75a000ae860cefb36c451b0ce01b4564dc4fc7a80c67093b6978b6b1f8a709a40020650fcfc91f4470dbbd84e42a43cdd065da0aef49f9835a3c2ce1e043f782

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uD9sJ19.exe

MD5 b9d494d1e57ac06dc607155cdd6178c3
SHA1 7f68da9172c5bfc060ea4536e66cb98badb4b81d
SHA256 72f04efdd854d2188b70182302778b9c1ade67aabef9a67700b00632ce7e6445
SHA512 e1bb8200584ab89436708bc466131da2b4c982cb795f99250d58c15591d4b4a81ac8fb5e061c7d46787f181c972cedcff5abc61c07fd5a0bf0040a48c4ad57ac

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uD9sJ19.exe

MD5 b9d494d1e57ac06dc607155cdd6178c3
SHA1 7f68da9172c5bfc060ea4536e66cb98badb4b81d
SHA256 72f04efdd854d2188b70182302778b9c1ade67aabef9a67700b00632ce7e6445
SHA512 e1bb8200584ab89436708bc466131da2b4c982cb795f99250d58c15591d4b4a81ac8fb5e061c7d46787f181c972cedcff5abc61c07fd5a0bf0040a48c4ad57ac

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1eW64tO2.exe

MD5 507c28a8202131c06b71017ca93685e9
SHA1 fb12f27dc897d85a1e0cb86abd2b183229b78c80
SHA256 20d64d6ad9c5cbd233708dc686f3828d0c108d2acbf080a7b255b4a8c623cb97
SHA512 edd888ac2abde0d82865dc9c731d26078accee61d80ec2a64d79a7abb2c8c8270c5e27c39750e2c5e811f350f7535e05a821558e5057e38b3468213a6410bf47

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1eW64tO2.exe

MD5 507c28a8202131c06b71017ca93685e9
SHA1 fb12f27dc897d85a1e0cb86abd2b183229b78c80
SHA256 20d64d6ad9c5cbd233708dc686f3828d0c108d2acbf080a7b255b4a8c623cb97
SHA512 edd888ac2abde0d82865dc9c731d26078accee61d80ec2a64d79a7abb2c8c8270c5e27c39750e2c5e811f350f7535e05a821558e5057e38b3468213a6410bf47

memory/2248-28-0x00000000006E0000-0x00000000006EA000-memory.dmp

memory/2248-29-0x00007FFA39950000-0x00007FFA3A411000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Me2984.exe

MD5 b387173209c14e3d3fc51fdc6b10a045
SHA1 a096ebf60ceeaeb157bae90a893f3c6391ddb8b6
SHA256 7819bade8c59a95ef304b20bb7f9aca5a699472aab23cc63c3586ccf375ac918
SHA512 051737353c4ceb29dc72d3ea6d8477e28257e73a42a594b8f683482047cdf3d70962bd2fdf3f36282fb160bb0a61b8322e3446d3fe1aa044bb868946080866a2

memory/2248-33-0x00007FFA39950000-0x00007FFA3A411000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Me2984.exe

MD5 b387173209c14e3d3fc51fdc6b10a045
SHA1 a096ebf60ceeaeb157bae90a893f3c6391ddb8b6
SHA256 7819bade8c59a95ef304b20bb7f9aca5a699472aab23cc63c3586ccf375ac918
SHA512 051737353c4ceb29dc72d3ea6d8477e28257e73a42a594b8f683482047cdf3d70962bd2fdf3f36282fb160bb0a61b8322e3446d3fe1aa044bb868946080866a2

memory/1340-35-0x0000000000400000-0x0000000000428000-memory.dmp

memory/1340-36-0x0000000000400000-0x0000000000428000-memory.dmp

memory/1340-37-0x0000000000400000-0x0000000000428000-memory.dmp

memory/1340-39-0x0000000000400000-0x0000000000428000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3EV54QP.exe

MD5 4177df9cc008b6f21f2ff0ecc4218b20
SHA1 9a0043ff015221c5508b08551b356363a4decdfd
SHA256 2652ab95e45124a0b49ed55fefab024ea22193c4d2abe52bbc0120c28df05f8b
SHA512 c3b0ba64b39ab7559210debeea86d4064159080777ab4ce9594dff766ecbf50337dddc67459e52e9c2661109a114b5cab728e074f61226e11f48864e33a20e40

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3EV54QP.exe

MD5 4177df9cc008b6f21f2ff0ecc4218b20
SHA1 9a0043ff015221c5508b08551b356363a4decdfd
SHA256 2652ab95e45124a0b49ed55fefab024ea22193c4d2abe52bbc0120c28df05f8b
SHA512 c3b0ba64b39ab7559210debeea86d4064159080777ab4ce9594dff766ecbf50337dddc67459e52e9c2661109a114b5cab728e074f61226e11f48864e33a20e40

memory/2324-43-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2324-44-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Lk126lq.exe

