Malware Analysis Report

2025-06-16 01:29

Sample ID 231031-jgdeyshd2t
Target file.exe
SHA256 d06094368166a83ecc3802c2ff155d2ae25c1d7b840331fb2c52ded1d6ffdd62
Tags
amadey dcrat glupteba raccoon redline sectoprat smokeloader zgrat 6a6a005b9aa778f606280c5fa24ae595 @ytlogsbot grome kinza pixelnew up3 backdoor paypal discovery dropper evasion infostealer loader persistence phishing rat stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d06094368166a83ecc3802c2ff155d2ae25c1d7b840331fb2c52ded1d6ffdd62

Threat Level: Known bad

The file file.exe was found to be: Known bad.

Malicious Activity Summary

amadey dcrat glupteba raccoon redline sectoprat smokeloader zgrat 6a6a005b9aa778f606280c5fa24ae595 @ytlogsbot grome kinza pixelnew up3 backdoor paypal discovery dropper evasion infostealer loader persistence phishing rat stealer trojan

SectopRAT payload

RedLine

SectopRAT

ZGRat

Raccoon Stealer payload

Glupteba payload

Glupteba

Detect ZGRat V1

RedLine payload

Raccoon

Modifies Windows Defender Real-time Protection settings

SmokeLoader

Amadey

DcRat

Modifies Windows Firewall

Stops running service(s)

Downloads MZ/PE file

Loads dropped DLL

Windows security modification

Checks computer location settings

Executes dropped EXE

Looks up external IP address via web service

Adds Run key to start application

Checks installed software on the system

Detected potential entity reuse from brand paypal.

Suspicious use of SetThreadContext

Drops file in Program Files directory

Launches sc.exe

Enumerates physical storage devices

Program crash

Unsigned PE

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Checks SCSI registry key(s)

Creates scheduled task(s)

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-31 07:38

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-31 07:38

Reported

2023-10-31 07:40

Platform

win10v2004-20231020-en

Max time kernel

57s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\2058.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\2058.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\2058.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\2058.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\2058.exe N/A

Raccoon

stealer raccoon

Raccoon Stealer payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

ZGRat

rat zgrat

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Stops running service(s)

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\kos4.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7565.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5te3xb1.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\4846.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kN8pt06.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QH0eE74.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\XE5Cr14.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tp0kp22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mi0BM65.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Oz08eN2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2lP3642.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3Kn95LI.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4zX929xx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5te3xb1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6AN4Vh6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Qm0LX47.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1BB1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1C9C.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Mw5PR0bI.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Qq1Im4YA.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zs8mf1qB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\zj8LL1Re.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1F5D.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2058.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2462.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2cX809La.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4846.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4AF7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\kos4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\latestX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6630.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RUICS.tmp\LzmwAqmV.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6DF2.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7565.exe N/A
N/A N/A C:\Program Files (x86)\LAudioConverter\LAudioConverter.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7AA6.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\2058.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tp0kp22.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zs8mf1qB.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\zj8LL1Re.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kN8pt06.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\XE5Cr14.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Mw5PR0bI.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Qq1Im4YA.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\4AF7.exe'\"" C:\Users\Admin\AppData\Local\Temp\4AF7.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QH0eE74.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup5 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mi0BM65.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\1BB1.exe N/A

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Detected potential entity reuse from brand paypal.

phishing paypal

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\LAudioConverter\is-BHK7M.tmp C:\Users\Admin\AppData\Local\Temp\is-RUICS.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\LAudioConverter\XML\Styles\is-TJA9M.tmp C:\Users\Admin\AppData\Local\Temp\is-RUICS.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\LAudioConverter\is-PDMBP.tmp C:\Users\Admin\AppData\Local\Temp\is-RUICS.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\LAudioConverter\is-GET05.tmp C:\Users\Admin\AppData\Local\Temp\is-RUICS.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\LAudioConverter\is-5UMCP.tmp C:\Users\Admin\AppData\Local\Temp\is-RUICS.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\LAudioConverter\is-LPEVE.tmp C:\Users\Admin\AppData\Local\Temp\is-RUICS.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\LAudioConverter\is-4LUCL.tmp C:\Users\Admin\AppData\Local\Temp\is-RUICS.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\LAudioConverter\is-DB0NS.tmp C:\Users\Admin\AppData\Local\Temp\is-RUICS.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\LAudioConverter\is-Q6RNJ.tmp C:\Users\Admin\AppData\Local\Temp\is-RUICS.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\LAudioConverter\is-QUV0B.tmp C:\Users\Admin\AppData\Local\Temp\is-RUICS.tmp\LzmwAqmV.tmp N/A
File opened for modification C:\Program Files (x86)\LAudioConverter\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-RUICS.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\LAudioConverter\is-5F7G1.tmp C:\Users\Admin\AppData\Local\Temp\is-RUICS.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\LAudioConverter\XML\Styles\is-4JP8R.tmp C:\Users\Admin\AppData\Local\Temp\is-RUICS.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\LAudioConverter\XML\Styles\is-HBFES.tmp C:\Users\Admin\AppData\Local\Temp\is-RUICS.tmp\LzmwAqmV.tmp N/A
File opened for modification C:\Program Files (x86)\LAudioConverter\LAudioConverter.exe C:\Users\Admin\AppData\Local\Temp\is-RUICS.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\LAudioConverter\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-RUICS.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\LAudioConverter\is-6HEDT.tmp C:\Users\Admin\AppData\Local\Temp\is-RUICS.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\LAudioConverter\is-HCKKU.tmp C:\Users\Admin\AppData\Local\Temp\is-RUICS.tmp\LzmwAqmV.tmp N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3Kn95LI.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3Kn95LI.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3Kn95LI.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3Kn95LI.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3Kn95LI.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3Kn95LI.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2058.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\kos4.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RUICS.tmp\LzmwAqmV.tmp N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1348 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kN8pt06.exe
PID 1348 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kN8pt06.exe
PID 1348 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kN8pt06.exe
PID 2992 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kN8pt06.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QH0eE74.exe
PID 2992 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kN8pt06.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QH0eE74.exe
PID 2992 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kN8pt06.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QH0eE74.exe
PID 804 wrote to memory of 4164 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QH0eE74.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\XE5Cr14.exe
PID 804 wrote to memory of 4164 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QH0eE74.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\XE5Cr14.exe
PID 804 wrote to memory of 4164 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QH0eE74.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\XE5Cr14.exe
PID 4164 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\XE5Cr14.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tp0kp22.exe
PID 4164 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\XE5Cr14.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tp0kp22.exe
PID 4164 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\XE5Cr14.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tp0kp22.exe
PID 1976 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tp0kp22.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mi0BM65.exe
PID 1976 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tp0kp22.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mi0BM65.exe
PID 1976 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tp0kp22.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mi0BM65.exe
PID 2976 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mi0BM65.exe C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Oz08eN2.exe
PID 2976 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mi0BM65.exe C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Oz08eN2.exe
PID 2976 wrote to memory of 364 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mi0BM65.exe C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Oz08eN2.exe
PID 364 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Oz08eN2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 364 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Oz08eN2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 364 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Oz08eN2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 364 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Oz08eN2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 364 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Oz08eN2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 364 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Oz08eN2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 364 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Oz08eN2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 364 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Oz08eN2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2976 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mi0BM65.exe C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2lP3642.exe
PID 2976 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mi0BM65.exe C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2lP3642.exe
PID 2976 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mi0BM65.exe C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2lP3642.exe
PID 3936 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2lP3642.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3936 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2lP3642.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3936 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2lP3642.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3936 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2lP3642.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3936 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2lP3642.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3936 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2lP3642.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3936 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2lP3642.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3936 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2lP3642.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3936 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2lP3642.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3936 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2lP3642.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1976 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tp0kp22.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3Kn95LI.exe
PID 1976 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tp0kp22.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3Kn95LI.exe
PID 1976 wrote to memory of 2996 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tp0kp22.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3Kn95LI.exe
PID 4164 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\XE5Cr14.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4zX929xx.exe
PID 4164 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\XE5Cr14.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4zX929xx.exe
PID 4164 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\XE5Cr14.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4zX929xx.exe
PID 4028 wrote to memory of 4804 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4zX929xx.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4028 wrote to memory of 4804 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4zX929xx.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4028 wrote to memory of 4804 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4zX929xx.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4028 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4zX929xx.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4028 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4zX929xx.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4028 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4zX929xx.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4028 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4zX929xx.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4028 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4zX929xx.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4028 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4zX929xx.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4028 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4zX929xx.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4028 wrote to memory of 2296 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4zX929xx.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 804 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QH0eE74.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5te3xb1.exe
PID 804 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QH0eE74.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5te3xb1.exe
PID 804 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QH0eE74.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5te3xb1.exe
PID 1772 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5te3xb1.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 1772 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5te3xb1.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 1772 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5te3xb1.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 2992 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kN8pt06.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6AN4Vh6.exe
PID 2992 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kN8pt06.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6AN4Vh6.exe

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kN8pt06.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kN8pt06.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QH0eE74.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QH0eE74.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\XE5Cr14.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\XE5Cr14.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tp0kp22.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tp0kp22.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mi0BM65.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mi0BM65.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Oz08eN2.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Oz08eN2.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2lP3642.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2lP3642.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3Kn95LI.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3Kn95LI.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4780 -ip 4780

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 540

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4zX929xx.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4zX929xx.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5te3xb1.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5te3xb1.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6AN4Vh6.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6AN4Vh6.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Qm0LX47.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Qm0LX47.exe

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\DB7B.tmp\DB7C.tmp\DB7D.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Qm0LX47.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffbab8246f8,0x7ffbab824708,0x7ffbab824718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffbab8246f8,0x7ffbab824708,0x7ffbab824718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffbab8246f8,0x7ffbab824708,0x7ffbab824718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffbab8246f8,0x7ffbab824708,0x7ffbab824718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffbab8246f8,0x7ffbab824708,0x7ffbab824718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x150,0x170,0x7ffbab8246f8,0x7ffbab824708,0x7ffbab824718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffbab8246f8,0x7ffbab824708,0x7ffbab824718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,11020857479798936291,13809639510066139724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,11020857479798936291,13809639510066139724,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,4567638069521297696,1057714518114144402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,6980673125501343790,4822117499003300196,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,6980673125501343790,4822117499003300196,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2808 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,8724712294193657666,17022682358232340152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4276 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,363938573572789351,12154769728677907208,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffbab8246f8,0x7ffbab824708,0x7ffbab824718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0xfc,0x170,0x7ffbab8246f8,0x7ffbab824708,0x7ffbab824718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffbab8246f8,0x7ffbab824708,0x7ffbab824718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6820 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7172 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7512 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7512 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7712 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4344 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\1BB1.exe

