Malware Analysis Report

2024-10-24 19:57

Sample ID 231104-hkydvsfa72
Target af9e55e83d026cf03000fa394257145ef2bd4860aa5a7.exe
SHA256 af9e55e83d026cf03000fa394257145ef2bd4860aa5a7dc9ff95509fb294e246
Tags
amadey dcrat glupteba healer redline sectoprat smokeloader xmrig kedru livetraffic pixelnew2.0 plost up3 backdoor paypal discovery dropper evasion infostealer loader miner persistence phishing rat spyware stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

af9e55e83d026cf03000fa394257145ef2bd4860aa5a7dc9ff95509fb294e246

Threat Level: Known bad

The file af9e55e83d026cf03000fa394257145ef2bd4860aa5a7.exe was found to be: Known bad.

Malicious Activity Summary

amadey dcrat glupteba healer redline sectoprat smokeloader xmrig kedru livetraffic pixelnew2.0 plost up3 backdoor paypal discovery dropper evasion infostealer loader miner persistence phishing rat spyware stealer trojan upx

Healer

DcRat

Glupteba payload

RedLine payload

SmokeLoader

xmrig

Suspicious use of NtCreateUserProcessOtherParentProcess

Detects Healer an antivirus disabler dropper

Modifies Windows Defender Real-time Protection settings

Glupteba

SectopRAT

SectopRAT payload

Amadey

RedLine

XMRig Miner payload

Modifies Windows Firewall

Blocklisted process makes network request

Downloads MZ/PE file

Stops running service(s)

Drops file in Drivers directory

Loads dropped DLL

Executes dropped EXE

Reads user/profile data of web browsers

UPX packed file

Checks computer location settings

Windows security modification

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Suspicious use of SetThreadContext

Detected potential entity reuse from brand paypal.

Launches sc.exe

Unsigned PE

Enumerates physical storage devices

Program crash

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Checks SCSI registry key(s)

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious behavior: MapViewOfSection

Enumerates system info in registry

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-11-04 06:48

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-11-04 06:48

Reported

2023-11-04 06:50

Platform

win10v2004-20231023-en

Max time kernel

89s

Max time network

154s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\af9e55e83d026cf03000fa394257145ef2bd4860aa5a7.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3425420.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3425420.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3425420.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3425420.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3425420.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3425420.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A

Downloads MZ/PE file

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\latestX.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Stops running service(s)

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\kos4.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8792114.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2D2A.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3F3E.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1106597.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3425420.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8792114.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c5767668.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FDA9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dp3vV3MI.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Nl6LZ0xt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\221.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ZJ5vC5Je.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\dU5oC5uB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1oC81UF7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2bZ811TH.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2D2A.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3B63.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3D58.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3F3E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Broom.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\kos4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\latestX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C44D.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3425420.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\af9e55e83d026cf03000fa394257145ef2bd4860aa5a7.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1106597.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\FDA9.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dp3vV3MI.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Nl6LZ0xt.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ZJ5vC5Je.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\dU5oC5uB.exe N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Detected potential entity reuse from brand paypal.

phishing paypal

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3736 set thread context of 4228 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1oC81UF7.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 6552 set thread context of 6832 N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c5767668.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c5767668.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c5767668.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3425420.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3425420.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c5767668.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c5767668.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c5767668.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3425420.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3D58.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\kos4.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8792114.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3F3E.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Broom.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3196 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\af9e55e83d026cf03000fa394257145ef2bd4860aa5a7.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1106597.exe
PID 3196 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\af9e55e83d026cf03000fa394257145ef2bd4860aa5a7.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1106597.exe
PID 3196 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\af9e55e83d026cf03000fa394257145ef2bd4860aa5a7.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1106597.exe
PID 5000 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1106597.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3425420.exe
PID 5000 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1106597.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3425420.exe
PID 5000 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1106597.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8792114.exe
PID 5000 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1106597.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8792114.exe
PID 5000 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1106597.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8792114.exe
PID 3000 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8792114.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 3000 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8792114.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 3000 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8792114.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 3196 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\af9e55e83d026cf03000fa394257145ef2bd4860aa5a7.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c5767668.exe
PID 3196 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\af9e55e83d026cf03000fa394257145ef2bd4860aa5a7.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c5767668.exe
PID 3196 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\af9e55e83d026cf03000fa394257145ef2bd4860aa5a7.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c5767668.exe
PID 3628 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3628 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3628 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3628 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3628 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3628 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 228 wrote to memory of 3348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 228 wrote to memory of 3348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 228 wrote to memory of 3348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 228 wrote to memory of 3200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 228 wrote to memory of 3200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 228 wrote to memory of 3200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 228 wrote to memory of 4236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 228 wrote to memory of 4236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 228 wrote to memory of 4236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 228 wrote to memory of 4268 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 228 wrote to memory of 4268 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 228 wrote to memory of 4268 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 228 wrote to memory of 4212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 228 wrote to memory of 4212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 228 wrote to memory of 4212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 228 wrote to memory of 4684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 228 wrote to memory of 4684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 228 wrote to memory of 4684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3380 wrote to memory of 3264 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\FDA9.exe
PID 3380 wrote to memory of 3264 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\FDA9.exe
PID 3380 wrote to memory of 3264 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\FDA9.exe
PID 3264 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\FDA9.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dp3vV3MI.exe
PID 3264 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\FDA9.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dp3vV3MI.exe
PID 3264 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\FDA9.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dp3vV3MI.exe
PID 3380 wrote to memory of 3972 N/A C:\Windows\Explorer.EXE C:\Windows\system32\cmd.exe
PID 3380 wrote to memory of 3972 N/A C:\Windows\Explorer.EXE C:\Windows\system32\cmd.exe
PID 3380 wrote to memory of 3216 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\F7.exe
PID 3380 wrote to memory of 3216 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\F7.exe
PID 3380 wrote to memory of 3216 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\F7.exe
PID 828 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dp3vV3MI.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Nl6LZ0xt.exe
PID 828 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dp3vV3MI.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Nl6LZ0xt.exe
PID 828 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dp3vV3MI.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Nl6LZ0xt.exe
PID 3380 wrote to memory of 2024 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\221.exe
PID 3380 wrote to memory of 2024 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\221.exe
PID 3380 wrote to memory of 2024 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\221.exe
PID 2944 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Nl6LZ0xt.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ZJ5vC5Je.exe
PID 2944 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Nl6LZ0xt.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ZJ5vC5Je.exe
PID 2944 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Nl6LZ0xt.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ZJ5vC5Je.exe
PID 4564 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ZJ5vC5Je.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\dU5oC5uB.exe
PID 4564 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ZJ5vC5Je.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\dU5oC5uB.exe
PID 4564 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ZJ5vC5Je.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\dU5oC5uB.exe
PID 4944 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\dU5oC5uB.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1oC81UF7.exe
PID 4944 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\dU5oC5uB.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1oC81UF7.exe
PID 4944 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\dU5oC5uB.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1oC81UF7.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\af9e55e83d026cf03000fa394257145ef2bd4860aa5a7.exe

"C:\Users\Admin\AppData\Local\Temp\af9e55e83d026cf03000fa394257145ef2bd4860aa5a7.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1106597.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1106597.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3425420.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3425420.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8792114.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8792114.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c5767668.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c5767668.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\FDA9.exe