MD5 9615b77096cc61729fd5ebc7c882c0b4
SHA1 6dc3d880db35c7ffa399c3b6253fc8ea4563b79c
SHA256 cff7b72097433aa1bb3f518b8d5290ca349b885fca7107f85578be27ed7a1d57
SHA512 7bcc06aafcd438322a5b998504a4267cddabf24d73642ff02dfd61cc2b4b44353d98709fef6e537bc92024c9cfe55adc6bf48a0639bfd0e25c82844d32459695

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Lk126lq.exe

MD5 9615b77096cc61729fd5ebc7c882c0b4
SHA1 6dc3d880db35c7ffa399c3b6253fc8ea4563b79c
SHA256 cff7b72097433aa1bb3f518b8d5290ca349b885fca7107f85578be27ed7a1d57
SHA512 7bcc06aafcd438322a5b998504a4267cddabf24d73642ff02dfd61cc2b4b44353d98709fef6e537bc92024c9cfe55adc6bf48a0639bfd0e25c82844d32459695

memory/4100-48-0x0000000000400000-0x000000000043E000-memory.dmp

memory/4100-49-0x0000000074160000-0x0000000074910000-memory.dmp

memory/4100-50-0x0000000007BD0000-0x0000000008174000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Fn9KO6.exe

MD5 7af54f3fcdd4ef3c03eddcaa6c961ccb
SHA1 7d83676245fae59a9042ff67405f0f13c7359407
SHA256 3f2157202f04cb1d52eccb84699e8391d6ff448e773a10c5904d54bc5587f629
SHA512 c28e299537e8b1a0b88f67606ae3c11f1f893a5397b7c685d6e515bc6027c2d1b10a144e2ddfa1c10a20088558c0cf14cd36cf7f0898a856ecbeef38f0f56469

memory/4100-53-0x0000000007700000-0x0000000007792000-memory.dmp

memory/4100-54-0x00000000076E0000-0x00000000076F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Fn9KO6.exe

MD5 7af54f3fcdd4ef3c03eddcaa6c961ccb
SHA1 7d83676245fae59a9042ff67405f0f13c7359407
SHA256 3f2157202f04cb1d52eccb84699e8391d6ff448e773a10c5904d54bc5587f629
SHA512 c28e299537e8b1a0b88f67606ae3c11f1f893a5397b7c685d6e515bc6027c2d1b10a144e2ddfa1c10a20088558c0cf14cd36cf7f0898a856ecbeef38f0f56469

memory/4100-56-0x00000000078F0000-0x00000000078FA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1EFD.tmp\1F0D.tmp\1F0E.bat

MD5 5a115a88ca30a9f57fdbb545490c2043
SHA1 67e90f37fc4c1ada2745052c612818588a5595f4
SHA256 52c4113e7f308faa933ae6e8ff5d1b955ba62d1edac0eb7c972caa26e1ae4e2d
SHA512 17c399dad7b7343d5b16156e4d83de78ff5755d12add358bd2987ed4216dd13d24cfec9ecdb92d9d6723bb1d20d8874c0bad969dbec69eed95beb7a2817eb4fe

memory/4100-59-0x00000000087A0000-0x0000000008DB8000-memory.dmp

memory/4100-60-0x0000000007A90000-0x0000000007B9A000-memory.dmp

memory/4100-61-0x00000000079C0000-0x00000000079D2000-memory.dmp

memory/4100-62-0x0000000007A20000-0x0000000007A5C000-memory.dmp

memory/4100-63-0x0000000008180000-0x00000000081CC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 3478c18dc45d5448e5beefe152c81321
SHA1 a00c4c477bbd5117dec462cd6d1899ec7a676c07
SHA256 d2191cbeb51c49cbcd6f0ef24c8f93227b56680c95c762843137ac5d5f3f2e23
SHA512 8473bb9429b1baf1ca4ac2f03f2fdecc89313624558cf9d3f58bebb58a8f394c950c34bdc7b606228090477f9c867b0d19a00c0e2f76355c613dafd73d69599c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4d25fc6e43a16159ebfd161f28e16ef7
SHA1 49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4
SHA256 cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5
SHA512 ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4d25fc6e43a16159ebfd161f28e16ef7
SHA1 49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4
SHA256 cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5
SHA512 ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

memory/3164-77-0x0000000002A30000-0x0000000002A46000-memory.dmp

memory/2324-80-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4d25fc6e43a16159ebfd161f28e16ef7
SHA1 49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4
SHA256 cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5
SHA512 ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