C:\Users\Admin\AppData\Local\Temp\1BB1.exe

C:\Users\Admin\AppData\Local\Temp\1C9C.exe

C:\Users\Admin\AppData\Local\Temp\1C9C.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Mw5PR0bI.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Mw5PR0bI.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Qq1Im4YA.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Qq1Im4YA.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zs8mf1qB.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zs8mf1qB.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1DB6.bat" "

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\zj8LL1Re.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\zj8LL1Re.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Me19hA8.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Me19hA8.exe

C:\Users\Admin\AppData\Local\Temp\1F5D.exe

C:\Users\Admin\AppData\Local\Temp\1F5D.exe

C:\Users\Admin\AppData\Local\Temp\2058.exe

C:\Users\Admin\AppData\Local\Temp\2058.exe

C:\Users\Admin\AppData\Local\Temp\21F0.exe

C:\Users\Admin\AppData\Local\Temp\21F0.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffbab8246f8,0x7ffbab824708,0x7ffbab824718

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\2462.exe

C:\Users\Admin\AppData\Local\Temp\2462.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 648 -ip 648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8024 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2cX809La.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2cX809La.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6944 /prefetch:1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5168 -ip 5168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbab8246f8,0x7ffbab824708,0x7ffbab824718

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5168 -s 784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8500 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbab8246f8,0x7ffbab824708,0x7ffbab824718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7304 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbab8246f8,0x7ffbab824708,0x7ffbab824718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9208 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7184 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffbab8246f8,0x7ffbab824708,0x7ffbab824718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbab8246f8,0x7ffbab824708,0x7ffbab824718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7928 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8480 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbab8246f8,0x7ffbab824708,0x7ffbab824718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbab8246f8,0x7ffbab824708,0x7ffbab824718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9340 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9484 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=9008 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\4846.exe

C:\Users\Admin\AppData\Local\Temp\4846.exe

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x4e8 0x508

C:\Users\Admin\AppData\Local\Temp\4AF7.exe

C:\Users\Admin\AppData\Local\Temp\4AF7.exe

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\kos4.exe

"C:\Users\Admin\AppData\Local\Temp\kos4.exe"

C:\Users\Admin\AppData\Local\Temp\latestX.exe

"C:\Users\Admin\AppData\Local\Temp\latestX.exe"

C:\Users\Admin\AppData\Local\Temp\6630.exe

C:\Users\Admin\AppData\Local\Temp\6630.exe

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2252,12542925549969424010,16597683309848061454,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3024 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"

C:\Users\Admin\AppData\Local\Temp\is-RUICS.tmp\LzmwAqmV.tmp

"C:\Users\Admin\AppData\Local\Temp\is-RUICS.tmp\LzmwAqmV.tmp" /SL5="$800EC,2998240,68096,C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"

C:\Users\Admin\AppData\Local\Temp\6DF2.exe

C:\Users\Admin\AppData\Local\Temp\6DF2.exe

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\system32\schtasks.exe" /Delete /F /TN "LAC1031-1"

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Program Files (x86)\LAudioConverter\LAudioConverter.exe

"C:\Program Files (x86)\LAudioConverter\LAudioConverter.exe" -i

C:\Users\Admin\AppData\Local\Temp\7565.exe

C:\Users\Admin\AppData\Local\Temp\7565.exe

C:\Program Files (x86)\LAudioConverter\LAudioConverter.exe

"C:\Program Files (x86)\LAudioConverter\LAudioConverter.exe" -s

C:\Users\Admin\AppData\Local\Temp\7AA6.exe

C:\Users\Admin\AppData\Local\Temp\7AA6.exe

C:\Users\Admin\AppData\Local\Temp\8083.exe

C:\Users\Admin\AppData\Local\Temp\8083.exe

C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe

"C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "Utsysc.exe" /P "Admin:N"&&CACLS "Utsysc.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ea7c8244c8" /P "Admin:N"&&CACLS "..\ea7c8244c8" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cacls.exe

CACLS "Utsysc.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "Utsysc.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ea7c8244c8" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "..\ea7c8244c8" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4112 -ip 4112

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4112 -s 572

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\465dbc52837d81\cred64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\465dbc52837d81\cred64.dll, Main

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\465dbc52837d81\clip64.dll, Main

C:\Windows\system32\netsh.exe

netsh wlan show profiles

C:\Windows\system32\tar.exe

tar.exe -cf "C:\Users\Admin\AppData\Local\Temp\811856890180_Desktop.tar" "C:\Users\Admin\AppData\Local\Temp\_Files_\*.*"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\System32\schtasks.exe

C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"

C:\Program Files\Google\Chrome\updater.exe

"C:\Program Files\Google\Chrome\updater.exe"