C:\Users\Admin\AppData\Local\Temp\FDA9.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dp3vV3MI.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dp3vV3MI.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FF7F.bat" "

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Nl6LZ0xt.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Nl6LZ0xt.exe

C:\Users\Admin\AppData\Local\Temp\F7.exe

C:\Users\Admin\AppData\Local\Temp\F7.exe

C:\Users\Admin\AppData\Local\Temp\221.exe

C:\Users\Admin\AppData\Local\Temp\221.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ZJ5vC5Je.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ZJ5vC5Je.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\dU5oC5uB.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\dU5oC5uB.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1oC81UF7.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1oC81UF7.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2bZ811TH.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2bZ811TH.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4228 -ip 4228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffee44b46f8,0x7ffee44b4708,0x7ffee44b4718

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee44b46f8,0x7ffee44b4708,0x7ffee44b4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,8722184634518447241,16126125155889282660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee44b46f8,0x7ffee44b4708,0x7ffee44b4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1976,8722184634518447241,16126125155889282660,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2976 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8722184634518447241,16126125155889282660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8722184634518447241,16126125155889282660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,8722184634518447241,16126125155889282660,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1980 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,3226666590225498301,13040074101197930350,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,3226666590225498301,13040074101197930350,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8722184634518447241,16126125155889282660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2192 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8722184634518447241,16126125155889282660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee44b46f8,0x7ffee44b4708,0x7ffee44b4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8722184634518447241,16126125155889282660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee44b46f8,0x7ffee44b4708,0x7ffee44b4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffee44b46f8,0x7ffee44b4708,0x7ffee44b4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8722184634518447241,16126125155889282660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8722184634518447241,16126125155889282660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8722184634518447241,16126125155889282660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4360 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee44b46f8,0x7ffee44b4708,0x7ffee44b4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8722184634518447241,16126125155889282660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee44b46f8,0x7ffee44b4708,0x7ffee44b4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8722184634518447241,16126125155889282660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8722184634518447241,16126125155889282660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\2D2A.exe

C:\Users\Admin\AppData\Local\Temp\2D2A.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1976,8722184634518447241,16126125155889282660,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3220 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1976,8722184634518447241,16126125155889282660,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6988 /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x4a8 0x2f0

C:\Users\Admin\AppData\Local\Temp\3B63.exe

C:\Users\Admin\AppData\Local\Temp\3B63.exe

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\3D58.exe

C:\Users\Admin\AppData\Local\Temp\3D58.exe

C:\Users\Admin\AppData\Local\Temp\3F3E.exe

C:\Users\Admin\AppData\Local\Temp\3F3E.exe

C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

"C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"

C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe

"C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\Broom.exe

C:\Users\Admin\AppData\Local\Temp\Broom.exe

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe" /F

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 840

C:\Users\Admin\AppData\Local\Temp\latestX.exe

"C:\Users\Admin\AppData\Local\Temp\latestX.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "Utsysc.exe" /P "Admin:N"&&CACLS "Utsysc.exe" /P "Admin:R" /E&&echo Y|CACLS "..\e8b5234212" /P "Admin:N"&&CACLS "..\e8b5234212" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5056 -ip 5056

C:\Users\Admin\AppData\Local\Temp\kos4.exe

"C:\Users\Admin\AppData\Local\Temp\kos4.exe"

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\cred64.dll, Main

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\clip64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\cred64.dll, Main

C:\Windows\SysWOW64\cacls.exe

CACLS "Utsysc.exe" /P "Admin:N"

C:\Windows\system32\netsh.exe

netsh wlan show profiles

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Windows\system32\tar.exe

tar.exe -cf "C:\Users\Admin\AppData\Local\Temp\114462139309_Desktop.tar" "C:\Users\Admin\AppData\Local\Temp\_Files_\*.*"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8722184634518447241,16126125155889282660,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7824 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8722184634518447241,16126125155889282660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8072 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1976,8722184634518447241,16126125155889282660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8440 /prefetch:8

C:\Windows\SysWOW64\cacls.exe

CACLS "Utsysc.exe" /P "Admin:R" /E

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1976,8722184634518447241,16126125155889282660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8440 /prefetch:8

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\e8b5234212" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\e8b5234212" /P "Admin:R" /E

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8722184634518447241,16126125155889282660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7056 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8722184634518447241,16126125155889282660,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7848 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\C44D.exe

C:\Users\Admin\AppData\Local\Temp\C44D.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\System32\schtasks.exe

C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"

C:\Program Files\Google\Chrome\updater.exe

"C:\Program Files\Google\Chrome\updater.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8722184634518447241,16126125155889282660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8672 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe

C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8722184634518447241,16126125155889282660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9080 /prefetch:1

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffee44b46f8,0x7ffee44b4708,0x7ffee44b4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,4219028214417527822,484471190624015354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,4219028214417527822,484471190624015354,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4219028214417527822,484471190624015354,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4219028214417527822,484471190624015354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4219028214417527822,484471190624015354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4219028214417527822,484471190624015354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4219028214417527822,484471190624015354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:1

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4219028214417527822,484471190624015354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4219028214417527822,484471190624015354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4219028214417527822,484471190624015354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4219028214417527822,484471190624015354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4219028214417527822,484471190624015354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\System32\conhost.exe