\??\pipe\LOCAL\crashpad_1140_LYEROEHHARYFEYPV

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

\??\pipe\LOCAL\crashpad_4796_ENYQXOALFWUQVJDM

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 4dda16dd102a59d36638bcf52a7e11cb
SHA1 c77c3fbe2cc4d5b33b068dd0cfc4162bfa13a85e
SHA256 7e341ae07f7eea2c5fba3d337ffcfa1440a3f6a9fcbd77adc32d739be1301526
SHA512 b89fb6d24064a2defd6fd1b6c91e8fa3ac1b84222906bbac12806466ea847496339b4636b26683b7b0f9ebec8c607bf7e4e7dec69871da3e79837c2047ca0c26

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 2d20cc46b04409158567b6e9c9595639
SHA1 e4691d221a0a651698a15561283a9f43c3894ef5
SHA256 eef44d2aa37081169008a0013e5d2eeeddd644b90d6204fcebd3867d121fb121
SHA512 b33eebd769bd8e1a7c5a59e88c4d6099c86175a1c2a69fdaa77f632498bf9115a30db9a22ead474370d3015ec46da51574ffbbceba347d602928e8137ac198d3

memory/4100-215-0x0000000074160000-0x0000000074910000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

memory/4100-224-0x00000000076E0000-0x00000000076F0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6285a5eec72f546cbefe21ae3880c724
SHA1 6225db7bef17551a0ca7347d3dcf289d4e98a2ef
SHA256 6c6d602e493e740c774102d4895da1b4329600e77d6845b0fe7bd47d39627d50
SHA512 0b0cd0cc1b90a468069af3081a990699d5b412f1307b8a62f7e650742312293c1b75b14b2604a25893cb6bfced16247eafa27e1e72834ac67c1f0363c8b105df

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 4dda16dd102a59d36638bcf52a7e11cb
SHA1 c77c3fbe2cc4d5b33b068dd0cfc4162bfa13a85e
SHA256 7e341ae07f7eea2c5fba3d337ffcfa1440a3f6a9fcbd77adc32d739be1301526
SHA512 b89fb6d24064a2defd6fd1b6c91e8fa3ac1b84222906bbac12806466ea847496339b4636b26683b7b0f9ebec8c607bf7e4e7dec69871da3e79837c2047ca0c26

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 135fa4466335c06d84f936a442a329a8
SHA1 a99a9809589a8ee4b412a0c3452d343bed3bdfdf
SHA256 e0d1a034348d0a28c03e4b8bf0b11a531874b0bf76d08662ae74f557297cf18d
SHA512 b1257448b6400e66ba0268d4b4cf94de42641d7a1e120294d435e6fd840cef0d9f0251b1813044c52d0185dc3bed84dc8672dff5276a5b1ca9df1ea2f79c59da

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 d555d038867542dfb2fb0575a0d3174e
SHA1 1a5868d6df0b5de26cf3fc7310b628ce0a3726f0
SHA256 044cac379dddf0c21b8e7ee4079d21c67e28795d14e678dbf3e35900f25a1e2e
SHA512 d8220966fe6c3ae4499bc95ab3aead087a3dd915853320648849d2fc123a4acd157b7dba64af0108802522575a822651ecc005523c731423d9131ee679c2712f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Temp\7971.exe

MD5 58f0d05dc318fb27da641c03fa4d664d
SHA1 daf53aa6f3f5706c1aec7c8149dd3973159d5264
SHA256 3f604bed00436d2063eb5e64e7443afd4c94b96cf4a5391150a8b2b6199261f2
SHA512 9ee0cf60aac3acfa2fe3bb466acdc549567f01fb817008ace925a0178a5d0f3409499ff7d6f6f3953298041cfb6ef758347d30c261b6190ee3d9e9deb17396c7

C:\Users\Admin\AppData\Local\Temp\7971.exe

MD5 58f0d05dc318fb27da641c03fa4d664d
SHA1 daf53aa6f3f5706c1aec7c8149dd3973159d5264
SHA256 3f604bed00436d2063eb5e64e7443afd4c94b96cf4a5391150a8b2b6199261f2
SHA512 9ee0cf60aac3acfa2fe3bb466acdc549567f01fb817008ace925a0178a5d0f3409499ff7d6f6f3953298041cfb6ef758347d30c261b6190ee3d9e9deb17396c7

C:\Users\Admin\AppData\Local\Temp\7A8B.exe

MD5 0b5d6ef3c97a9e982265f7af225e5a9c
SHA1 1997d3ee98bd097055ab61b4c3d63637b120bee3
SHA256 fe7f655249dcdafa18d1ff185dfc1b26d1c71262ad2f76391f0e423e9bb240e4
SHA512 71784323e6aab3550314fae076fc6b3a35e3c30e707f53f16a19d9b3d533c2da1215c33038b195fc72bec245b64897b5cc21c8392fcce5fcfdf354214dd6bea8

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6qe08pX.exe

MD5 5235caae76d02f5952194d9ca29b3b03
SHA1 c5d28760e6bbb69298904aa1f9bf9ba777b23697
SHA256 c82317a752e64d5d09b5d4ca0a517c625141a50c535a2bd0b6148d18306632dc
SHA512 601ed5535bedad1b3eece71ac74580e57c4f375c7eb714a4efe0ad53b3fc4fcce19a2e9d317fd71896ca80825f573abf594579ee9f0f3885c8944507d72797d7