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe

C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe

C:\Users\Admin\AppData\Roaming\fvftbtu

C:\Users\Admin\AppData\Roaming\fvftbtu

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

Network

Country Destination Domain Proto
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 126.177.238.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 39.142.81.104.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
RU 193.233.255.73:80 193.233.255.73 tcp
US 8.8.8.8:53 73.255.233.193.in-addr.arpa udp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 1.124.91.77.in-addr.arpa udp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 www.facebook.com udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 157.240.247.35:443 www.facebook.com tcp
US 8.8.8.8:53 www.epicgames.com udp
US 44.213.182.48:443 www.epicgames.com tcp
US 8.8.8.8:53 twitter.com udp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.247.240.157.in-addr.arpa udp
US 104.244.42.193:443 twitter.com tcp
US 8.8.8.8:53 store.steampowered.com udp
US 8.8.8.8:53 steamcommunity.com udp
NL 104.85.0.101:443 store.steampowered.com tcp
JP 23.207.106.113:443 steamcommunity.com tcp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 community.akamai.steamstatic.com udp
NL 23.72.252.169:443 community.akamai.steamstatic.com tcp
NL 23.72.252.169:443 community.akamai.steamstatic.com tcp
NL 23.72.252.169:443 community.akamai.steamstatic.com tcp
NL 23.72.252.169:443 community.akamai.steamstatic.com tcp
NL 23.72.252.169:443 community.akamai.steamstatic.com tcp
NL 23.72.252.169:443 community.akamai.steamstatic.com tcp
US 8.8.8.8:53 www.paypal.com udp
US 151.101.1.21:443 www.paypal.com tcp
US 8.8.8.8:53 apps.identrust.com udp
US 8.8.8.8:53 193.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 101.0.85.104.in-addr.arpa udp
US 8.8.8.8:53 48.182.213.44.in-addr.arpa udp
US 8.8.8.8:53 113.106.207.23.in-addr.arpa udp
US 8.8.8.8:53 162.47.239.18.in-addr.arpa udp
NL 88.221.25.169:80 apps.identrust.com tcp
US 8.8.8.8:53 169.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 21.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 169.25.221.88.in-addr.arpa udp
US 8.8.8.8:53 174.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 store.akamai.steamstatic.com udp
NL 23.72.252.176:443 store.akamai.steamstatic.com tcp
NL 23.72.252.176:443 store.akamai.steamstatic.com tcp
NL 23.72.252.176:443 store.akamai.steamstatic.com tcp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 131.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 176.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 tracking.epicgames.com udp
US 8.8.8.8:53 static-assets-prod.unrealengine.com udp
US 54.166.243.177:443 tracking.epicgames.com tcp
US 8.8.8.8:53 i.ytimg.com udp
US 18.239.36.22:443 static-assets-prod.unrealengine.com tcp
US 18.239.36.22:443 static-assets-prod.unrealengine.com tcp
NL 172.217.168.246:443 i.ytimg.com tcp
US 8.8.8.8:53 abs.twimg.com udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 8.8.8.8:53 pbs.twimg.com udp
US 8.8.8.8:53 api.twitter.com udp
US 152.199.21.141:443 abs.twimg.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 8.8.8.8:53 video.twimg.com udp
IE 163.70.151.21:443 static.xx.fbcdn.net tcp
IE 163.70.151.21:443 static.xx.fbcdn.net tcp
IE 163.70.151.21:443 static.xx.fbcdn.net tcp
NL 199.232.148.159:443 pbs.twimg.com tcp
US 104.244.42.66:443 api.twitter.com tcp
US 8.8.8.8:53 t.co udp
NL 199.232.148.158:443 video.twimg.com tcp
US 8.8.8.8:53 196.168.217.172.in-addr.arpa udp
US 152.199.21.141:443 abs.twimg.com tcp
US 8.8.8.8:53 www.paypalobjects.com udp
US 8.8.8.8:53 22.36.239.18.in-addr.arpa udp
US 104.244.42.69:443 t.co tcp
US 8.8.8.8:53 246.168.217.172.in-addr.arpa udp
US 152.199.21.141:443 abs.twimg.com tcp
US 8.8.8.8:53 177.243.166.54.in-addr.arpa udp
US 8.8.8.8:53 106.208.58.216.in-addr.arpa udp
US 8.8.8.8:53 141.21.199.152.in-addr.arpa udp
US 8.8.8.8:53 159.148.232.199.in-addr.arpa udp
US 8.8.8.8:53 21.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 66.42.244.104.in-addr.arpa udp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 8.8.8.8:53 static.ads-twitter.com udp
NL 199.232.148.157:443 static.ads-twitter.com tcp
US 8.8.8.8:53 158.148.232.199.in-addr.arpa udp
US 8.8.8.8:53 69.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 25.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 157.148.232.199.in-addr.arpa udp
US 192.229.221.25:443 www.paypalobjects.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 facebook.com udp
IE 163.70.151.35:443 facebook.com tcp
US 8.8.8.8:53 c.paypal.com udp
US 8.8.8.8:53 fbcdn.net udp
US 192.55.233.1:443 tcp
IE 163.70.151.35:443 fbcdn.net tcp
US 8.8.8.8:53 b.stats.paypal.com udp
US 64.4.245.84:443 b.stats.paypal.com tcp
US 192.55.233.1:443 tcp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 35.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 84.245.4.64.in-addr.arpa udp
US 8.8.8.8:53 www.recaptcha.net udp
NL 142.250.179.163:443 www.recaptcha.net tcp
US 8.8.8.8:53 dub.stats.paypal.com udp
US 64.4.245.84:443 dub.stats.paypal.com tcp
NL 142.250.179.163:443 www.recaptcha.net udp
US 8.8.8.8:53 t.paypal.com udp
US 151.101.1.35:443 t.paypal.com tcp
US 8.8.8.8:53 163.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 c6.paypal.com udp
US 151.101.1.35:443 c6.paypal.com tcp
NL 23.72.252.176:443 store.akamai.steamstatic.com tcp
NL 23.72.252.176:443 store.akamai.steamstatic.com tcp
NL 23.72.252.176:443 store.akamai.steamstatic.com tcp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
NL 142.251.36.14:443 play.google.com udp
NL 23.72.252.169:443 community.akamai.steamstatic.com tcp
NL 23.72.252.169:443 community.akamai.steamstatic.com tcp
NL 23.72.252.169:443 community.akamai.steamstatic.com tcp
US 8.8.8.8:53 29.68.91.77.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 14.36.251.142.in-addr.arpa udp
US 18.239.36.22:443 static-assets-prod.unrealengine.com tcp
RU 193.233.255.73:80 193.233.255.73 tcp
FI 77.91.68.249:80 77.91.68.249 tcp
US 8.8.8.8:53 249.68.91.77.in-addr.arpa udp
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
NL 194.169.175.118:80 194.169.175.118 tcp
FI 77.91.124.86:19084 tcp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 118.175.169.194.in-addr.arpa udp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
FI 77.91.124.86:19084 tcp
NL 104.85.0.101:443 store.steampowered.com tcp
JP 23.207.106.113:443 steamcommunity.com tcp
NL 172.217.168.246:443 i.ytimg.com udp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
NL 142.250.179.194:443 googleads.g.doubleclick.net tcp
NL 142.250.179.194:443 googleads.g.doubleclick.net udp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 api.steampowered.com udp
JP 23.207.106.113:443 api.steampowered.com tcp
US 8.8.8.8:53 194.179.250.142.in-addr.arpa udp
FI 77.91.124.71:4341 tcp
US 8.8.8.8:53 71.124.91.77.in-addr.arpa udp
US 8.8.8.8:53 yt3.ggpht.com udp
NL 142.251.36.1:443 yt3.ggpht.com tcp
US 8.8.8.8:53 iplogger.com udp
NL 142.251.36.1:443 yt3.ggpht.com udp
DE 148.251.234.93:443 iplogger.com tcp
US 8.8.8.8:53 i4.ytimg.com udp
DE 172.217.23.206:443 i4.ytimg.com tcp
US 8.8.8.8:53 stim.graspalace.com udp
US 188.114.96.0:80 stim.graspalace.com tcp
US 8.8.8.8:53 1.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 93.234.251.148.in-addr.arpa udp
US 8.8.8.8:53 206.23.217.172.in-addr.arpa udp
US 8.8.8.8:53 0.96.114.188.in-addr.arpa udp
BG 171.22.28.213:80 171.22.28.213 tcp
US 8.8.8.8:53 rr1---sn-4g5lznek.googlevideo.com udp
DE 74.125.162.38:443 rr1---sn-4g5lznek.googlevideo.com tcp
DE 74.125.162.38:443 rr1---sn-4g5lznek.googlevideo.com tcp
US 8.8.8.8:53 213.28.22.171.in-addr.arpa udp
US 8.8.8.8:53 38.162.125.74.in-addr.arpa udp
DE 74.125.162.38:443 rr1---sn-4g5lznek.googlevideo.com udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
NL 142.250.179.138:443 jnn-pa.googleapis.com tcp
US 149.40.62.171:15666 tcp
NL 142.250.179.138:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 api.ipify.org udp
US 8.8.8.8:53 138.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 171.62.40.149.in-addr.arpa udp
US 173.231.16.77:443 api.ipify.org tcp
IT 185.196.9.171:80 185.196.9.171 tcp
US 8.8.8.8:53 77.16.231.173.in-addr.arpa udp
US 8.8.8.8:53 171.9.196.185.in-addr.arpa udp
US 8.8.8.8:53 static.doubleclick.net udp
NL 142.251.36.6:443 static.doubleclick.net tcp
NL 142.251.36.6:443 static.doubleclick.net tcp
NL 194.169.175.235:42691 tcp
US 8.8.8.8:53 6.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 23.149.64.172.in-addr.arpa udp
US 194.49.94.11:80 194.49.94.11 tcp
US 8.8.8.8:53 youtube.com udp
NL 216.58.214.14:443 youtube.com tcp
US 8.8.8.8:53 11.94.49.194.in-addr.arpa udp
US 8.8.8.8:53 233.38.18.104.in-addr.arpa udp
US 8.8.8.8:53 14.214.58.216.in-addr.arpa udp
FI 77.91.124.86:19084 tcp
FI 77.91.124.86:19084 tcp
FI 77.91.124.1:80 77.91.124.1 tcp
US 185.196.8.176:80 185.196.8.176 tcp
US 185.196.8.176:80 185.196.8.176 tcp
US 8.8.8.8:53 176.8.196.185.in-addr.arpa udp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.13.31:443 api.ip.sb tcp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 login.steampowered.com udp
JP 23.207.106.113:443 login.steampowered.com tcp
US 8.8.8.8:53 31.13.26.104.in-addr.arpa udp
US 185.196.8.176:80 185.196.8.176 tcp
US 8.8.8.8:53 rr3---sn-4g5ednd7.googlevideo.com udp
DE 74.125.162.104:443 rr3---sn-4g5ednd7.googlevideo.com udp
US 8.8.8.8:53 104.162.125.74.in-addr.arpa udp
NL 142.250.179.141:443 accounts.google.com udp
US 185.196.8.176:80 185.196.8.176 tcp
US 8.8.8.8:53 sentry.io udp
US 35.186.247.156:443 sentry.io tcp
US 8.8.8.8:53 156.247.186.35.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com udp
NL 194.169.175.235:42691 tcp
US 8.8.8.8:53 www.paypal.com udp
US 8.8.8.8:53 www.paypalobjects.com udp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 www.recaptcha.net udp
NL 142.250.179.163:443 www.recaptcha.net udp
NL 142.250.179.163:443 www.recaptcha.net tcp
US 8.8.8.8:53 accounts.google.com udp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 talon-website-prod.ecosec.on.epicgames.com udp
US 104.18.41.136:443 talon-website-prod.ecosec.on.epicgames.com tcp
US 8.8.8.8:53 136.41.18.104.in-addr.arpa udp
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 host-host-file8.com udp
US 95.214.26.28:80 host-host-file8.com tcp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 28.26.214.95.in-addr.arpa udp
US 8.8.8.8:53 i.ytimg.com udp
NL 172.217.168.246:443 i.ytimg.com udp
US 8.8.8.8:53 rr1---sn-4g5lznek.googlevideo.com udp
DE 74.125.162.38:443 rr1---sn-4g5lznek.googlevideo.com udp
US 8.8.8.8:53 3e72c1ae-8b9e-40ea-9222-7354db267a2e.uuid.statsexplorer.org udp
US 192.55.233.1:443 tcp
US 192.55.233.1:443 tcp
US 8.8.8.8:53 api.twitter.com udp
US 104.244.42.130:443 api.twitter.com tcp
US 104.244.42.130:443 api.twitter.com tcp
US 8.8.8.8:53 abs.twimg.com udp
US 152.199.21.141:443 abs.twimg.com tcp
US 104.244.42.130:443 api.twitter.com tcp
US 8.8.8.8:53 130.42.244.104.in-addr.arpa udp
NL 194.169.175.235:42691 tcp
US 8.8.8.8:53 194.168.217.172.in-addr.arpa udp
US 8.8.8.8:53 www.epicgames.com udp
US 18.213.79.25:443 www.epicgames.com tcp
US 8.8.8.8:53 c.paypal.com udp
US 8.8.8.8:53 25.79.213.18.in-addr.arpa udp
US 8.8.8.8:53 b.stats.paypal.com udp
US 64.4.245.84:443 b.stats.paypal.com tcp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 dub.stats.paypal.com udp
US 64.4.245.84:443 dub.stats.paypal.com tcp
US 8.8.8.8:53 sentry.io udp
US 35.186.247.156:443 sentry.io udp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 server13.statsexplorer.org udp
US 8.8.8.8:53 stun1.l.google.com udp
US 8.8.8.8:53 cdn.discordapp.com udp
BG 185.82.216.108:443 server13.statsexplorer.org tcp
US 162.159.135.233:443 cdn.discordapp.com tcp
US 142.251.125.127:19302 stun1.l.google.com udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kN8pt06.exe

MD5 33d0723543360bae517999cca46c5402
SHA1 4729e931fbee9f9204b0091d00eb597a89f9c0c6
SHA256 ed259935baeb7073474d731c090a28bea8ad0d602a837ae9ed8f7dbae3bf33f7
SHA512 35024b69248f737de3665a9c89152c892d73c617d3e569279ab10b56d423392e55bc3eefdd53d0a92926189d8b43c65195349c8d42b6b192d10694f2574efd47

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kN8pt06.exe

MD5 33d0723543360bae517999cca46c5402
SHA1 4729e931fbee9f9204b0091d00eb597a89f9c0c6
SHA256 ed259935baeb7073474d731c090a28bea8ad0d602a837ae9ed8f7dbae3bf33f7
SHA512 35024b69248f737de3665a9c89152c892d73c617d3e569279ab10b56d423392e55bc3eefdd53d0a92926189d8b43c65195349c8d42b6b192d10694f2574efd47

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QH0eE74.exe

MD5 38d8fb01c22e27eca2dca15abc82ad6a
SHA1 599ecccf5d93c9a6bd301d1a00eac73859eccb4d
SHA256 d3fd2372364a1e18cb613fc95854b6d4576642b9a5865633e3ea7b104e56341e
SHA512 b0b9c68f80ef5b42b4eb074563655c59f41afc629a8672e6c44260be853b00f375697d36ba12197895c9a826aec3b8b00d547c4fb43508db81092c4e58548b24

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QH0eE74.exe

MD5 38d8fb01c22e27eca2dca15abc82ad6a
SHA1 599ecccf5d93c9a6bd301d1a00eac73859eccb4d
SHA256 d3fd2372364a1e18cb613fc95854b6d4576642b9a5865633e3ea7b104e56341e
SHA512 b0b9c68f80ef5b42b4eb074563655c59f41afc629a8672e6c44260be853b00f375697d36ba12197895c9a826aec3b8b00d547c4fb43508db81092c4e58548b24

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\XE5Cr14.exe

MD5 fc744a18bbd410beaa7b3edfb8f3a8a3
SHA1 a3ac3159c1deb0964f6548b5114c6d9f955a571a
SHA256 9f83e5c680b12aec1700fde1695617e3ce94b13858011072d1a48014d88dc099
SHA512 06ffc055362e8619d17fe0593069465dee44ee69db140f7c2089ae106108015398132502ffb2fef70e55f9b1d55ee48c93c97be3994030a8f21030243226f8ef

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\XE5Cr14.exe

MD5 fc744a18bbd410beaa7b3edfb8f3a8a3
SHA1 a3ac3159c1deb0964f6548b5114c6d9f955a571a
SHA256 9f83e5c680b12aec1700fde1695617e3ce94b13858011072d1a48014d88dc099
SHA512 06ffc055362e8619d17fe0593069465dee44ee69db140f7c2089ae106108015398132502ffb2fef70e55f9b1d55ee48c93c97be3994030a8f21030243226f8ef