C:\Windows\System32\conhost.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 121.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 39.142.81.104.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 29.68.91.77.in-addr.arpa udp
FI 77.91.68.249:80 77.91.68.249 tcp
RU 193.233.255.73:80 193.233.255.73 tcp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 249.68.91.77.in-addr.arpa udp
US 8.8.8.8:53 73.255.233.193.in-addr.arpa udp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
FI 77.91.124.86:19084 tcp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 store.steampowered.com udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 accounts.google.com udp
NL 157.240.247.35:443 www.facebook.com tcp
NL 104.85.0.101:443 store.steampowered.com tcp
NL 142.251.36.45:443 accounts.google.com tcp
NL 142.251.36.45:443 accounts.google.com udp
US 8.8.8.8:53 35.247.240.157.in-addr.arpa udp
US 8.8.8.8:53 101.0.85.104.in-addr.arpa udp
US 8.8.8.8:53 45.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 twitter.com udp
US 104.244.42.65:443 twitter.com tcp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 131.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 65.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 steamcommunity.com udp
JP 23.207.106.113:443 steamcommunity.com tcp
US 8.8.8.8:53 www.epicgames.com udp
US 3.215.51.251:443 www.epicgames.com tcp
US 8.8.8.8:53 113.106.207.23.in-addr.arpa udp
US 8.8.8.8:53 251.51.215.3.in-addr.arpa udp
US 8.8.8.8:53 113.39.65.18.in-addr.arpa udp
US 8.8.8.8:53 www.paypal.com udp
US 151.101.1.21:443 www.paypal.com tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
IE 163.70.151.21:443 static.xx.fbcdn.net tcp
IE 163.70.151.21:443 static.xx.fbcdn.net tcp
IE 163.70.151.21:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 i.ytimg.com udp
NL 142.251.36.22:443 i.ytimg.com tcp
US 8.8.8.8:53 163.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 21.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 21.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 206.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 22.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 106.208.58.216.in-addr.arpa udp
US 8.8.8.8:53 api.twitter.com udp
US 8.8.8.8:53 abs.twimg.com udp
US 8.8.8.8:53 pbs.twimg.com udp
US 104.244.42.130:443 api.twitter.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
NL 199.232.148.159:443 pbs.twimg.com tcp
US 8.8.8.8:53 t.co udp
US 8.8.8.8:53 video.twimg.com udp
US 68.232.34.217:443 video.twimg.com tcp
US 104.244.42.133:443 t.co tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 130.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 141.21.199.152.in-addr.arpa udp
US 8.8.8.8:53 159.148.232.199.in-addr.arpa udp
US 8.8.8.8:53 217.34.232.68.in-addr.arpa udp
US 8.8.8.8:53 133.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 store.akamai.steamstatic.com udp
NL 23.72.252.171:443 store.akamai.steamstatic.com tcp
NL 23.72.252.171:443 store.akamai.steamstatic.com tcp
NL 23.72.252.171:443 store.akamai.steamstatic.com tcp
US 8.8.8.8:53 apps.identrust.com udp
NL 88.221.25.169:80 apps.identrust.com tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 152.199.21.141:443 abs.twimg.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 8.8.8.8:53 community.akamai.steamstatic.com udp
US 8.8.8.8:53 tracking.epicgames.com udp
US 8.8.8.8:53 www.paypalobjects.com udp
US 8.8.8.8:53 static-assets-prod.unrealengine.com udp
NL 216.58.214.2:443 googleads.g.doubleclick.net tcp
US 44.209.232.36:443 tracking.epicgames.com tcp
NL 23.72.252.160:443 community.akamai.steamstatic.com tcp
NL 23.72.252.160:443 community.akamai.steamstatic.com tcp
NL 23.72.252.160:443 community.akamai.steamstatic.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 18.239.36.105:443 static-assets-prod.unrealengine.com tcp
US 18.239.36.105:443 static-assets-prod.unrealengine.com tcp
US 8.8.8.8:53 171.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 2.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 160.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 169.25.221.88.in-addr.arpa udp
US 8.8.8.8:53 25.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 105.36.239.18.in-addr.arpa udp
US 8.8.8.8:53 36.232.209.44.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
NL 216.58.214.2:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 rr1---sn-4g5edndk.googlevideo.com udp
DE 172.217.133.198:443 rr1---sn-4g5edndk.googlevideo.com tcp
DE 172.217.133.198:443 rr1---sn-4g5edndk.googlevideo.com tcp
NL 194.169.175.118:80 194.169.175.118 tcp
IT 185.196.9.171:80 185.196.9.171 tcp
US 8.8.8.8:53 198.133.217.172.in-addr.arpa udp
US 8.8.8.8:53 118.175.169.194.in-addr.arpa udp
US 8.8.8.8:53 171.9.196.185.in-addr.arpa udp
DE 172.217.133.198:443 rr1---sn-4g5edndk.googlevideo.com tcp
DE 172.217.133.198:443 rr1---sn-4g5edndk.googlevideo.com tcp
NL 142.251.36.22:443 i.ytimg.com udp
BG 171.22.28.213:80 171.22.28.213 tcp
US 8.8.8.8:53 213.28.22.171.in-addr.arpa udp
US 8.8.8.8:53 196.168.217.172.in-addr.arpa udp
DE 172.217.133.198:443 rr1---sn-4g5edndk.googlevideo.com tcp
DE 172.217.133.198:443 rr1---sn-4g5edndk.googlevideo.com tcp
US 194.49.94.11:80 194.49.94.11 tcp
US 8.8.8.8:53 i4.ytimg.com udp
US 8.8.8.8:53 yt3.ggpht.com udp
DE 172.217.23.206:443 i4.ytimg.com tcp
NL 142.251.36.1:443 yt3.ggpht.com tcp
NL 142.251.36.1:443 yt3.ggpht.com tcp
NL 142.251.36.1:443 yt3.ggpht.com tcp
NL 142.251.36.1:443 yt3.ggpht.com tcp
NL 142.251.36.1:443 yt3.ggpht.com tcp
NL 142.251.36.1:443 yt3.ggpht.com tcp
US 8.8.8.8:53 11.94.49.194.in-addr.arpa udp
US 8.8.8.8:53 206.23.217.172.in-addr.arpa udp
US 8.8.8.8:53 1.36.251.142.in-addr.arpa udp
DE 167.235.20.126:80 167.235.20.126 tcp
DE 167.235.20.126:80 167.235.20.126 tcp
US 8.8.8.8:53 126.20.235.167.in-addr.arpa udp
US 8.8.8.8:53 iplogger.com udp
DE 148.251.234.93:443 iplogger.com tcp
US 8.8.8.8:53 93.234.251.148.in-addr.arpa udp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
NL 142.251.36.14:443 play.google.com udp
US 8.8.8.8:53 facebook.com udp
IE 163.70.151.35:443 facebook.com tcp
US 8.8.8.8:53 14.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 rr2---sn-5hnekn7l.googlevideo.com udp
NL 74.125.100.7:443 rr2---sn-5hnekn7l.googlevideo.com tcp
NL 74.125.100.7:443 rr2---sn-5hnekn7l.googlevideo.com tcp
US 8.8.8.8:53 35.151.70.163.in-addr.arpa udp
NL 74.125.100.7:443 rr2---sn-5hnekn7l.googlevideo.com udp
US 8.8.8.8:53 api.ip.sb udp
US 8.8.8.8:53 7.100.125.74.in-addr.arpa udp
US 172.67.75.172:443 api.ip.sb tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 172.75.67.172.in-addr.arpa udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
US 8.8.8.8:53 static.doubleclick.net udp
NL 142.250.179.170:443 jnn-pa.googleapis.com tcp
NL 142.251.36.6:443 static.doubleclick.net tcp
NL 142.250.179.170:443 jnn-pa.googleapis.com udp
DE 167.235.20.126:80 167.235.20.126 tcp
US 8.8.8.8:53 170.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 6.36.251.142.in-addr.arpa udp
FI 77.91.124.86:19084 tcp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 fbcdn.net udp
IE 163.70.151.35:443 fbcdn.net tcp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 youtube.com udp
NL 216.58.214.14:443 youtube.com tcp
US 8.8.8.8:53 14.214.58.216.in-addr.arpa udp
DE 167.235.20.126:80 167.235.20.126 tcp
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 static.ads-twitter.com udp
NL 199.232.148.157:443 static.ads-twitter.com tcp
US 8.8.8.8:53 157.148.232.199.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
FI 77.91.68.61:80 tcp
US 8.8.8.8:53 34.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 www.paypal.com udp
US 8.8.8.8:53 www.paypalobjects.com udp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com udp
NL 142.251.36.14:443 play.google.com udp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 c.paypal.com udp
US 8.8.8.8:53 www.recaptcha.net udp
NL 142.250.179.163:443 www.recaptcha.net tcp
US 192.55.233.1:443 tcp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 163.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 t.paypal.com udp
US 192.55.233.1:443 tcp
US 8.8.8.8:53 b.stats.paypal.com udp
US 64.4.245.84:443 b.stats.paypal.com tcp
US 8.8.8.8:53 84.245.4.64.in-addr.arpa udp
US 8.8.8.8:53 dub.stats.paypal.com udp
US 64.4.245.84:443 dub.stats.paypal.com tcp
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 host-host-file8.com udp
US 95.214.26.28:80 host-host-file8.com tcp
US 8.8.8.8:53 28.26.214.95.in-addr.arpa udp
RU 195.10.205.17:8122 tcp
NL 142.250.179.163:443 www.recaptcha.net udp
US 8.8.8.8:53 17.205.10.195.in-addr.arpa udp
US 8.8.8.8:53 sentry.io udp
US 35.186.247.156:443 sentry.io tcp
US 8.8.8.8:53 156.247.186.35.in-addr.arpa udp
US 8.8.8.8:53 static-assets-prod.unrealengine.com udp
US 18.239.36.103:443 static-assets-prod.unrealengine.com tcp
US 8.8.8.8:53 103.36.239.18.in-addr.arpa udp
US 8.8.8.8:53 194.23.217.172.in-addr.arpa udp
US 8.8.8.8:53 585f29c1-7294-4d65-9795-994548284fa8.uuid.theupdatetime.org udp
FI 77.91.124.86:19084 tcp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 xmr-eu1.nanopool.org udp
DE 135.125.238.108:14433 xmr-eu1.nanopool.org tcp
US 8.8.8.8:53 pastebin.com udp
US 104.20.67.143:443 pastebin.com tcp
FR 212.47.253.124:14433 xmr-eu1.nanopool.org tcp
US 8.8.8.8:53 108.238.125.135.in-addr.arpa udp
US 8.8.8.8:53 143.67.20.104.in-addr.arpa udp
US 8.8.8.8:53 124.253.47.212.in-addr.arpa udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 stun4.l.google.com udp
US 8.8.8.8:53 server12.theupdatetime.org udp
US 162.159.133.233:443 cdn.discordapp.com tcp
US 74.125.204.127:19302 stun4.l.google.com udp
BG 185.82.216.108:443 server12.theupdatetime.org tcp
US 8.8.8.8:53 walkinglate.com udp
US 188.114.96.0:443 walkinglate.com tcp
US 8.8.8.8:53 127.204.125.74.in-addr.arpa udp
US 8.8.8.8:53 233.133.159.162.in-addr.arpa udp
US 8.8.8.8:53 108.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 0.96.114.188.in-addr.arpa udp
BG 185.82.216.108:443 server12.theupdatetime.org tcp
US 8.8.8.8:53 88.65.42.20.in-addr.arpa udp
FI 77.91.124.86:19084 tcp
FI 77.91.124.86:19084 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1106597.exe