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VR5us0ol.exe

MD5 66c3517503dc4974307fec6ffa661d5a
SHA1 7c371312352f3335f55053e19ed5138b355a81b4
SHA256 bfdea6f786a62a1efa9971fca4695516f625cc33748559957af2e95e518434a0
SHA512 86d3c68c407943cd4ab798acc864777453acec3c7db483ec0189f86a09fccf70bf516bff911251db1ef26e39baf4650b784056f628963ea89c153ebfc47d12bf

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VR5us0ol.exe

MD5 66c3517503dc4974307fec6ffa661d5a
SHA1 7c371312352f3335f55053e19ed5138b355a81b4
SHA256 bfdea6f786a62a1efa9971fca4695516f625cc33748559957af2e95e518434a0
SHA512 86d3c68c407943cd4ab798acc864777453acec3c7db483ec0189f86a09fccf70bf516bff911251db1ef26e39baf4650b784056f628963ea89c153ebfc47d12bf

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Or4RX8cx.exe

MD5 49aafacee476804694b089564753232a
SHA1 e5f3f789c72b9f57f646dfbdcd8da420ffbd6460
SHA256 802b6e16f12cfa5b130717d3500c22a7ee02bbb783b20935ffba17145c3c5787
SHA512 30be2c3e14b54b0fb9b30b2517db720d185d80cf6f5d49a179c5eed44c31c7cfd056c0e792715b7fa558dc8c57ef3ae2a5c4389cc2f62d00bc4507a390d4575c

C:\Users\Admin\AppData\Local\Temp\7A8B.exe

MD5 0b5d6ef3c97a9e982265f7af225e5a9c
SHA1 1997d3ee98bd097055ab61b4c3d63637b120bee3
SHA256 fe7f655249dcdafa18d1ff185dfc1b26d1c71262ad2f76391f0e423e9bb240e4
SHA512 71784323e6aab3550314fae076fc6b3a35e3c30e707f53f16a19d9b3d533c2da1215c33038b195fc72bec245b64897b5cc21c8392fcce5fcfdf354214dd6bea8

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\oS1CF3Qn.exe

MD5 9014a0234d2c58ee7cf349c19e148c3b
SHA1 53b90f7cdbb745bbe5616cbbfd609323df8f822a
SHA256 5956c5a0dac5224aae9b8309e85290aa11b081d874f69d539817ba6d01ea613c
SHA512 42c4e86e34bf75bc00d6b7d8fa090e6ee1435e0b8a3c895810aa683e0ad6a6459f6b16182ba73b2e62270c2a158d9565e5143b0a308122d0042aebeb2bb01c06

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Or4RX8cx.exe

MD5 49aafacee476804694b089564753232a
SHA1 e5f3f789c72b9f57f646dfbdcd8da420ffbd6460
SHA256 802b6e16f12cfa5b130717d3500c22a7ee02bbb783b20935ffba17145c3c5787
SHA512 30be2c3e14b54b0fb9b30b2517db720d185d80cf6f5d49a179c5eed44c31c7cfd056c0e792715b7fa558dc8c57ef3ae2a5c4389cc2f62d00bc4507a390d4575c

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\oS1CF3Qn.exe

MD5 9014a0234d2c58ee7cf349c19e148c3b
SHA1 53b90f7cdbb745bbe5616cbbfd609323df8f822a
SHA256 5956c5a0dac5224aae9b8309e85290aa11b081d874f69d539817ba6d01ea613c
SHA512 42c4e86e34bf75bc00d6b7d8fa090e6ee1435e0b8a3c895810aa683e0ad6a6459f6b16182ba73b2e62270c2a158d9565e5143b0a308122d0042aebeb2bb01c06

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Xy0vr1bG.exe

MD5 ad04538ac68bdbcdd4af15df754950df
SHA1 01a914d0ff62513dd29e5471a06262425b3587d0
SHA256 a148f9b369eb12dcc206683c98559e264ce830b4402c2e2aac6559eec6f3f621
SHA512 da9a246975b6bd40ee83cdf91f96f7d44b84becfe925fcd7c9976a8b6c950e1d40b5adf448460b64ab8a6351e4370c47f338bb0f4197a7abde976dc9da7b9eef

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Ti66oF6.exe

MD5 94fe8c5b20737216593756185af3492c
SHA1 8eead059a52929964e302ea5b368b979839c2cac
SHA256 de73644bad0e5ac1b38ac89d00ec878bd467884f5ba2c13a5d7ff900a2bf0b9a
SHA512 4105e2ddfb853054057fa6eee53e74df7f335bad223a990487e99621ceb64959183fd3dc04fb03a820df684eda2056a941f9f6549fd18d1be360c52f1dc9e340