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tp0kp22.exe

MD5 22aea9275e1f0f7ec4ff922f2a7e9f9a
SHA1 ae5c4c5248a103a99bee189e9ea7ec88497981a4
SHA256 db7b6b5c814300be76ccbb9f74ddc77f84df5e1fd2236a89c4f37e3f019cb0b1
SHA512 cfe19f4ea5458198facfbdc0fc42fab8b30d46037c5c580b666efd8345a9aae51f37215d99213c2f60161713fa486572d2c61dcf7eb27caa7fed01485aeb6886

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tp0kp22.exe

MD5 22aea9275e1f0f7ec4ff922f2a7e9f9a
SHA1 ae5c4c5248a103a99bee189e9ea7ec88497981a4
SHA256 db7b6b5c814300be76ccbb9f74ddc77f84df5e1fd2236a89c4f37e3f019cb0b1
SHA512 cfe19f4ea5458198facfbdc0fc42fab8b30d46037c5c580b666efd8345a9aae51f37215d99213c2f60161713fa486572d2c61dcf7eb27caa7fed01485aeb6886

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mi0BM65.exe

MD5 6d23a627983f20db8ce2c5ead158657e
SHA1 56edd9d4d3c8f5d579ff73e12658f4c574ec1e2d
SHA256 454e519643204ec3b80f3a7f5d7219d3a356e77e24c7f58e39be9d46956ea328
SHA512 734801390042a58ee66fb0c79a51d087745110023d6be5fb8ed050f792b6ef38f23e0a0011fdb618e0effc072b0688347ec1051b053f7c455eedee48c203807c

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mi0BM65.exe

MD5 6d23a627983f20db8ce2c5ead158657e
SHA1 56edd9d4d3c8f5d579ff73e12658f4c574ec1e2d
SHA256 454e519643204ec3b80f3a7f5d7219d3a356e77e24c7f58e39be9d46956ea328
SHA512 734801390042a58ee66fb0c79a51d087745110023d6be5fb8ed050f792b6ef38f23e0a0011fdb618e0effc072b0688347ec1051b053f7c455eedee48c203807c

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Oz08eN2.exe

MD5 8a44e55728cf15b6767329725d120625
SHA1 d4b003917d1c89c9d453ac15227f7893199bc7a6
SHA256 63038cebbd6f3f501202b4a7166ca57c8fbcf3a12e7f95ae032afce53e5fd4b3
SHA512 82a1c25002436ec399a1285f48da20aa5a43af9e8911ee395dab9c2ecd19ff08cefada8ffa170e18f330cbe56cf09032acefd2bbf3d730aaccacd9b49df69411

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Oz08eN2.exe

MD5 8a44e55728cf15b6767329725d120625
SHA1 d4b003917d1c89c9d453ac15227f7893199bc7a6
SHA256 63038cebbd6f3f501202b4a7166ca57c8fbcf3a12e7f95ae032afce53e5fd4b3
SHA512 82a1c25002436ec399a1285f48da20aa5a43af9e8911ee395dab9c2ecd19ff08cefada8ffa170e18f330cbe56cf09032acefd2bbf3d730aaccacd9b49df69411

memory/3048-42-0x0000000000400000-0x000000000040A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2lP3642.exe

MD5 1b5fa28e7b8a7674248e2b7153861721
SHA1 f0ec96480bb21cd5458be5757983c2c2c3bc3538
SHA256 3a104e8ea56466f176f0e0b07ed901c817300bfb9d5cc4dbd37fc130ceacc044
SHA512 b706591a5276f72559a418b90d312a5838e9a2fb1c7c68e42f24a98572bce4680b6a059b0889111b173fb0576d2042a569257d043d70ed61cf8c8958e7b46169

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2lP3642.exe

MD5 1b5fa28e7b8a7674248e2b7153861721
SHA1 f0ec96480bb21cd5458be5757983c2c2c3bc3538
SHA256 3a104e8ea56466f176f0e0b07ed901c817300bfb9d5cc4dbd37fc130ceacc044
SHA512 b706591a5276f72559a418b90d312a5838e9a2fb1c7c68e42f24a98572bce4680b6a059b0889111b173fb0576d2042a569257d043d70ed61cf8c8958e7b46169

memory/3048-46-0x0000000073DD0000-0x0000000074580000-memory.dmp

memory/4780-47-0x0000000000400000-0x0000000000434000-memory.dmp

memory/4780-48-0x0000000000400000-0x0000000000434000-memory.dmp

memory/4780-49-0x0000000000400000-0x0000000000434000-memory.dmp

memory/4780-51-0x0000000000400000-0x0000000000434000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3Kn95LI.exe

MD5 64a07155db91d8c7220559ceebfd1d21
SHA1 42bc213cc7aa56a2927ad3218dc3bef9547d0edb
SHA256 7e37fa625d3cf122994b91943c8a9258aff1ffc6b94c125c512927720cd3be77
SHA512 dfdaa6b933afea056762c788a5d565b046746cd7ea17317a776160a7f1749a8224421283a8e900d567dbb3da36746190d34e359da09838f06b025013d27b90a7

memory/2996-54-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3Kn95LI.exe

MD5 64a07155db91d8c7220559ceebfd1d21
SHA1 42bc213cc7aa56a2927ad3218dc3bef9547d0edb
SHA256 7e37fa625d3cf122994b91943c8a9258aff1ffc6b94c125c512927720cd3be77
SHA512 dfdaa6b933afea056762c788a5d565b046746cd7ea17317a776160a7f1749a8224421283a8e900d567dbb3da36746190d34e359da09838f06b025013d27b90a7

memory/3248-56-0x0000000000F20000-0x0000000000F36000-memory.dmp

memory/2996-57-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4zX929xx.exe

MD5 8c8080515816fb1ab67e98f0330aa654
SHA1 ff418f2bb16b4be8c33d642fecaad3e1f8739494
SHA256 4cc8619418a0f70d54942b81c99cb939a5467e818e6ddeeecce8c343aed6569b
SHA512 1b05f892dc02d1f95866fd31a9e633a7c47496c2a740f70e5afa14fdc6e8116a2e248f159ceb5acd43e25d6e82950278719a82337e46cf185fc021ae3bc49976

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4zX929xx.exe

MD5 8c8080515816fb1ab67e98f0330aa654
SHA1 ff418f2bb16b4be8c33d642fecaad3e1f8739494
SHA256 4cc8619418a0f70d54942b81c99cb939a5467e818e6ddeeecce8c343aed6569b
SHA512 1b05f892dc02d1f95866fd31a9e633a7c47496c2a740f70e5afa14fdc6e8116a2e248f159ceb5acd43e25d6e82950278719a82337e46cf185fc021ae3bc49976

memory/2296-63-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5te3xb1.exe

MD5 44f8730764687fdc5b27362f2b578b32
SHA1 372a7207283090b2e0ca6580ed76a87e8593d66c
SHA256 d6780e515a8143aa9d8097deae4cba874790690f6743c51f8e03a1af4cf7c0b8
SHA512 d57d5de17a6580956a6ab81d95da0e0d28756f51025f0f193c643d8a4e175c00b6b79fb1601cc2f9c08194754fc56679f5c8a8bb005fca59437743ae0ddebc84

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5te3xb1.exe

MD5 44f8730764687fdc5b27362f2b578b32
SHA1 372a7207283090b2e0ca6580ed76a87e8593d66c
SHA256 d6780e515a8143aa9d8097deae4cba874790690f6743c51f8e03a1af4cf7c0b8
SHA512 d57d5de17a6580956a6ab81d95da0e0d28756f51025f0f193c643d8a4e175c00b6b79fb1601cc2f9c08194754fc56679f5c8a8bb005fca59437743ae0ddebc84

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 44f8730764687fdc5b27362f2b578b32
SHA1 372a7207283090b2e0ca6580ed76a87e8593d66c
SHA256 d6780e515a8143aa9d8097deae4cba874790690f6743c51f8e03a1af4cf7c0b8
SHA512 d57d5de17a6580956a6ab81d95da0e0d28756f51025f0f193c643d8a4e175c00b6b79fb1601cc2f9c08194754fc56679f5c8a8bb005fca59437743ae0ddebc84

memory/2296-69-0x0000000073DD0000-0x0000000074580000-memory.dmp

memory/2296-70-0x00000000078F0000-0x0000000007E94000-memory.dmp

memory/2296-71-0x0000000007420000-0x00000000074B2000-memory.dmp

memory/2296-73-0x0000000007660000-0x0000000007670000-memory.dmp

memory/2296-77-0x00000000075C0000-0x00000000075CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 44f8730764687fdc5b27362f2b578b32
SHA1 372a7207283090b2e0ca6580ed76a87e8593d66c
SHA256 d6780e515a8143aa9d8097deae4cba874790690f6743c51f8e03a1af4cf7c0b8
SHA512 d57d5de17a6580956a6ab81d95da0e0d28756f51025f0f193c643d8a4e175c00b6b79fb1601cc2f9c08194754fc56679f5c8a8bb005fca59437743ae0ddebc84

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 44f8730764687fdc5b27362f2b578b32
SHA1 372a7207283090b2e0ca6580ed76a87e8593d66c
SHA256 d6780e515a8143aa9d8097deae4cba874790690f6743c51f8e03a1af4cf7c0b8
SHA512 d57d5de17a6580956a6ab81d95da0e0d28756f51025f0f193c643d8a4e175c00b6b79fb1601cc2f9c08194754fc56679f5c8a8bb005fca59437743ae0ddebc84

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6AN4Vh6.exe

MD5 54b85e3284fa3138a477a750cbbaf8b8
SHA1 983e3e2a725733f3fe6984e8c0ced39bf4f40619
SHA256 0aa46e647057072016c6fb44d7a9df087b8273204c42e3ed1cbcb48755c564c5
SHA512 0db9511804cc325fa3d46ea39475244d4c7ba8a12f7ca5075c5f9273106f6387422b43f730cd515bc7fc68979834398fbf15c5e75abc2043de4f1f9d80941ae4

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6AN4Vh6.exe

MD5 54b85e3284fa3138a477a750cbbaf8b8
SHA1 983e3e2a725733f3fe6984e8c0ced39bf4f40619
SHA256 0aa46e647057072016c6fb44d7a9df087b8273204c42e3ed1cbcb48755c564c5
SHA512 0db9511804cc325fa3d46ea39475244d4c7ba8a12f7ca5075c5f9273106f6387422b43f730cd515bc7fc68979834398fbf15c5e75abc2043de4f1f9d80941ae4

memory/2296-84-0x00000000084C0000-0x0000000008AD8000-memory.dmp

memory/2296-85-0x0000000007780000-0x000000000788A000-memory.dmp

memory/2296-86-0x00000000076B0000-0x00000000076C2000-memory.dmp

memory/2296-87-0x0000000007710000-0x000000000774C000-memory.dmp

memory/2296-88-0x0000000007890000-0x00000000078DC000-memory.dmp

memory/3048-89-0x0000000073DD0000-0x0000000074580000-memory.dmp

memory/3048-91-0x0000000073DD0000-0x0000000074580000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Qm0LX47.exe