MD5 45a3bb26ea6be74edc125030beeef437
SHA1 366fe6443678f62e564919e1b0043f8a3d4072d2
SHA256 3d426ba7313007978b404b0a54ac66c53d62a851b9992e5b53e8b21f5e0dcc12
SHA512 470b71f2a97ae47b6e5fbc717b4df2bac37882890be99e3ced126104747f9d601fe62202cd00989e0e13e689e107030a9a60edc23e176ec9c97e67abc756d320

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1106597.exe

MD5 45a3bb26ea6be74edc125030beeef437
SHA1 366fe6443678f62e564919e1b0043f8a3d4072d2
SHA256 3d426ba7313007978b404b0a54ac66c53d62a851b9992e5b53e8b21f5e0dcc12
SHA512 470b71f2a97ae47b6e5fbc717b4df2bac37882890be99e3ced126104747f9d601fe62202cd00989e0e13e689e107030a9a60edc23e176ec9c97e67abc756d320

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3425420.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3425420.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/2224-14-0x0000000000640000-0x000000000064A000-memory.dmp

memory/2224-15-0x00007FFEE3150000-0x00007FFEE3C11000-memory.dmp

memory/2224-17-0x00007FFEE3150000-0x00007FFEE3C11000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8792114.exe

MD5 74f145f1bc8fe95013f30cff035aef28
SHA1 c1e73bf94b6a8bdb8e133a9cf69ad02895b222a6
SHA256 4938bb8c9f1cf0f55c3e555b816632eb84a1e2cef0b08548f53400f43ede38c1
SHA512 1792c711d1670838bac98f332a38bd70064cfac5324e216143127450cdb915b1fba5b07d201a82a7d16c444428d72014707883b86275e868a166d0e4f640c008

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8792114.exe

MD5 74f145f1bc8fe95013f30cff035aef28
SHA1 c1e73bf94b6a8bdb8e133a9cf69ad02895b222a6
SHA256 4938bb8c9f1cf0f55c3e555b816632eb84a1e2cef0b08548f53400f43ede38c1
SHA512 1792c711d1670838bac98f332a38bd70064cfac5324e216143127450cdb915b1fba5b07d201a82a7d16c444428d72014707883b86275e868a166d0e4f640c008

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

MD5 74f145f1bc8fe95013f30cff035aef28
SHA1 c1e73bf94b6a8bdb8e133a9cf69ad02895b222a6
SHA256 4938bb8c9f1cf0f55c3e555b816632eb84a1e2cef0b08548f53400f43ede38c1
SHA512 1792c711d1670838bac98f332a38bd70064cfac5324e216143127450cdb915b1fba5b07d201a82a7d16c444428d72014707883b86275e868a166d0e4f640c008

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

MD5 74f145f1bc8fe95013f30cff035aef28
SHA1 c1e73bf94b6a8bdb8e133a9cf69ad02895b222a6
SHA256 4938bb8c9f1cf0f55c3e555b816632eb84a1e2cef0b08548f53400f43ede38c1
SHA512 1792c711d1670838bac98f332a38bd70064cfac5324e216143127450cdb915b1fba5b07d201a82a7d16c444428d72014707883b86275e868a166d0e4f640c008

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

MD5 74f145f1bc8fe95013f30cff035aef28
SHA1 c1e73bf94b6a8bdb8e133a9cf69ad02895b222a6
SHA256 4938bb8c9f1cf0f55c3e555b816632eb84a1e2cef0b08548f53400f43ede38c1
SHA512 1792c711d1670838bac98f332a38bd70064cfac5324e216143127450cdb915b1fba5b07d201a82a7d16c444428d72014707883b86275e868a166d0e4f640c008

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c5767668.exe

MD5 2e0f97ae1bcad17088b12bfec0dea44e
SHA1 c6b90f19a2a9ee2602106e35bbb03f5fb71b78e6
SHA256 decd8291a1f383677b50935b429110f0978b4d248b86a0e5bf4fe62355f3ef06
SHA512 4f1cbb5a84c9c867e4c4ca0f984351b08549299496368c042672a15b59d3320750f99c444ce55263653158bb997e88960b17c2360f89bab66c2d4dd2b6c8449b

memory/4692-33-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c5767668.exe

MD5 2e0f97ae1bcad17088b12bfec0dea44e
SHA1 c6b90f19a2a9ee2602106e35bbb03f5fb71b78e6
SHA256 decd8291a1f383677b50935b429110f0978b4d248b86a0e5bf4fe62355f3ef06
SHA512 4f1cbb5a84c9c867e4c4ca0f984351b08549299496368c042672a15b59d3320750f99c444ce55263653158bb997e88960b17c2360f89bab66c2d4dd2b6c8449b

memory/3380-35-0x0000000002540000-0x0000000002556000-memory.dmp

memory/4692-36-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

MD5 74f145f1bc8fe95013f30cff035aef28
SHA1 c1e73bf94b6a8bdb8e133a9cf69ad02895b222a6
SHA256 4938bb8c9f1cf0f55c3e555b816632eb84a1e2cef0b08548f53400f43ede38c1
SHA512 1792c711d1670838bac98f332a38bd70064cfac5324e216143127450cdb915b1fba5b07d201a82a7d16c444428d72014707883b86275e868a166d0e4f640c008