C:\Users\Admin\AppData\Local\Temp\7E08.exe

MD5 0e6557057a1d9769a7cc3b4f670fdde5
SHA1 8870b8d7db588dd57b416e474875b908517cbedb
SHA256 aa0a00deb37f55d80e804526da1e0675f595772782a4871e3fc2be021da6c10c
SHA512 13a4af52593a02b8309d0c71d70932527c792f7145cee1d3102b5504352185a80257af7fc5921bda690e6eae068f22616ed59677e00906d76c3d9dee43f5ad40

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Xy0vr1bG.exe

MD5 ad04538ac68bdbcdd4af15df754950df
SHA1 01a914d0ff62513dd29e5471a06262425b3587d0
SHA256 a148f9b369eb12dcc206683c98559e264ce830b4402c2e2aac6559eec6f3f621
SHA512 da9a246975b6bd40ee83cdf91f96f7d44b84becfe925fcd7c9976a8b6c950e1d40b5adf448460b64ab8a6351e4370c47f338bb0f4197a7abde976dc9da7b9eef

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Ti66oF6.exe

MD5 94fe8c5b20737216593756185af3492c
SHA1 8eead059a52929964e302ea5b368b979839c2cac
SHA256 de73644bad0e5ac1b38ac89d00ec878bd467884f5ba2c13a5d7ff900a2bf0b9a
SHA512 4105e2ddfb853054057fa6eee53e74df7f335bad223a990487e99621ceb64959183fd3dc04fb03a820df684eda2056a941f9f6549fd18d1be360c52f1dc9e340

C:\Users\Admin\AppData\Local\Temp\7BC5.bat

MD5 403991c4d18ac84521ba17f264fa79f2
SHA1 850cc068de0963854b0fe8f485d951072474fd45
SHA256 ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512 a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

C:\Users\Admin\AppData\Local\Temp\7F22.exe

MD5 cb71132b03f15b037d3e8a5e4d9e0285
SHA1 95963fba539b45eb6f6acbd062c48976733519a1
SHA256 7f7d4ba0b7b46eff509b3aa2105d10d25f79e13ef3c1b1ec9c889cf2f0f1d373
SHA512 d140809bcac5b6b47f710c18ca1df1a3dd9b9adb95dbc368049cdc91874070c9a9f67137941ab17147143ebfabb81de7f1e697e42b0a28d51776b2f9c48cba4a

memory/5244-313-0x0000000000270000-0x000000000027A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7E08.exe

MD5 0e6557057a1d9769a7cc3b4f670fdde5
SHA1 8870b8d7db588dd57b416e474875b908517cbedb
SHA256 aa0a00deb37f55d80e804526da1e0675f595772782a4871e3fc2be021da6c10c
SHA512 13a4af52593a02b8309d0c71d70932527c792f7145cee1d3102b5504352185a80257af7fc5921bda690e6eae068f22616ed59677e00906d76c3d9dee43f5ad40

C:\Users\Admin\AppData\Local\Temp\7F22.exe

MD5 cb71132b03f15b037d3e8a5e4d9e0285
SHA1 95963fba539b45eb6f6acbd062c48976733519a1
SHA256 7f7d4ba0b7b46eff509b3aa2105d10d25f79e13ef3c1b1ec9c889cf2f0f1d373
SHA512 d140809bcac5b6b47f710c18ca1df1a3dd9b9adb95dbc368049cdc91874070c9a9f67137941ab17147143ebfabb81de7f1e697e42b0a28d51776b2f9c48cba4a

memory/5244-315-0x00007FFA35730000-0x00007FFA361F1000-memory.dmp

memory/5312-324-0x0000000000400000-0x0000000000428000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 4bd59a6b3207f99fc3435baf3c22bc4e
SHA1 ae90587beed289f177f4143a8380ba27109d0a6f
SHA256 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512 ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

memory/5312-321-0x0000000000400000-0x0000000000428000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8201.exe

MD5 4bd59a6b3207f99fc3435baf3c22bc4e
SHA1 ae90587beed289f177f4143a8380ba27109d0a6f
SHA256 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512 ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

memory/5312-325-0x0000000000400000-0x0000000000428000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8201.exe