MD5 3a82085632eb1f75702852d770af9c5a
SHA1 2da7d371d489763cb613f7d3e44a1e2e65f946f8
SHA256 dd734bad74b47911174c04d43510bd8a659752a4c7b42e8a3bfc2e53ef154ff2
SHA512 4b6606b855b1b32bba9f87354059357a3906e7042b7b0545bf06d7df3ccb6ca0d5c2d6a70dc03318f3211d8c0b15b9eab6b458e226c1738123b73e3e0c0c7fdf

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Qm0LX47.exe

MD5 3a82085632eb1f75702852d770af9c5a
SHA1 2da7d371d489763cb613f7d3e44a1e2e65f946f8
SHA256 dd734bad74b47911174c04d43510bd8a659752a4c7b42e8a3bfc2e53ef154ff2
SHA512 4b6606b855b1b32bba9f87354059357a3906e7042b7b0545bf06d7df3ccb6ca0d5c2d6a70dc03318f3211d8c0b15b9eab6b458e226c1738123b73e3e0c0c7fdf

C:\Users\Admin\AppData\Local\Temp\DB7B.tmp\DB7C.tmp\DB7D.bat

MD5 0769624c4307afb42ff4d8602d7815ec
SHA1 786853c829f4967a61858c2cdf4891b669ac4df9
SHA256 7da27df04c56cf1aa11d427d9a3dff48b0d0df8c11f7090eb849abee6bfe421f
SHA512 df8e4c6e50c74f5daf89b3585a98980ac1dbacf4cce641571f8999e4263078e5d14863dae9cf64be4c987671a21ebdce3bf8e210715f68c5e383cc4d55f53106

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 16e56f576d6ace85337e8c07ec00c0bf
SHA1 5c9579bb4975c93a69d1336eed5f05013dc35b9c
SHA256 7796a7ba79148fc3cb46e4bbca48094376371ca9dd66f0810f7797c5e24158f5
SHA512 69e89f39fa6438a74a48985387cd2e3e003858b0855ee6cd03abf6967674503b98b90573c784b4cf785b9cca594d3c8762f92def24e2bf51374ef5a00921e5e2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 16e56f576d6ace85337e8c07ec00c0bf
SHA1 5c9579bb4975c93a69d1336eed5f05013dc35b9c
SHA256 7796a7ba79148fc3cb46e4bbca48094376371ca9dd66f0810f7797c5e24158f5
SHA512 69e89f39fa6438a74a48985387cd2e3e003858b0855ee6cd03abf6967674503b98b90573c784b4cf785b9cca594d3c8762f92def24e2bf51374ef5a00921e5e2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0629525c94f6548880f5f3a67846755e
SHA1 40ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256 812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512 f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0629525c94f6548880f5f3a67846755e
SHA1 40ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256 812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512 f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0629525c94f6548880f5f3a67846755e
SHA1 40ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256 812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512 f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0629525c94f6548880f5f3a67846755e
SHA1 40ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256 812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512 f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0629525c94f6548880f5f3a67846755e
SHA1 40ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256 812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512 f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0629525c94f6548880f5f3a67846755e
SHA1 40ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256 812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512 f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0629525c94f6548880f5f3a67846755e
SHA1 40ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256 812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512 f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0629525c94f6548880f5f3a67846755e
SHA1 40ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256 812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512 f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0629525c94f6548880f5f3a67846755e
SHA1 40ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256 812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512 f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0629525c94f6548880f5f3a67846755e
SHA1 40ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256 812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512 f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

\??\pipe\LOCAL\crashpad_3652_CEKAZAGSVUGGXPLA

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0629525c94f6548880f5f3a67846755e
SHA1 40ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256 812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512 f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0629525c94f6548880f5f3a67846755e
SHA1 40ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256 812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512 f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0629525c94f6548880f5f3a67846755e
SHA1 40ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256 812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512 f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0629525c94f6548880f5f3a67846755e
SHA1 40ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256 812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512 f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 9fa5c0005fcc75ce3d5aafce106bf57a
SHA1 3fdf62d8ab6cc9974c571a80bf6cf837347b29e8
SHA256 a69dda3b5236064b60497bcb410a0b3a184fe7d8a88d9c005727b23042214f27
SHA512 4a3938cdc3d9aefc58b1addce08df97690ceeb890d3f3dc7c58635cba03a95a9483840652b8a4854409241545b27248868022b52648cc387724531a7788398b6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0629525c94f6548880f5f3a67846755e
SHA1 40ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256 812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512 f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 fcc86dc5274a53cf213930a972d2e49a
SHA1 8d6290c739eb034623bba9ab2297fcbace052540
SHA256 9b1663a1287a9fb1e4e6956563095e5b52fd04cb71434db7f0170b3efb682077
SHA512 4efdd2930ff1218adb19aaabe73bed0dec1f9fc251227f09c28d97857f2616b4090f539bf84bc05484c6eb85b973a157f96ca7aadd7462f1b76b5ef349741028

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 9fa5c0005fcc75ce3d5aafce106bf57a
SHA1 3fdf62d8ab6cc9974c571a80bf6cf837347b29e8
SHA256 a69dda3b5236064b60497bcb410a0b3a184fe7d8a88d9c005727b23042214f27
SHA512 4a3938cdc3d9aefc58b1addce08df97690ceeb890d3f3dc7c58635cba03a95a9483840652b8a4854409241545b27248868022b52648cc387724531a7788398b6

\??\pipe\LOCAL\crashpad_3712_FADLNQSXCQMNLKXY

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0629525c94f6548880f5f3a67846755e
SHA1 40ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256 812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512 f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 f107d933c34b258fc01019a2b3e21ac3
SHA1 c49c26a20104df67d3d01532f94c33854577da74
SHA256 0253cacef1bc5a66240120689af3f6cf8f358b1f49d2a8b4b230a57114bdc60c
SHA512 4bab0876c7455378df4ff9dca7405011386c882817a15cbb440f22b5197b4477b52fee3172c3bfb3db41f20d2ce19928ac44670baf918fb662e19607a6ffecbb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 62e8be1aeeeeed82eafdbdeb10722d32
SHA1 7506239fdf76b5a7ee8ca312f251fea6de0ff105
SHA256 684fa71b72e77e48064ee636403916eb0e270cf94b8d715e35bfcfd828f2ec9d
SHA512 2954cc26c5bdb1997b1024d013a9c464874f4b84a9568d7b8e44a57f37913b940b26c624ac9b71becc8e625e0cca7c7e345d1b989cc0ff61c2c509ab7ec73ef9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 62e8be1aeeeeed82eafdbdeb10722d32
SHA1 7506239fdf76b5a7ee8ca312f251fea6de0ff105
SHA256 684fa71b72e77e48064ee636403916eb0e270cf94b8d715e35bfcfd828f2ec9d
SHA512 2954cc26c5bdb1997b1024d013a9c464874f4b84a9568d7b8e44a57f37913b940b26c624ac9b71becc8e625e0cca7c7e345d1b989cc0ff61c2c509ab7ec73ef9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 fcc86dc5274a53cf213930a972d2e49a
SHA1 8d6290c739eb034623bba9ab2297fcbace052540
SHA256 9b1663a1287a9fb1e4e6956563095e5b52fd04cb71434db7f0170b3efb682077
SHA512 4efdd2930ff1218adb19aaabe73bed0dec1f9fc251227f09c28d97857f2616b4090f539bf84bc05484c6eb85b973a157f96ca7aadd7462f1b76b5ef349741028

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0629525c94f6548880f5f3a67846755e
SHA1 40ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256 812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512 f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

\??\pipe\LOCAL\crashpad_4452_VIPHNPOBFPLDTVDE

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0629525c94f6548880f5f3a67846755e
SHA1 40ef667fc04bb1c0ae4bf2c17ded88594f0f4423
SHA256 812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee
SHA512 f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6cb0c7740860aebf5f0ed058a19ea1f3
SHA1 90d8faa7f1311ab7e305d626c787f4200681ef19
SHA256 a98ee5684916661413a2b23fc93e1f93ef6bee4a68d81f89ffcad668e93af429
SHA512 1da2c8f0e9aed8ba928fa4f871ed370e8447d0bfee8100333cbc7699fbc726832c8833b97c16d72837656c3d97d0d10e7afaf0c3b21a0cefcfb3ffdf8685d6a7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 f107d933c34b258fc01019a2b3e21ac3
SHA1 c49c26a20104df67d3d01532f94c33854577da74
SHA256 0253cacef1bc5a66240120689af3f6cf8f358b1f49d2a8b4b230a57114bdc60c
SHA512 4bab0876c7455378df4ff9dca7405011386c882817a15cbb440f22b5197b4477b52fee3172c3bfb3db41f20d2ce19928ac44670baf918fb662e19607a6ffecbb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b9212fbe958e2565a7be2b03a4a5dfbc
SHA1 748b902f20816e2e759f572120599c8f43975d1e
SHA256 9da9a042417f2496e8389f66b2655bf34dcfc8facf60aa2e554a5f27b49c6652
SHA512 f4b75a322c9bbd8e5c363ab4303d437a0bc0e8fd5aa3a87d90eef77f10e6cddfe26af64527b0b3ff9d983165acc5ccab96277976bad2ac9bb618efeabadd9a30

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6cb0c7740860aebf5f0ed058a19ea1f3
SHA1 90d8faa7f1311ab7e305d626c787f4200681ef19
SHA256 a98ee5684916661413a2b23fc93e1f93ef6bee4a68d81f89ffcad668e93af429
SHA512 1da2c8f0e9aed8ba928fa4f871ed370e8447d0bfee8100333cbc7699fbc726832c8833b97c16d72837656c3d97d0d10e7afaf0c3b21a0cefcfb3ffdf8685d6a7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 9fa5c0005fcc75ce3d5aafce106bf57a
SHA1 3fdf62d8ab6cc9974c571a80bf6cf837347b29e8
SHA256 a69dda3b5236064b60497bcb410a0b3a184fe7d8a88d9c005727b23042214f27
SHA512 4a3938cdc3d9aefc58b1addce08df97690ceeb890d3f3dc7c58635cba03a95a9483840652b8a4854409241545b27248868022b52648cc387724531a7788398b6

memory/2296-333-0x0000000073DD0000-0x0000000074580000-memory.dmp

memory/2296-371-0x0000000007660000-0x0000000007670000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

MD5 a5c3c60ee66c5eee4d68fdcd1e70a0f8
SHA1 679c2d0f388fcf61ecc2a0d735ef304b21e428d2
SHA256 a77e911505d857000f49f47d29f28399475324bbf89c5c77066e9f9aca4dd234
SHA512 5a4f5a1e0de5e650ca4b56bfd8e6830b98272a74d75610ed6e2f828f47cdf8447fbc5d8404bcf706ca95e5833e7c255f251137855723b531d12cbc450062750a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