C:\Users\Admin\AppData\Local\Temp\FDA9.exe

MD5 8df804b7c38381235cdc4de8fc6effb3
SHA1 ff6f124968263095c0ae5319c31c117a9dbf5110
SHA256 a090498895b60752c0c1ce3a574341ebdd044ee902e265506ef39caf677d17c5
SHA512 c0623fc66a05f00fea15fa6f09f7c5a82e6a131a148457238676725cd803d1cb2261764fc4adab1add4b215855f7df22be894d63850e8c0f6b8c2e84f3d9f319

C:\Users\Admin\AppData\Local\Temp\FDA9.exe

MD5 8df804b7c38381235cdc4de8fc6effb3
SHA1 ff6f124968263095c0ae5319c31c117a9dbf5110
SHA256 a090498895b60752c0c1ce3a574341ebdd044ee902e265506ef39caf677d17c5
SHA512 c0623fc66a05f00fea15fa6f09f7c5a82e6a131a148457238676725cd803d1cb2261764fc4adab1add4b215855f7df22be894d63850e8c0f6b8c2e84f3d9f319

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dp3vV3MI.exe

MD5 f9cbdd75433a855b2be61b3f7eed5c3e
SHA1 0b6d3153422dac2f4ba68387b9cacba96d888212
SHA256 c94f2463f7871ee7db1449cc74b9447144920c29ec927fb97b52793694dcf6a5
SHA512 915dcde43e00c5539e2f7c59760f68495a10ebefb679c0fe134a7fc2def9f227d3cc2ad635bb2809841ce88936773131ff9b80c78021141a481a1f5742c67ec8

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dp3vV3MI.exe

MD5 f9cbdd75433a855b2be61b3f7eed5c3e
SHA1 0b6d3153422dac2f4ba68387b9cacba96d888212
SHA256 c94f2463f7871ee7db1449cc74b9447144920c29ec927fb97b52793694dcf6a5
SHA512 915dcde43e00c5539e2f7c59760f68495a10ebefb679c0fe134a7fc2def9f227d3cc2ad635bb2809841ce88936773131ff9b80c78021141a481a1f5742c67ec8

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Nl6LZ0xt.exe

MD5 43b51da3bbea33f93e0e50e4b8015c66
SHA1 baa497e2f914fe90b28fc57e533467afd66089e6
SHA256 9ac1db93ad396bd57140d963e6c2c66824e0127872854440367e5685a4ba0fad
SHA512 5f62d87bbb5cdb93ceb6137dccf67c6308606816cc270e0bc5993d96a26b02d3008ffcd83eef9ab510d49b232c4619affe7a1f53f488fdb696203359c1635f5d

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Nl6LZ0xt.exe

MD5 43b51da3bbea33f93e0e50e4b8015c66
SHA1 baa497e2f914fe90b28fc57e533467afd66089e6
SHA256 9ac1db93ad396bd57140d963e6c2c66824e0127872854440367e5685a4ba0fad
SHA512 5f62d87bbb5cdb93ceb6137dccf67c6308606816cc270e0bc5993d96a26b02d3008ffcd83eef9ab510d49b232c4619affe7a1f53f488fdb696203359c1635f5d

C:\Users\Admin\AppData\Local\Temp\F7.exe

MD5 286aba392f51f92a8ed50499f25a03df
SHA1 ee11fb0150309ec2923ce3ab2faa4e118c960d46
SHA256 ecf04cf957e7653f20ef2d0d73b63040620a6e36a53605ab2242cbef40f7fb22
SHA512 84e1535026a4fce44bb662a21221ca295a9f894b0bd2a03e1e5720f6c9734d849f7fe5f997c14badc520ddd0b5bd507f49556a432b6ccd8e4c73d34a0a17421c

C:\Users\Admin\AppData\Local\Temp\F7.exe

MD5 286aba392f51f92a8ed50499f25a03df
SHA1 ee11fb0150309ec2923ce3ab2faa4e118c960d46
SHA256 ecf04cf957e7653f20ef2d0d73b63040620a6e36a53605ab2242cbef40f7fb22
SHA512 84e1535026a4fce44bb662a21221ca295a9f894b0bd2a03e1e5720f6c9734d849f7fe5f997c14badc520ddd0b5bd507f49556a432b6ccd8e4c73d34a0a17421c

C:\Users\Admin\AppData\Local\Temp\FF7F.bat

MD5 e79bae3b03e1bff746f952a0366e73ba
SHA1 5f547786c869ce7abc049869182283fa09f38b1d
SHA256 900e53f17f7c9a2753107b69c30869343612c1be7281115f3f78d17404af5f63
SHA512 c67a9a5a366be8383ad5b746c54697c71dbda712397029bc8346b7c52dd71a7d41be3d35159de35c44a3b8755d9ce94acda08d12ff105263559adb6a6d0baf50

C:\Users\Admin\AppData\Local\Temp\221.exe

MD5 1aba285cb98a366dc4be21585eecd62a
SHA1 c6f97ddd38231287ca6a9bb3cf3b5eefb0bf9b9b
SHA256 ffa9f51e3c68fedcd1d07567206d777456ae6dd12b9540c11ad45c36adfa32a8
SHA512 9fa385f257b974ab16b5b52af89fb3867b49a5ddcf02a11449b1557293ef870a9c31e3da33fad5898b568356266ffac5b3d80881bd981d354311cbcd7a75b439

C:\Users\Admin\AppData\Local\Temp\221.exe

MD5 1aba285cb98a366dc4be21585eecd62a
SHA1 c6f97ddd38231287ca6a9bb3cf3b5eefb0bf9b9b
SHA256 ffa9f51e3c68fedcd1d07567206d777456ae6dd12b9540c11ad45c36adfa32a8
SHA512 9fa385f257b974ab16b5b52af89fb3867b49a5ddcf02a11449b1557293ef870a9c31e3da33fad5898b568356266ffac5b3d80881bd981d354311cbcd7a75b439

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ZJ5vC5Je.exe

MD5 a0ee295f99700e83eb44157c57a4a83d
SHA1 0c8ffcd9de33a8741a52d03b10aa0558ec4b5ab3
SHA256 76ee3f71cb52646650c18d5a5bdef5418b327fc27a12716a61dcba1a06b7f2bd
SHA512 e4ef72c63705466c3d38580c1821be17cbcb4b91a0915ba505dfab07b157f66ab8fb53795c2855e13a553bda757e99ac76d6b2bb2d7ad6c3cb846c6fc177f0fe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ZJ5vC5Je.exe