MD5 4bd59a6b3207f99fc3435baf3c22bc4e
SHA1 ae90587beed289f177f4143a8380ba27109d0a6f
SHA256 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512 ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

memory/5440-327-0x0000000000400000-0x0000000000428000-memory.dmp

memory/5440-328-0x0000000000400000-0x0000000000428000-memory.dmp

memory/5440-334-0x0000000000400000-0x0000000000428000-memory.dmp

memory/5312-335-0x0000000000400000-0x0000000000428000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 4bd59a6b3207f99fc3435baf3c22bc4e
SHA1 ae90587beed289f177f4143a8380ba27109d0a6f
SHA256 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512 ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 4bd59a6b3207f99fc3435baf3c22bc4e
SHA1 ae90587beed289f177f4143a8380ba27109d0a6f
SHA256 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512 ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

memory/5584-340-0x0000000074160000-0x0000000074910000-memory.dmp

memory/5584-341-0x00000000076B0000-0x00000000076C0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 8240f00b1ae7ddd79dac5241874c2283
SHA1 e371cfe7e112eca22cb655a75d57dbe32ca02a9e
SHA256 59a2806fd9020292d8118ef3de4e1187dc7d2b01565590ecfd8c15010b2caad0
SHA512 7f6bb60e8a3ac461f7f6f428d9312c95183725b2f32142616d6166de35a2acc40b9e2df1e5dca1d54612647b93419b1f0f9bbd2874ac59bd74e1cba873ef909e

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Rb326Jw.exe

MD5 e748f885cdee27913e4462d9db102166
SHA1 b242938a5bdec37c2f831054992c48246e0bcb3c
SHA256 9403b9206c3f092ac6c85ad1f7e19006c1bb823609bd3f9a9926be3b84f638c2
SHA512 d4e1fc798ca5387ef914d314a77fbe8025047e7c666cd61c055884b5629d50a9dab7e02363b18ad7aa0f4b3b4304f95c6a01413cc9de280cf2efee82adfd6363

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Rb326Jw.exe

MD5 e748f885cdee27913e4462d9db102166
SHA1 b242938a5bdec37c2f831054992c48246e0bcb3c
SHA256 9403b9206c3f092ac6c85ad1f7e19006c1bb823609bd3f9a9926be3b84f638c2
SHA512 d4e1fc798ca5387ef914d314a77fbe8025047e7c666cd61c055884b5629d50a9dab7e02363b18ad7aa0f4b3b4304f95c6a01413cc9de280cf2efee82adfd6363

memory/5916-359-0x0000000074160000-0x0000000074910000-memory.dmp

memory/5916-360-0x00000000004E0000-0x000000000051E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4d25fc6e43a16159ebfd161f28e16ef7
SHA1 49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4
SHA256 cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5
SHA512 ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

memory/5916-362-0x0000000007210000-0x0000000007220000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4d25fc6e43a16159ebfd161f28e16ef7
SHA1 49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4
SHA256 cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5
SHA512 ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 2e1118b3236a1dfc0c48a88515533f5e
SHA1 a651ddef5a17fcdcc5a20b177b0fc2c88a2c3e21
SHA256 df434b079fb09dda2a6d031df852f63a6acb43a49aab427398ec12fbe4d1bca9
SHA512 2bede166736eaf1fd1d30af3dde3e8182f1623c8ce1add8cad7b7c22c111147acf9d5e8d800145e472ac512af4075a6d1a25c24579b7c1d62a42fc256d4fe0da

C:\Users\Admin\AppData\Local\Temp\A1BF.exe

MD5 3c81534d635fbe4bfab2861d98422f70
SHA1 9cc995fa42313cd82eacaad9e3fe818cd3805f58
SHA256 88921dad96a51ff9f15a1d93b51910b2ac75589020fbb75956b6f090381d4d4f
SHA512 132fa532fad96b512b795cf4786245cc24bbdbbab433bf34925cf20401a819cab7bed92771e7f0b4c970535804d42f7f1d2887765ed8f999c99a0e15d93a0136

C:\Users\Admin\AppData\Local\Temp\A1BF.exe

MD5 3c81534d635fbe4bfab2861d98422f70
SHA1 9cc995fa42313cd82eacaad9e3fe818cd3805f58
SHA256 88921dad96a51ff9f15a1d93b51910b2ac75589020fbb75956b6f090381d4d4f
SHA512 132fa532fad96b512b795cf4786245cc24bbdbbab433bf34925cf20401a819cab7bed92771e7f0b4c970535804d42f7f1d2887765ed8f999c99a0e15d93a0136

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 1a112ff9028c50b0534789b1dc25154c
SHA1 ee8d7107a3be8d16dfd95ebb30fc3a4747c9ea07
SHA256 268ec8502bccda89b236d7dceb9e1d28c997af1975c64dacff04d77bec0fc2fc
SHA512 b6f459eba50264a8035e1ecd0a51bac2d5841e3348a2553258ea6e15b655d63f994541c6dfa20918d97e144d26e735749ab8a5344b0b7f5b2d92a2579a1da39a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a3ec.TMP

MD5 5f0fb351c7a6b4c4dcf3524b13c2d645
SHA1 9adf9739cfee45aff9271f6b9f2f9e992e01cc67
SHA256 5f3c162731ccceaffe933d3dd77096fd877cc6cf5aba391fc31e901a072fa461
SHA512 9f424c397971e689ade6c40e7307a31fedc2310db611b71d04fc63e6870c795c83fb0f7105fcc0732d97aa3beb88de831c33eb42c47d31bb09efd7e9325dbf02

memory/5244-477-0x00007FFA35730000-0x00007FFA361F1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ss41.exe