MD5 923a543cc619ea568f91b723d9fb1ef0
SHA1 6f4ade25559645c741d7327c6e16521e43d7e1f9
SHA256 bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd
SHA512 a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

MD5 7d75a9eb3b38b5dd04b8a7ce4f1b87cc
SHA1 68f598c84936c9720c5ffd6685294f5c94000dff
SHA256 6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7
SHA512 cf0488c34a1af36b1bb854dea2decfc8394f47831b1670cab3eed8291b61188484cc8ab0a726a524ecdd20b71d291bcccbc2ce999fd91662aca63d2d22ed0d9f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

MD5 a6056708f2b40fe06e76df601fdc666a
SHA1 542f2a7be8288e26f08f55216e0c32108486c04c
SHA256 fe8009d99826585803f561c9d7b01c95ec4a666e92fedb2c1ca6fa0f50bb7152
SHA512 e83e64d00199a51c1f17faca3012f6f28ad54e5ac48acea6509cccdd61ddb08b03c3a895776944190a4e261393b90f9f516ad64b1b0e4cdd88a66f6f691331a4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 377af91811eb4abd6dd33068179a3c55
SHA1 35b478e4c57a61831906846451e6a319b550a83d
SHA256 15fd462b75905836eac20e224d421345fb69f70eb26972206fd0c830c840305b
SHA512 5011cffc95046cf53dd7fe50d5b34ead164d2a4aa093f384818ed3af116de8b60d206b46ae360318e0fd6be0b0c8e84c30f3f878a36c8e9cf35fc643c39ddbbe

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 2f2416d0649d14c798fdad403189779e
SHA1 3ea8015fb37fd3405a5eb7035072dca61acab5b4
SHA256 1e6e5067fbeb61f79b98200dd0e113a79ab596abcdd73b09f73293d56595bdda
SHA512 85e93f67f56362fe53524e669e7fc3cfed29653e7c66b19c5a69b3fe6c2cc407d4096215c82cee60fdeff3c4ec41f1a60e3d89e0c9c3da58027e34f63f69fcaa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 fd20981c7184673929dfcab50885629b
SHA1 14c2437aad662b119689008273844bac535f946c
SHA256 28b7a1e7b492fff3e5268a6cd480721f211ceb6f2f999f3698b3b8cbd304bb22
SHA512 b99520bbca4d2b39f8bedb59944ad97714a3c9b8a87393719f1cbc40ed63c5834979f49346d31072c4d354c612ab4db9bf7f16e7c15d6802c9ea507d8c46af75

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

MD5 990324ce59f0281c7b36fb9889e8887f
SHA1 35abc926cbea649385d104b1fd2963055454bf27
SHA256 67bcedd3040fc55d968bbe21df05c02b731181541aff4ae72b9205300a4a3ecc
SHA512 31e83da1ac217d25be6e7f35a041881b926f731fff69db6f144e4fe99b696a31f9ab7766ca22cf5a482743c2a2d00a699ca2c2d67837a86c471a2dd3bed9ea1f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6go51Hy.exe

MD5 41e46570e1c12f68fb88333e8b21b51c
SHA1 25b9373fc1aaa52426f483ffcc0de06f32807b9f
SHA256 e4a34c622947151b9083ed4e21ba96fd582766ea3e715c98311983e6db61e27c
SHA512 2a74be7ea50405de94dd5ba19954688a5512b2f2ba3384aaa4cbc7042336737a3c9b1a5ddb4987a99015656c8852b3b6332f681e03c09738418faf8208133ce2

C:\Users\Admin\AppData\Local\Temp\1C9C.exe

MD5 e561df80d8920ae9b152ddddefd13c7c
SHA1 0d020453f62d2188f7a0e55442af5d75e16e7caf
SHA256 5484ca53027230772ae149e3d7684b7e322432ceb013b6bc2440bd3c269192ea
SHA512 a7afed5a6434f296f0e0186de8ce87245bbd0f264498e327188a93551dd45e0e67409e62f3477b526ab5b0927e4349ad66107cbea7f7554b4be53c18227741a5

memory/2360-652-0x0000000073DD0000-0x0000000074580000-memory.dmp

memory/1772-655-0x0000000000DD0000-0x0000000000DDA000-memory.dmp

memory/1772-656-0x0000000073DD0000-0x0000000074580000-memory.dmp

memory/2360-657-0x0000000006EF0000-0x0000000006F00000-memory.dmp

memory/648-661-0x0000000000400000-0x0000000000434000-memory.dmp

memory/648-667-0x0000000000400000-0x0000000000434000-memory.dmp

memory/648-662-0x0000000000400000-0x0000000000434000-memory.dmp

memory/5196-671-0x00000000006E0000-0x000000000071E000-memory.dmp

memory/5196-672-0x0000000073DD0000-0x0000000074580000-memory.dmp

memory/5196-674-0x0000000007690000-0x00000000076A0000-memory.dmp

memory/5168-687-0x0000000000400000-0x0000000000480000-memory.dmp

memory/5168-705-0x0000000000480000-0x00000000004DA000-memory.dmp

memory/5168-761-0x0000000073DD0000-0x0000000074580000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

MD5 b24045e033655badfcc5b3292df544fb
SHA1 7869c0742b4d5cd8f1341bb061ac6c8c8cf8544b
SHA256 ce60e71ab0f5a6f0a61ee048ff379b355d72cd01fda773380b4b474b4273ec6c
SHA512 0496eab064778fe47802d7f79a536022de4a89d085457ad0d092597f93e19653f750b86f5649768e18f631505ff9792c421ba3a14b9d30522d731b5cd3d8206c

memory/5168-831-0x0000000000400000-0x0000000000480000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

MD5 9ee8d611a9369b4a54ca085c0439120c
SHA1 74ac1126b6d7927ec555c5b4dc624f57d17df7bb
SHA256 e4cf7a17182adf614419d07a906cacf03b413bc51a98aacbcfc8b8da47f8581c
SHA512 926c00967129494292e3bf9f35dbcdef8efdbddc66114d7104fcc61aa6866298ad0182c0cbdf923b694f25bb9e18020e674fd1367df236a2c6506b859641c041

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003e

MD5 57613e143ff3dae10f282e84a066de28
SHA1 88756cc8c6db645b5f20aa17b14feefb4411c25f
SHA256 19b8db163bcc51732457efa40911b4a422f297ff3cd566467d87eab93cef0c14
SHA512 94f045e71b9276944609ca69fc4b8704e4447f9b0fc2b80789cc012235895c50ef9ecb781a3ed901a0c989bed26caa37d4d4a9baffcce2cb19606dbb16a17176

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000040

MD5 2d64caa5ecbf5e42cbb766ca4d85e90e
SHA1 147420abceb4a7fd7e486dddcfe68cda7ebb3a18
SHA256 045b433f94502cfa873a39e72d616c73ec1b4c567b7ee0f847f442651683791f
SHA512 c96556ec57dac504919e806c7df536c4f86892b8525739289b2f2dbbf475de883a4824069dbdd4bb1770dd484f321563a00892e6c79d48818a4b95406bf1af96

memory/5168-841-0x0000000073DD0000-0x0000000074580000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003f

MD5 ce6bda6643b662a41b9fb570bdf72f83
SHA1 87bcf1d2820b476aaeaea91dc7f6dbedd73c1cb8
SHA256 0adf4d5edbc82d28879fdfaaf7274ba05162ff8cbbda816d69ed52f1dae547f6
SHA512 8023da9f9619d34d4e5f7c819a96356485f73fddcb8adb452f3ceefa8c969c16ca78a8c8d02d8e7a213eb9c5bbe5c50745ba7602e0ee2fe36d2742fb3e979c86

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000042

MD5 4f7c668ae0988bf759b831769bfd0335
SHA1 280a11e29d10bb78d6a5b4a1f512bf3c05836e34
SHA256 32d4c8dc451e11db315d047306feea0376fbdc3a77c0ab8f5a8ab154164734d1
SHA512 af959fe2a7d5f186bd79a6b1d02c69f058ecd52e60ebd0effa7f23b665a41500732ffa50a6e468a5253bb58644251586ae38ec53e21eab9140f1cf5fd291f6a5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000041

MD5 48b805d8fa321668db4ce8dfd96db5b9
SHA1 e0ded2606559c8100ef544c1f1c704e878a29b92
SHA256 9a75f8cc40bbe9c9499e7b2d3bab98a447685a361489357a111479517005c954
SHA512 95da761ca3f99f7808a0148cfa2416b8c03d90859bff65b396061ada5a4394fb50e2a4b82986caab07bc1fcd73980fe9b08e804b3ce897762a17d2e44935076d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 63536948f8f8e1620655c61680aa37b9
SHA1 d610cb9fb0d51cb574e6b47a5fab7537c4f790cc
SHA256 d62c8d67f7e34856cb2627aef1346949a1544ec8959fb09e7c1c6db9d89b1f82
SHA512 4c4e65544362f7d33592d3af94d201fb5db7deb16f438fdb13dcd38ae191f1223082a1dbadc5e13477391ec325930f22c6616d01118aedf7b25e47a7b72db91d

memory/2360-891-0x0000000073DD0000-0x0000000074580000-memory.dmp

memory/1772-892-0x0000000073DD0000-0x0000000074580000-memory.dmp

memory/2360-925-0x0000000006EF0000-0x0000000006F00000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 0018ce592226c4a029a4086e47b1ba7e
SHA1 d404f82c6d16f2b5fcca3f8a36c3d95f97719ca9
SHA256 a21100d682a4934197df1e76509793f6cbc758980ecfc0edd7ac910def6ba7ed
SHA512 ed48ca46dc610fcc2c51cc8bfe5fdd52c84b27aecb9cc43e8d70e7ccbbf25e61b6e87821ccd81ffbf9ccd39ebcf0e4eae63b539e2c3670e52090cafd757433ff

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 d2ee83ae5d81d612166c514dcb542ac1
SHA1 2d7b93dad430e6995cd3ab521070c144be2f7618
SHA256 a7b9daf1b5a6c6d82780f61d9b7933e91d332d7cfd836f24615cc8a620d9eae5
SHA512 5073792fb4834fea665fc7baaaef7f82b327f8919667ec57852d4800b989541a16a3ddddf50e120f6f3728baa6ef0e385594cd1832aa458b481573d576509ac7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe58487e.TMP