MD5 a0ee295f99700e83eb44157c57a4a83d
SHA1 0c8ffcd9de33a8741a52d03b10aa0558ec4b5ab3
SHA256 76ee3f71cb52646650c18d5a5bdef5418b327fc27a12716a61dcba1a06b7f2bd
SHA512 e4ef72c63705466c3d38580c1821be17cbcb4b91a0915ba505dfab07b157f66ab8fb53795c2855e13a553bda757e99ac76d6b2bb2d7ad6c3cb846c6fc177f0fe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\dU5oC5uB.exe

MD5 3d5619975677aac65fe74649dbce6c57
SHA1 7511772f648d8d5e7ccd99c0a960c864f0759ddb
SHA256 14fe9290ab604dc467ff418e9afacf63e391562fa2de091021dfceba9de04dff
SHA512 9ac381ff7f08d0eecc4fd86e87a63cfa7546c10ea8f164c8d8cfdd2907d63680f0675e09894d27b02fd5fc2e802ae732cfad02ff3d39f27d0c9eb721867e0178

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\dU5oC5uB.exe

MD5 3d5619975677aac65fe74649dbce6c57
SHA1 7511772f648d8d5e7ccd99c0a960c864f0759ddb
SHA256 14fe9290ab604dc467ff418e9afacf63e391562fa2de091021dfceba9de04dff
SHA512 9ac381ff7f08d0eecc4fd86e87a63cfa7546c10ea8f164c8d8cfdd2907d63680f0675e09894d27b02fd5fc2e802ae732cfad02ff3d39f27d0c9eb721867e0178

memory/2024-88-0x00000000000E0000-0x000000000011C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1oC81UF7.exe

MD5 64309252cd2b9cd86db027a1d455ccf8
SHA1 8c0048a67f6fc9cdfe27d1e11ec6337a26b12639
SHA256 d6bbd0ed0c114d616d20cb595ca35379c33865d5f7238730fa5e46db7d9443b5
SHA512 d9f3384544b1502d363c173639ff0c9ad0d77cf0b56c19fbdf78ba9c4d95cf1172d9d45d1fd61bedc0d025f95d56a124fd783d206e51f61743c6a4baf73d51c4

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1oC81UF7.exe

MD5 64309252cd2b9cd86db027a1d455ccf8
SHA1 8c0048a67f6fc9cdfe27d1e11ec6337a26b12639
SHA256 d6bbd0ed0c114d616d20cb595ca35379c33865d5f7238730fa5e46db7d9443b5
SHA512 d9f3384544b1502d363c173639ff0c9ad0d77cf0b56c19fbdf78ba9c4d95cf1172d9d45d1fd61bedc0d025f95d56a124fd783d206e51f61743c6a4baf73d51c4

memory/2024-93-0x0000000007570000-0x0000000007B14000-memory.dmp

memory/2024-94-0x0000000007060000-0x00000000070F2000-memory.dmp

memory/4228-97-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2024-99-0x00000000072E0000-0x00000000072F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2bZ811TH.exe

MD5 43fd79f4d388a3f27eebf191bb67eec8
SHA1 715e97de135fc0a5f6ae380e2f6514b4bb2c55fb
SHA256 81542f456b81cdf99c65e968bb9d54b3bf227d204eed3eb4afa150c79ecb0498
SHA512 9cd871316d8c357e575a7e8082ae5ba55034df1dabfa08bd934fe4eaa006ff1ba494d64a87c3b745c0afb93022153f86328898f2194ed388832983cf7273bcfd

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2bZ811TH.exe

MD5 43fd79f4d388a3f27eebf191bb67eec8
SHA1 715e97de135fc0a5f6ae380e2f6514b4bb2c55fb
SHA256 81542f456b81cdf99c65e968bb9d54b3bf227d204eed3eb4afa150c79ecb0498
SHA512 9cd871316d8c357e575a7e8082ae5ba55034df1dabfa08bd934fe4eaa006ff1ba494d64a87c3b745c0afb93022153f86328898f2194ed388832983cf7273bcfd

memory/1780-106-0x0000000000370000-0x00000000003AC000-memory.dmp

memory/1780-105-0x0000000072F70000-0x0000000073720000-memory.dmp

memory/2024-101-0x0000000006FF0000-0x0000000006FFA000-memory.dmp

memory/4228-100-0x0000000000400000-0x0000000000433000-memory.dmp

memory/4228-96-0x0000000000400000-0x0000000000433000-memory.dmp

memory/4228-95-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2024-89-0x0000000072F70000-0x0000000073720000-memory.dmp

memory/2024-108-0x0000000007400000-0x000000000750A000-memory.dmp

memory/2024-109-0x0000000007260000-0x0000000007272000-memory.dmp

memory/1780-107-0x0000000008190000-0x00000000087A8000-memory.dmp

memory/1780-110-0x0000000007430000-0x000000000746C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8f30b8232b170bdbc7d9c741c82c4a73
SHA1 9abfca17624e13728bd7fa6547e7e26e0695d411
SHA256 0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb
SHA512 587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

memory/1780-112-0x0000000007B70000-0x0000000007BBC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8f30b8232b170bdbc7d9c741c82c4a73
SHA1 9abfca17624e13728bd7fa6547e7e26e0695d411
SHA256 0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb
SHA512 587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8f30b8232b170bdbc7d9c741c82c4a73
SHA1 9abfca17624e13728bd7fa6547e7e26e0695d411
SHA256 0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb
SHA512 587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8f30b8232b170bdbc7d9c741c82c4a73
SHA1 9abfca17624e13728bd7fa6547e7e26e0695d411
SHA256 0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb
SHA512 587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

\??\pipe\LOCAL\crashpad_1932_CENXBYNMROZYHMYN

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8f30b8232b170bdbc7d9c741c82c4a73
SHA1 9abfca17624e13728bd7fa6547e7e26e0695d411
SHA256 0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb
SHA512 587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8f30b8232b170bdbc7d9c741c82c4a73
SHA1 9abfca17624e13728bd7fa6547e7e26e0695d411
SHA256 0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb
SHA512 587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

\??\pipe\LOCAL\crashpad_1448_LQHIXIWUICUTFCCG

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 ea25621369b21e87cbf85c4782f0c2bc
SHA1 b970a61a73b431ceb9b22a7b08b36bf7df5e0059
SHA256 2f362031c3f7b52cd3eb6fa93466719bf57abbc8475920014cdafd39f9a61ef5
SHA512 e233e3c9cc8d451a622b40e1d7564193ff85a3f70566bac76f46a532bf548666b7d07a5b89690b8020d20df7355f01feee2b10440ae33d1203ba7e3b9884e3c7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8b898c11e6ef7faddbf8b92f1739837d
SHA1 829876426ec021299f783a88a87b198b5a284a6c
SHA256 da2a9a05d9e924f646c8f5721275dc032a637f036893756fabc75171514d8b0c
SHA512 5c951b28cb874c1fec15c8a6f749496fd4d733b2e88454ec701542973d3a908f7a4fca3cbf0fb5bb6e1a280dc81eb7749ef2581b4d836ab55437aaa94615f4bd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8f30b8232b170bdbc7d9c741c82c4a73
SHA1 9abfca17624e13728bd7fa6547e7e26e0695d411
SHA256 0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb
SHA512 587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8f30b8232b170bdbc7d9c741c82c4a73
SHA1 9abfca17624e13728bd7fa6547e7e26e0695d411
SHA256 0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb
SHA512 587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8f30b8232b170bdbc7d9c741c82c4a73
SHA1 9abfca17624e13728bd7fa6547e7e26e0695d411
SHA256 0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb
SHA512 587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8f30b8232b170bdbc7d9c741c82c4a73
SHA1 9abfca17624e13728bd7fa6547e7e26e0695d411
SHA256 0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb
SHA512 587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8f30b8232b170bdbc7d9c741c82c4a73
SHA1 9abfca17624e13728bd7fa6547e7e26e0695d411
SHA256 0916f816feace92a097267171f8aa8f944074530574a7aa1f9f0334899dfa3eb
SHA512 587d973b13b97c5b92621c776c18348a13ef451ccda32977baa529de33e47a27e7920a57fe7c4d0b2f0e4a8a3bca5c62cc5798cf97f19556028f88afb38b37be