MD5 83330cf6e88ad32365183f31b1fd3bda
SHA1 1c5b47be2b8713746de64b39390636a81626d264
SHA256 7ce942cdc58ba5fa628d97f991c8a794294c2acfb724efbf0ac887c47942a31e
SHA512 e28a9c47f690b0b0f0dd3b946d9cd59c761803f3826a382208a5b92be1293067b37a39f1141ddda13247b96138a108ce2f85b83de0143d48d4acc94f69a11908

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 528b5dc5ede359f683b73a684b9c19f6
SHA1 8bff4feae6dbdaafac1f9f373f15850d08e0a206
SHA256 3a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9
SHA512 87cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb

memory/5216-491-0x00007FF6F5A40000-0x00007FF6F5AAA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 7ea584dc49967de03bebdacec829b18d
SHA1 3d47f0e88c7473bedeed2f14d7a8db1318b93852
SHA256 79232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53
SHA512 ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0

memory/5244-513-0x00007FFA35730000-0x00007FFA361F1000-memory.dmp

memory/5996-514-0x0000000000C90000-0x0000000000E04000-memory.dmp

memory/5584-515-0x0000000074160000-0x0000000074910000-memory.dmp

memory/5200-518-0x00000000026C0000-0x00000000027C0000-memory.dmp

memory/5200-521-0x00000000041C0000-0x00000000041C9000-memory.dmp

memory/3316-523-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3316-520-0x0000000000400000-0x0000000000409000-memory.dmp

memory/5996-524-0x0000000074160000-0x0000000074910000-memory.dmp

memory/5584-525-0x00000000076B0000-0x00000000076C0000-memory.dmp

memory/5464-534-0x0000000004790000-0x0000000004B96000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\set16.exe

MD5 22d5269955f256a444bd902847b04a3b
SHA1 41a83de3273270c3bd5b2bd6528bdc95766aa268
SHA256 ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd
SHA512 d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

memory/5720-528-0x00000000003C0000-0x000000000057D000-memory.dmp

memory/5916-536-0x0000000074160000-0x0000000074910000-memory.dmp

memory/5452-537-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\kos.exe

MD5 076ab7d1cc5150a5e9f8745cc5f5fb6c
SHA1 7b40783a27a38106e2cc91414f2bc4d8b484c578
SHA256 d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90
SHA512 75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

memory/5464-550-0x0000000004BA0000-0x000000000548B000-memory.dmp

memory/6136-553-0x0000000000820000-0x0000000000828000-memory.dmp

memory/5996-567-0x0000000074160000-0x0000000074910000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\kos1.exe

MD5 85b698363e74ba3c08fc16297ddc284e
SHA1 171cfea4a82a7365b241f16aebdb2aad29f4f7c0
SHA256 78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe
SHA512 7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

memory/5464-571-0x0000000000400000-0x000000000298D000-memory.dmp

memory/5412-572-0x0000000000400000-0x0000000000430000-memory.dmp

memory/6136-573-0x000000001B450000-0x000000001B460000-memory.dmp

memory/6008-577-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

memory/5916-588-0x0000000007210000-0x0000000007220000-memory.dmp

memory/5720-600-0x00000000003C0000-0x000000000057D000-memory.dmp

memory/5412-602-0x0000000002DC0000-0x0000000002DC6000-memory.dmp

memory/5720-604-0x00000000003C0000-0x000000000057D000-memory.dmp

memory/6136-603-0x00007FFA35730000-0x00007FFA361F1000-memory.dmp

memory/5452-579-0x0000000000400000-0x0000000000413000-memory.dmp

memory/5276-607-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/5412-613-0x0000000074160000-0x0000000074910000-memory.dmp

memory/5276-615-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/5956-623-0x0000000000400000-0x0000000000467000-memory.dmp

memory/5320-627-0x0000000000980000-0x0000000000CB2000-memory.dmp

memory/3316-620-0x0000000000400000-0x0000000000409000-memory.dmp

memory/5956-628-0x0000000074160000-0x0000000074910000-memory.dmp

memory/5412-619-0x0000000002DD0000-0x0000000002DE0000-memory.dmp

memory/5320-630-0x0000000005470000-0x000000000554A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