MD5 7097ebbfa71286894ad3f07e6e8e60dd
SHA1 060a001916a305cfbfc2d7b35c9b82f609df71f7
SHA256 d41a91b37cf3ed543e4c7299c9dcc23d4ae41442207bef9f14cb4b1b9dc02831
SHA512 22c2d74460b8e300335b5d2ebefa584b1089057ab7ef8a5d96342f058bda1201d4f19be5310c6013d6d58202f931b15e747a3bc939882271c6bac2f74f544a0e

memory/5196-957-0x0000000073DD0000-0x0000000074580000-memory.dmp

memory/7292-956-0x0000000000E50000-0x0000000001834000-memory.dmp

memory/1772-959-0x0000000073DD0000-0x0000000074580000-memory.dmp

memory/7292-961-0x0000000073DD0000-0x0000000074580000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 326f01804d10310a65efd6e0929702a7
SHA1 784dde9c4096f3276055eecd0887c80bb4a186ca
SHA256 cd55701f5c3749ae067dbb6e8a98ef7d3d2dd90cb4ad60fb64c7dadf139d6971
SHA512 b6f09ca018e6c9ecf3d8b1a18d28b637b90282d765882c7e09cf07f124fa1fff359f6e99603f4dd83f4aa5755d3c2d1203ebf5a2b2ca8e8729f8ec36182a0787

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584d31.TMP

MD5 a5105a7c84355c2b10f3989dcb1b96a6
SHA1 9143714173c29876d8f4363c91bd9bed505db2a1
SHA256 1bfb1e9e8d18c0650271421a18de6081281015c0e1f7d992891ffcf291c61497
SHA512 e57a1203d0aa5a33f89db79d88e02aa2fdc6cd7b58c2e3dffe3340a8c665f5bdc53cb5d9a834220e1e113c5a83cd9dc3e8a6044ff8380aeb0b15616ac5ca94db

memory/5196-979-0x0000000007690000-0x00000000076A0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 6e68805f0661dbeb776db896761d469f
SHA1 95e550b2f54e9167ae02f67e963703c593833845
SHA256 095e2b0ed70525cf5a7a5c31241aad5c27964fd69d68569c646a158c0ff50b47
SHA512 5cf25502b2fc8ab34b777b490493c8974af15135e8ff81f43ff254b910f74ee5cece6848ca4a5adae54b8cbf895362f268fd1665705f39bee27f395ea5c04efc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 9662595fd20c1218310b541b964c1c9f
SHA1 7ec47394c1747ee2d1e5769a7bc9751a03f37c2f
SHA256 8f9d86f03b3d94f5afbf924474c7291d4041779ae115cb6e6a0bd4f5a985fba2
SHA512 761d951cfd3e278a9362e200d1e2f11cc63dd4d76947008c818a3f4c86da3e51c7baff5feb8f97505acd33d12bee34e97e5c7c9fea8966d36974676a7d3bcde1

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 89c82822be2e2bf37b5d80d575ef2ec8
SHA1 9fe2fad2faff04ad5e8d035b98676dedd5817eca
SHA256 6fea30b9d17eacffde43b727058b5b2c422a7b70407534549042ba7b20d5f8c9
SHA512 142ca76bc32cc60c11f640bd9e050df6000b6824a192595416f661d22d6e52704dfd369974d7f2f73d01eaa356237c50778737d72d5588c5a2ff8a8010ee8101

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

MD5 9f1c899a371951195b4dedabf8fc4588
SHA1 7abeeee04287a2633f5d2fa32d09c4c12e76051b
SHA256 ba60b39bc10f6abd7f7a3a2a9bae5c83a0a6f7787e60115d0e8b4e17578c35f7
SHA512 86e75284beaff4727fae0a46bd8c3a8b4a7c95eceaf45845d5c3c2806139d739c983205b9163e515f6158aa7c3c901554109c92a7acc2c0077b1d22c003dba54

C:\Users\Admin\AppData\Local\Temp\kos4.exe

MD5 01707599b37b1216e43e84ae1f0d8c03
SHA1 521fe10ac55a1f89eba7b8e82e49407b02b0dcb2
SHA256 cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd
SHA512 9f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

MD5 eccad76805c6421735c51509323ea374
SHA1 7408929a96e1cd9a4b923b86966ce0e2b021552b
SHA256 14c8d86be351170c4e9f785c2dfb686bfe945209cbf98533f54194f8c276b6db
SHA512 4a7e5d3815d0655e0ea2aac7843d13258f312f70174d68951a21782054e684f739484dac08fda8cd47f5cf20d37516b017799d4819b0f88e46c819bd077fd94f

memory/3052-1082-0x00007FFB988D0000-0x00007FFB99391000-memory.dmp

memory/3052-1085-0x0000000001200000-0x0000000001210000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\latestX.exe

MD5 bae29e49e8190bfbbf0d77ffab8de59d
SHA1 4a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256 f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA512 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

memory/3052-1076-0x00000000009F0000-0x00000000009F8000-memory.dmp

memory/7292-1088-0x0000000073DD0000-0x0000000074580000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

MD5 73ad1ae9855d313baf3b80d18908d53e
SHA1 21dd5ac5a897f298721280a34761fef3947bd58b
SHA256 24f67f034f9a5178feeaa5db9bfdc6e2a71ff9b700cb962f59820414c39382c2
SHA512 0dc9ead6cb835c004fa4570314b8de072cd55e0ce49adf5b738242709bec5799f91da525987da0af32f950f352a772ed26902b149fbecfef2463cc5407b47bd3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 95d833a5121759a8180e66551a6a92e7
SHA1 579e409598b1430d86a1c0a2f957cf0d52c52f9b
SHA256 b162a0e41de93dfc269a7cb48828e4305970d009f639d083897fd2c786076771
SHA512 6b2830dec0fac47924600456659f39433ebaac3e5f590ef762e9a159a9db417c1d68465fce44e186769bb5597846fdfa4771340d7bb357c90db44881dae6a337

memory/7040-1136-0x0000000000D90000-0x0000000001170000-memory.dmp

memory/7040-1139-0x0000000005990000-0x0000000005A2C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

MD5 54d21c82e78e51f37d47a1aba4ef86d3
SHA1 f6c8803762c9067d0a3186db5a7b47d03d88fce4
SHA256 34d9a3f04cdd077c97651f77065e51e98a7c7e3c6098958567aa56d12eb961c7
SHA512 5a23e893c67538be85af548d41e889636e46bebf26e3fc997ff03ae3e01ae381d5e0fa8a27691a96b5db1d52c6e5e2417c0b85e6fd078921599d123c3c93b02e

memory/1216-1152-0x0000000000400000-0x0000000000418000-memory.dmp

memory/3168-1154-0x0000000000880000-0x0000000000980000-memory.dmp

memory/3168-1159-0x0000000000810000-0x0000000000819000-memory.dmp

memory/6080-1185-0x0000000000400000-0x0000000000409000-memory.dmp

memory/6080-1169-0x0000000000400000-0x0000000000409000-memory.dmp

memory/6280-1196-0x0000000000540000-0x0000000000541000-memory.dmp

memory/3052-1156-0x00007FFB988D0000-0x00007FFB99391000-memory.dmp

memory/7040-1137-0x0000000073DD0000-0x0000000074580000-memory.dmp

memory/5528-1288-0x0000000000400000-0x0000000000611000-memory.dmp

memory/5528-1289-0x0000000000400000-0x0000000000611000-memory.dmp

memory/4424-1291-0x0000000002A60000-0x0000000002E62000-memory.dmp

memory/5528-1298-0x0000000000400000-0x0000000000611000-memory.dmp

memory/4424-1302-0x0000000002E70000-0x000000000375B000-memory.dmp

memory/7232-1309-0x00000000001C0000-0x00000000001FE000-memory.dmp

memory/4424-1312-0x0000000000400000-0x0000000000D1B000-memory.dmp

memory/5812-1316-0x0000000000400000-0x0000000000611000-memory.dmp

memory/7232-1314-0x0000000000400000-0x0000000000461000-memory.dmp

memory/7040-1317-0x0000000073DD0000-0x0000000074580000-memory.dmp

memory/1216-1324-0x0000000000400000-0x0000000000418000-memory.dmp

memory/7232-1323-0x0000000073DD0000-0x0000000074580000-memory.dmp

memory/7232-1326-0x00000000075D0000-0x00000000075E0000-memory.dmp

memory/6052-1328-0x0000000000CF0000-0x0000000000D0E000-memory.dmp

memory/6052-1329-0x0000000073DD0000-0x0000000074580000-memory.dmp

memory/6052-1337-0x00000000054C0000-0x00000000054D0000-memory.dmp

memory/6080-1339-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3248-1338-0x0000000002E50000-0x0000000002E66000-memory.dmp

memory/6280-1345-0x0000000000540000-0x0000000000541000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe

MD5 b6d627dcf04d04889b1f01a14ec12405
SHA1 f7292c3d6f2003947cc5455b41df5f8fbd14df14
SHA256 9da10d7b75c589f06f1758ed8e3c0335b9a738d0ad1317c48e380bca768bdddf
SHA512 1eef46fcb568049edad6a6dac0ce6532185f15d2b4f9939853226a4f24e0732f637951c98f580efdb98ef396d3f4d9846bccffa22c0309b455432c98292af937

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8773dcf8ce1bc730a0d2bf9016fd908c
SHA1 a7426046bb092727002adec9b8bc0515444e5742
SHA256 26e347850493b0fc08a31f1324f1a9eb5d022120130f514bc4e4382332d9d780
SHA512 12928f79a65d7749ae7dad21be366df5ce15c051f876b5ea98cfbfea8e45f0a5a628a5c8405708a6ad9554e61da01325628b2296110f299b7a9cf089f59cd8f7

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 1317934d45423a98158a13727abd8551
SHA1 b47407ca7366d4f9269b6e015684f726f7a058f7
SHA256 6616ea166c4b3e2775ec76f19c66352cfc5a60da3e8b911e5e361e0557d055de
SHA512 806816739bcb0625efa90b6f5a57b3eab29e43becb9bf3855f5bd1511a3248d28873c8f0211ecc7a57d75c4d934f86775f2d7d8ec6e192f4743a60341001581e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a081.TMP

MD5 ead0e9ba40a396adf8692d7a506e06b7
SHA1 5d24844ef0bbd4ff8f7243860e7e91c5c45a0664
SHA256 446cc1e431eefec22ada35ab29375354bc9ba1f0518e89dc433464cd0143bab6
SHA512 b9464d5c094b6c535027639d32dc1bc13e3f66366a0f3355336e03c64910765b456f0bd2540a2689f368c7b24d1804ceb837c29f617dd2af33f46d0b05872efb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 aa72911943795a3234456b24766f7241
SHA1 2ddf1766bf3721771cf161310f8132351e0e245a
SHA256 f7bc132b5f098d034be317f93d38a96e87395aa927b03b97dc3af6c513575c5b
SHA512 38061b5b670e6ef228cba231528ffb5e84131066fe7b3c5c05b255ce44ea10efdc52fa8c85b08fddc57aedd2740b55f3603aa54b6b826a3206ca658cbd147fe0

memory/4112-1553-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4112-1561-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4112-1565-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\811856890180