memory/2024-223-0x0000000072F70000-0x0000000073720000-memory.dmp

memory/2024-232-0x00000000072E0000-0x00000000072F0000-memory.dmp

memory/1780-240-0x0000000072F70000-0x0000000073720000-memory.dmp

memory/1780-259-0x0000000007310000-0x0000000007320000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2D2A.exe

MD5 699c65fed2ca6370f86d5da5f70ee9c2
SHA1 f27c46e0e5bf076326392f0f4e1976f8ecd6db35
SHA256 f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d
SHA512 87c847e190fbac40ccc8a21c16ab120a74c71b1d157137935c8305725715f14b76b823e098b1d44b6b94b040183c2a76f9a6bfe0788ce19eee7866c2936e9692

C:\Users\Admin\AppData\Local\Temp\2D2A.exe

MD5 699c65fed2ca6370f86d5da5f70ee9c2
SHA1 f27c46e0e5bf076326392f0f4e1976f8ecd6db35
SHA256 f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d
SHA512 87c847e190fbac40ccc8a21c16ab120a74c71b1d157137935c8305725715f14b76b823e098b1d44b6b94b040183c2a76f9a6bfe0788ce19eee7866c2936e9692

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 abd4f941255fcce906b6bbdbcda29b56
SHA1 37e638ac83bb34c6e577668e15ddf6d271efa7d9
SHA256 44323c65320d8cdbc75f910da0a321dd2d60955389ca0aad3bae7aac7ac63edb
SHA512 0bde8787bd930904afecd25d907dbd4ac210492fbdccf67d43165e6b589e81f893d9ec9a39d40b6796a7796cc808e17334b009935af161b9502ab7f2fa4e91dd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 ac6a20d269af468f51b2d1d3d24a6457
SHA1 4a57cd19baeee05fce9558539ce33a422ee98b8d
SHA256 fefacb9f8a17553e74ef4d6e7a633ea2f2a72d963e952276afc0eb46036a8d5a
SHA512 a36fc183bd2b95bd506cca1ebae9cc5df165c76ebd9bd089efd7b439bda25e76826c93aed04b101782f17331d717e105c892c2d55f63a03996a1e4de47428dfc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 eca04424f8f4a351aa9c5877ba024a71
SHA1 9253c4f555f3eb36defc6a59f3dd0734dd4a0476
SHA256 144fa2fb874264f2bddd89ff80218e6f37bc72f04e3747f57553ac921b3dce74
SHA512 6c179a843d1dd2f0b0e2c945cd64255a2b4fefddff9f284c1e021f1d9f8883c5549fee6ac5f9ab90b920069201542ff13bfdb24c89c2deb31a701926c7879e17

memory/5180-304-0x0000000072F70000-0x0000000073720000-memory.dmp

memory/5180-306-0x0000000000780000-0x0000000001414000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 ea25621369b21e87cbf85c4782f0c2bc
SHA1 b970a61a73b431ceb9b22a7b08b36bf7df5e0059
SHA256 2f362031c3f7b52cd3eb6fa93466719bf57abbc8475920014cdafd39f9a61ef5
SHA512 e233e3c9cc8d451a622b40e1d7564193ff85a3f70566bac76f46a532bf548666b7d07a5b89690b8020d20df7355f01feee2b10440ae33d1203ba7e3b9884e3c7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c0f5503a6f0295a5eb5a568cf25adae4
SHA1 6e7897ea783a416a408ceee3674bfc05360a789c
SHA256 fcf3e4fe65b8cb517e5e80c9465df420ecec8eb2272a265cf2ab475cc4f534b9
SHA512 9bf3037882835a4762d0f07940a6cde14ef009d36103094cbb7a10865e4cf9e797368d98525a6563c73e64f0300aa174adb0cf10f088d6a34ef645c6896f6482

C:\Users\Admin\AppData\Local\Temp\3B63.exe

MD5 ed1e95debacead7bec24779f6549744a
SHA1 d1becd6ca86765f9e82c40d8f698c07854b32a45
SHA256 e9955f64d2e3579dc9d2edf2b75a4c272738f3d78d05b16ebfa7632cc1d89651
SHA512 32ddac199c036567fa4e7d10775951a62b64f562b9afba9462c5a3bf333caa92462c036655d1b9ba9dbd961a628f6314455f812817ecbc8a49cbc8c807db9c84

C:\Users\Admin\AppData\Local\Temp\3D58.exe

MD5 0592c6d7674c77b053080c5b6e79fdcb
SHA1 693339ede19093e2b4593fda93be0b140be69141
SHA256 fe19cdb149ecd8fd116f048852dcc10e46a3521351102685ce25c61a7d962a14
SHA512 37f2ff110b0702229b888280c8c2dff7885e6b1e583ccc47c36e74f44adfa491f70d6d6ab95d79149437d6fd9400448f1046eee3676ea98dffe99bc28e4783cb

C:\Users\Admin\AppData\Local\Temp\3F3E.exe

MD5 5d0310efbb0ea7ead8624b0335b21b7b
SHA1 88f26343350d7b156e462d6d5c50697ed9d3911c
SHA256 a43f3cf974c02ae797b15d908b0ce1253781e9523a3a5831c199cb4d5dcbda4a
SHA512 ac88ba67e5a88ff99521d7f30c75dffadbb92ef3517eb804713896006f3dc57294742fcf666db5510bd7f43f89d4d11c62b817e31dfd94c2343eced1576be7a7

C:\Users\Admin\AppData\Local\Temp\3F3E.exe

MD5 5d0310efbb0ea7ead8624b0335b21b7b
SHA1 88f26343350d7b156e462d6d5c50697ed9d3911c
SHA256 a43f3cf974c02ae797b15d908b0ce1253781e9523a3a5831c199cb4d5dcbda4a
SHA512 ac88ba67e5a88ff99521d7f30c75dffadbb92ef3517eb804713896006f3dc57294742fcf666db5510bd7f43f89d4d11c62b817e31dfd94c2343eced1576be7a7