MD5 ec6aae2bb7d8781226ea61adca8f0586
SHA1 d82b3bad240f263c1b887c7c0cc4c2ff0e86dfe3
SHA256 b02fffaba9e664ff7840c82b102d6851ec0bb148cec462cef40999545309e599
SHA512 aa62a8cd02a03e4f462f76ae6ff2e43849052ce77cca3a2ccf593f6669425830d0910afac3cf2c46dd385454a6fb3b4bd604ae13b9586087d6f22de644f9dfc7

memory/5320-638-0x0000000005590000-0x00000000055A0000-memory.dmp

memory/5956-639-0x0000000007590000-0x00000000075A0000-memory.dmp

memory/5320-641-0x0000000005610000-0x00000000056E8000-memory.dmp

memory/5040-642-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/5320-643-0x0000000005830000-0x00000000058F8000-memory.dmp

memory/5320-631-0x0000000074160000-0x0000000074910000-memory.dmp

memory/3164-616-0x0000000002C20000-0x0000000002C36000-memory.dmp

memory/5956-609-0x0000000000900000-0x000000000095A000-memory.dmp

memory/5464-646-0x0000000000400000-0x000000000298D000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 8f6fc61abb85e6a15157f31bd30ea3eb
SHA1 272dfd6b73eece9d6c62ee9e05c1e2a444a292ea
SHA256 233d8844e88ebdf55a2853f940d65bf817c9f42afe0ed05537c5874bd4db1f78
SHA512 093e0905cf793253e61b0268775e55d401d7a0d1b3ffb9fb5511d5ddd3e6e483fc46d721f53a73d7a21dd1ffae9db30fdad31743e0a833e1f120057ceb37e35c

memory/6008-677-0x0000000000400000-0x00000000004B0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 a98cda30c769382c43e0f34d5d1779c4
SHA1 f89f42750dbeabfb3fa80bb3e46d3d4c32cb5c5b
SHA256 2edca23c5c2ba5c6f785ecca7286a3c31c0cf217000dd4c0f38f2c2ad33f5f49
SHA512 1d15a588132dd110ed31eb023b6d4aae96677b45adbc2be82610a784e2d8f9834441f4d7097416daf61305b232ae954568439c735fa82c44994f151236cea3d3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 dca45f316252e4524052c1ac52c3958a
SHA1 0b0632944dc2f55749921ae9a93a3b82c8357b51
SHA256 7ec78332be81c156b6beb4ccfe4079116ed5ca09570193e65b9fac6d864de1b4
SHA512 3d56874aa0fb1435b508f84c04a1f160bb41242ab113a98cfede5474be0f83db91b582134f3b40f09e52d6c013fbf580c3ff7c554918d334d6a25d88849640c4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 ca92561177dd592795f45baa59009a5e
SHA1 8e74d622aa7d815d8987b4ab6b8e891764a63dc6
SHA256 36ac47eb03143224fb7a24c0e373e95b7ed6ee975c11794f16b1d358b03ed68f
SHA512 eb8a14cae7a74f92ef6f3fcd84e56d7f1ff79487ae5a6c8b2d6508d465166c9ede9728b98928a1bc447f57a005b165c751dbf23601b8cb791e6461385d121a93

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 9d06ec151bffef0f01e69d8d948c1e2b
SHA1 84dc5854559b551328d72d4c68bbc6453b74d9c9
SHA256 ace2bcbad65b758a83470a8d445fd752c8f6382d504278f833c9f21cfe4262eb
SHA512 f2d9bd4f72eac15f8283ce2c165d650670bcb3514d63a3e4c9ecd0a32e8d91a947113d17f2ac3542af4a9cca0739c005b92c480e38ef69e83ec43ad2a312b676

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 cba27c49976edf778137c26c49aa9cb8
SHA1 96e5d97d06b9e94e2d64bebdc9aef092b8adf8e3
SHA256 d6a13eb8d8dfcd312ca751503772006da188132c5e21b8a07b42fce5a994f000
SHA512 8f16752d2831fd94765fb1baa5b3236d25963c54baa512d13d8b87bfa477040b42a067b88193b924f98392b4dd7881a081a2ddfab232c417864446fd7b98e3f1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 e087c51039256dfa18f8abda8c414243
SHA1 ff244c8e3871044951004d72cc9aaed427401e4d
SHA256 f46dab1ceaddf0bfec9e9e6fa5903807730a6d355f4f0023500192e132112cf4
SHA512 bb2afbd328aea6e25b34808bd0b40170d6c1a664b14b7b490564b84698ce62530e6d608d4a4b526fabb414905e830382decafef19a438024bed60c9c12b38ede

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x2rvxjv2.nzv.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5464-844-0x0000000000400000-0x000000000298D000-memory.dmp

memory/5040-887-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/5464-908-0x0000000000400000-0x000000000298D000-memory.dmp

memory/5040-943-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/5444-956-0x0000000000400000-0x000000000298D000-memory.dmp

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

memory/5040-1008-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/3148-1021-0x0000000000400000-0x00000000004AC000-memory.dmp

memory/5444-1020-0x0000000000400000-0x000000000298D000-memory.dmp

memory/3148-1025-0x00000000057E0000-0x00000000058C1000-memory.dmp

memory/3148-1027-0x00000000057E0000-0x00000000058C1000-memory.dmp

memory/3148-1030-0x00000000057E0000-0x00000000058C1000-memory.dmp