MD5 8d4fd65533e83f845dc39a24a39face3
SHA1 77b2aa1d3d274fa0c521722acb5da956fb57b570
SHA256 541778fb6e09e28c16926a591cba7c39938afe8d00c0004a36e6b5f20a1f1446
SHA512 df29b647f63d166ba07dbf2bb1dc1461c3e9f83e7fe6f56fce49ed669499b7b9b0acd988355bee4b43befb2f3fe1ffa5a238fe0f7945685899212586769a3d1e

C:\Users\Admin\AppData\Roaming\465dbc52837d81\cred64.dll

MD5 1c27631e70908879e1a5a8f3686e0d46
SHA1 31da82b122b08bb2b1e6d0c904993d6d599dc93a
SHA256 478aa272d465eaa49c2f12fc141af2c0581f569ccf67f628747d90cc03a1e6a9
SHA512 7230ccad5e910f4f1aafb26642670c227a5d6e30f9c3de9a111e9c471651e54e352c56f34093667e6a51e78d01f3271c5e9d3248de5e1e82ae0e5d2aaea977dd

C:\Users\Admin\AppData\Roaming\465dbc52837d81\clip64.dll

MD5 ceffd8c6661b875b67ca5e4540950d8b
SHA1 91b53b79c98f22d0b8e204e11671d78efca48682
SHA256 da0bf5520986c2fb92fa9658ee2fcbb07ee531e09f901f299722c0d14e994ed2
SHA512 6f78e3479c7b80cee0c2cea33a5b3e06c65b3e85a558f2df4b72211f714b81a2549daed0bc7ffe1456867b447ede9caeec73a6c4d2b345aad664d501212d07d4

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p4yuorub.nns.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Temp\tmpB9EE.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmpBA13.tmp

MD5 985339a523cfa3862ebc174380d3340c
SHA1 73bf03c8f7bc58b4e28bcbfdd1c2ba52dea5dfb7
SHA256 57c7f10cd97c8db447281ad0f47d4694035056e050b85b81f5a5124f461621a2
SHA512 b5d34c43330f8070b3f353c826a54aecd99b7129a214913a365b66009a1a6744093bf085d3f86681ed40c714d6ebdfff40d99d7bd7a3508a0a0caed6304ac27c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 f881bdecb11d1e06995a33a9c394838a
SHA1 3f189922b67f52c795fae50e4bbe2f40abf88136
SHA256 feb044c998148a5ae2930845aebd2220c7b479cda6c8f12ea82fb318fa3a8f90
SHA512 ba6e9b70839001c103a21400e053f476960b7bc1ae650e931337a51a6b44e6cf462de3d6451d51602900f7ef2fece2b53bab125792e4267be998fc5a8cee8396

C:\Users\Admin\AppData\Local\Temp\tmpC6A8.tmp

MD5 dc3b5d38f2b93c911113fedcdf3b4f8e
SHA1 1cd49b1d37124d041b3d1df61820a920e687497c
SHA256 334dbdde037d64aa706a34760b740e3d3040d9fcbc07586e41f14853e1e4028b
SHA512 c39a56e45723d69bfedfa4d0f3104f151ae2a7bbe08a24e4d02998f85bcb6f84daaafcbde3bd6e316086dfbed0a8b20cf1bec65d188247ed3364baa0467011f9

C:\Users\Admin\AppData\Local\Temp\tmpC693.tmp

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\152e03e0-0d60-4bce-b0ca-73bd09229121\index-dir\the-real-index

MD5 2385cbabe230934010fe85fcfbed54d6
SHA1 af8057396e652d801ad69b4fc9149b8e1cafbacc
SHA256 d2ebf03f0534cb9bc8a26f158e98cee00f47fa179f2cacd7eac7beff83ea0dde
SHA512 c1ee8a1980616fb64d61269afc9c5ec542fa5513e3f96973837cdee0dfea65a8073d9121da670db86f1ec717c596fe8fd885ada849161c8431e8693aca4530c2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\152e03e0-0d60-4bce-b0ca-73bd09229121\index-dir\the-real-index~RFe58c54f.TMP

MD5 2a55f5b153e1438589a19e9655179456
SHA1 50888fb7097673f77bb61b76aa07f6be647ddec3
SHA256 d7e3d6c2dbab77d7af528e8088506eb7681905051ed6bbf696f0276ea1e1cccd
SHA512 309d82cbab3055e36fe71d1757022cab3d28790b19fc9a10e0f3d7ab2888f204aed158e08d34bf7651ceb46ae99930e11212d5c17e1572d188f9bc239d996f31

C:\Users\Admin\AppData\Local\Temp\tmpC6F8.tmp

MD5 55e54a0da9b8bdc734345d6fc2ca7b73
SHA1 41bca8e7337849f2fa5523a07311c01529c72c93
SHA256 f3a0d677d50e8762bcf255c75f5d1b59f93072a1853c12593cf97fe56315fac6
SHA512 f6c191a85c0eb40e9bea7134d9cfaa3c4533e394e0adc99dd549290f891842643c4212328dda47488cd04b6f09164f220835e648c9dfca0f5c3fffc365c82e4d

C:\Users\Admin\AppData\Local\Temp\tmpC724.tmp

MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 ca63afcf93a478ca9d3358905b3e87de
SHA1 4a993b250a230c1e94915b280db73f580a6bcff7
SHA256 d7f1882f14690152d4ae5a3e4c2a436690a79b032fff4e49631cee6230d0faae
SHA512 fc284fc77ee9b3cae928c7bf9212a32d00d0d4f6d30c136b7fef1a4b0a5c02915d1eeca0a20690429a40ad3c503a18d87d68ba82ea113f56233a10ba0fc45d46

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 a58101a4ae17b4dc7a6b5943413bad4b
SHA1 cc25b70ae4f9f85a4cc903bdb10b040b54f143dd
SHA256 bc9b39ad66099c21df7f3bc0833e95855b4ff14a2b0c2d780108800e7d6ce545
SHA512 f358d55b63b84a1a32f663934787259c0308edcd79183e57ddceebe4eba50db0f0ae0abb3c344b4dd667e4c63968e53ea8f480ca56983af1e774bbb7f4c4c873

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 09089d60bcc93a136fbb8e81b831531b
SHA1 93d0006b59881dc482b9206e7612d44e0b3ad2f0
SHA256 29b2618615e3354c27d4a3daf7b3b85d1bd2537a99918dafea3fc040e41bb474
SHA512 a1399e55e1cfec87e9e44abccce4bce15f8007ec69d12baa1376b02b537238f54a3dcc3d68352d9b764ac593d16fbef48ee6327bc870921462200ea4ebd752e6

memory/5420-2029-0x00007FF687C20000-0x00007FF6881C1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a881b812db02991bcf85ce1c2280852e
SHA1 beb7190435694f2b97b94f4ab6773069ded5da8c
SHA256 184778cac58046f3ac45fef9dcdefb1db6007bc9f05f51bef2d52297e5c85f64
SHA512 003decc6bc90a7653b27fe9879d238ce617486b333eb108ebae072ba416d96a163762b573def1c4fef655fcee8e968d28c4fca3a665ebc3a966c2ad87bc3477f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3fd7a181-30a2-4e8e-b5a5-93920d47474a\index-dir\the-real-index

MD5 b8ee19b3354de2febb3e099c593fd272
SHA1 d85aeae17765e6a9ed22d58b3411bcd6b5b5ff23
SHA256 ed15ef2bfcbb1ec2afa42db1ee6ddd7962a86e37061cd0f3c555fdd7f580f8a1
SHA512 38f33b0775e83af852ac511bef3e4b5f8d806ef9aa3ea9a67564e3d8ac4ce66d91becbf931267deb589a4112e1aa80f57c8f0ea6b4bc63bcc069748ec46758d5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3fd7a181-30a2-4e8e-b5a5-93920d47474a\index-dir\the-real-index~RFe58fb91.TMP

MD5 4e79eff680c42e676bd5bedbf0f814ac
SHA1 9c53cae259a103cb7bb923e17383926e927294da
SHA256 e1c81224987942b2e7cbad6fdd087a955ca927c2f97788e9eb75a17acf85bc00
SHA512 eea593db82719106918141e94507dd8bb829b6ced6fa07a0daf126d8df3a80f5988a4f3c3c049d3ed3466b861cbcfde0099eaf0a4778ea5e75e8502338b76ec5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 c8b92cb427e342e0888ca6a750ab5cde
SHA1 f3fab3770268f1a327c7441bf9153d6feb6bb28a
SHA256 40e46d0241d2fc48243d8b674a2f1f3f89b79c67d49b113932b341d576fea7e4
SHA512 564a25ce9b6fb7adfb7ae5bc9a5b2abc6d09fbe24e4700a16d006213821ecb2809c67cfc239ed130b376c9d8d481cb5dc04ad8c64c1709b43d428212e073ec47

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 36908a28bd396d57b2b3ffb07684ec7b
SHA1 4c875c96014e8314d62d418f0e34f3e8af6129a5
SHA256 0387659ce4a1269a63dbacfb0d778c64eac2fa6d139c7edc30d98ca27a962042
SHA512 6ccbdc3626a079a5c0582cb0eafe096739708bdd3894b49b7c9ba0584a54d521edbbfa4e3aff92b49f8de2db6e04f400d17942435ec9192d66ec4a4c19afd79e

memory/8904-2161-0x0000000000400000-0x0000000000D1B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 e5e42f3365ab0f110d9cf425cbe8c203
SHA1 64f16bf62e745b5a0287c2f04fe1ec17dffb3e15
SHA256 3cc9b934f92dc3a4de5c72ce5f5dea719c0aeefcc297c444c6eccb417fcc7835
SHA512 da6c6e3284a5055ec09542360cabb53d6b73f39a32fc054589000bb79b19747980924f27e5cb86fcdc895dca88f05510bb319e0d50570cc10b4e5a0cb7960379

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 93a0e2e3dddd071d39281287bbbcc5d9
SHA1 ca0fe55106e7ebbb384a1b574a64b77d3422e2a0
SHA256 317148b26e84e0519c92d891c185cdb825f4d78964f0930d4f2daf29194b66c8
SHA512 a4fd278f907e6d76ab7b6b7b52e3934c3f8c1f454d20bb95374a79d130a505f3806dcb236137282743e418a3997bc10e056531477db9e970b50f72279e3a9d24

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000062

MD5 231913fdebabcbe65f4b0052372bde56
SHA1 553909d080e4f210b64dc73292f3a111d5a0781f
SHA256 9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad
SHA512 7b11b709968c5a52b9b60189fb534f5df56912417243820e9d1c00c97f4bd6d0835f2cdf574d0c36ecb32dbbf5fc397324df54f7fdf9e1b062b5dbda2c02e919