C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

MD5 032a919dff4e6ba21c24d11a423b112c
SHA1 cbaa859c0afa6b4c0d2a288728e653e324e80e90
SHA256 12654cd367670f7f16dfd08210e2d704b777fcdd54a76a0c6e9925f588161553
SHA512 0c9edc1ef763cdcd3a5821644c23bb833b4b7080a9715fa58bd91f4b5a4ab98548c3c195835ed547264d22359dc4f341e758d5588d1d2ede1ef6bebd5df0785c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 0b8abe9b2d273da395ec7c5c0f376f32
SHA1 d7b266fb7310cc71ab5fdb0ef68f5788e702f2ec
SHA256 3751deeb9ad3db03e6b42dedcac68c1c9c7926a2beeaaa0820397b6ddb734a99
SHA512 3dd503ddf2585038aa2fedc53d20bb9576f4619c3dc18089d7aba2c12dc0288447b2a481327c291456d7958488ba2e2d4028af4ca2d30e92807c8b1cdcffc404

memory/5668-364-0x0000000000B40000-0x0000000000B5E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 5575d045a1f2def3ae9d8546ddb74548
SHA1 5198f0a1f745186ccc08dd02451927bc486eff7d
SHA256 4e1d58da54f537037ea9f4cf79396946d9036959dba3347bfd4e3747fb77b026
SHA512 680417e807186f659317e7f0a6fa4825885ddfe71b5d03aba758e15df6fdf620323d016c3f88331df1c7e976eeb95b548ea1af3cfc85022db2d1f06f290d7827

memory/5668-375-0x0000000072F70000-0x0000000073720000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe

MD5 5d0310efbb0ea7ead8624b0335b21b7b
SHA1 88f26343350d7b156e462d6d5c50697ed9d3911c
SHA256 a43f3cf974c02ae797b15d908b0ce1253781e9523a3a5831c199cb4d5dcbda4a
SHA512 ac88ba67e5a88ff99521d7f30c75dffadbb92ef3517eb804713896006f3dc57294742fcf666db5510bd7f43f89d4d11c62b817e31dfd94c2343eced1576be7a7

memory/5668-399-0x00000000054A0000-0x00000000054B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 0377dfbfa3dd6709118f35d1d0c33b71
SHA1 194dcc880ec2a9d7cadd51c27858ef2c3a2f087a
SHA256 b825586482565a13e4b4c004cf87f9e9d5980ba4446ec5f8d0c8acd5720bf632
SHA512 c1376f728d94c86b7785f00bf73982d2d6867d9d6988c58a1f0b13afd4fb249db75f6fd096a05339e12ea1949a3e1d86a0469bad121b816a08fcc794fb3c5c9f

memory/5056-405-0x00000000020A0000-0x00000000020FA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 020ad283a781f7ff82b32ca785d890e4
SHA1 6c0dfa83de61c67bddef5d35ddefac9eacf60dc3
SHA256 9532da8b4316e7ece17b4c4a4b7284f5438c91bf0c4ff9c73aabeabd10436629
SHA512 b9d485a90cc61719b6303ee9b7f0ae60cf4768a06bf3407ad61a1f521999f25886c1730d990b913d7a045c84c06331d00cf081712ddd8438167d9d004798bb95

memory/5056-382-0x0000000000400000-0x0000000000480000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 a86143e8c5f35ef49465c6c24643780b
SHA1 0d5923c90e2553869a2ef7b7f7dd488434a6fc31
SHA256 3dcd84cb43cadb51ba2af15319e0a2fecd41393ba825cad08b50fa1200607248
SHA512 ee691dd5f1fc188458cfeb062e05b55b4b5320144b5e3b13f1a8dab0bfa80a08127cc9c8259f9af1aaf665ec5ca481f8693aab179f92f60a994f6329f1e6755e

memory/5056-424-0x0000000072F70000-0x0000000073720000-memory.dmp

memory/6860-438-0x0000000000090000-0x0000000000098000-memory.dmp

memory/6688-445-0x0000000000E40000-0x0000000000E41000-memory.dmp

memory/6860-446-0x000000001AC30000-0x000000001AC40000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\latestX.exe

MD5 bae29e49e8190bfbbf0d77ffab8de59d
SHA1 4a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256 f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA512 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

memory/5180-472-0x0000000072F70000-0x0000000073720000-memory.dmp

memory/6860-440-0x00007FFEE0B10000-0x00007FFEE15D1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\kos4.exe

MD5 01707599b37b1216e43e84ae1f0d8c03
SHA1 521fe10ac55a1f89eba7b8e82e49407b02b0dcb2
SHA256 cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd
SHA512 9f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

memory/5056-538-0x0000000000400000-0x0000000000480000-memory.dmp

memory/5056-539-0x0000000072F70000-0x0000000073720000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\114462139309

MD5 5d3b605d140078e93dff78eae983e2f7
SHA1 dd83c1af596fdaf402a49d180a0b97ed1088c7a8
SHA256 c61c5803233bba957e5e984da0799edf7bbf9cc37b8cbc3674b497da3922180a
SHA512 7bad5e698bc60a2abcc302620ab094e1395d6be11c4cb1eed3925f991043e262590bb7dff65602e6836ca94cad45dbe8c9f456b06d5a974f3c446a82bef98693

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

MD5 0dd544ca4ccb44f6ed5cf12555859eb7
SHA1 f702775542adefab834a1f25d8456bec8b7abfd9
SHA256 7b412527489f5ffedebed690b6ec7252d5b2f4cb75b7e71e3d6eab6e9d0fe98a
SHA512 1cf4e6e9e1d19db819331140aaefefe80d81332ef9eebe8bfe04676e3893acc891b67bb9fd0843d6bfb349e4f683dfb8890c82535d97bf408b78306a6102dfd0

memory/5668-572-0x0000000072F70000-0x0000000073720000-memory.dmp

C:\Users\Admin\AppData\Roaming\aca439ae61e801\cred64.dll

MD5 0111e5a2a49918b9c34cbfbf6380f3f3
SHA1 81fc519232c0286f5319b35078ac3bb381311bd4
SHA256 4643d18bb8be79c2e3178bc3978d201c596ab70a347e8cf1e8fdbe3028d69d7c
SHA512 a2aac32a2c5146dd7287d245bfa9424287bfd12a40825f4da7d18204837242c99d4406428f2361e13c2e4f4d68c385de12e98243cf48bf4c6c5a82273c4467a5

C:\Users\Admin\AppData\Roaming\aca439ae61e801\clip64.dll

MD5 8da053f9830880089891b615436ae761
SHA1 47d5ed85d9522a08d5df606a8d3c45cb7ddd01f4
SHA256 d5482b48563a2f1774b473862fbd2a1e5033b4c262eee107ef64588e47e1c374
SHA512 69d49817607eced2a16a640eaac5d124aa10f9eeee49c30777c0bc18c9001cd6537c5b675f3a8b40d07e76ec2a0a96e16d1273bfebdce1bf20f80fbd68721b39

memory/5668-656-0x00000000069F0000-0x0000000006BB2000-memory.dmp

memory/5668-681-0x00000000070F0000-0x000000000761C000-memory.dmp

memory/5668-689-0x00000000054A0000-0x00000000054B0000-memory.dmp

memory/6860-719-0x00007FFEE0B10000-0x00007FFEE15D1000-memory.dmp

memory/5668-796-0x0000000006C60000-0x0000000006CC6000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 165c892c0bb13ca6a9de27aff8136a2b
SHA1 074097bb6d0bf8c0411b1fb8243a22d597cde3aa
SHA256 86a580d9e80a5171167e5a7ffc188d34d83c7ade2602ffbe0a4dff5b4a06e16f
SHA512 923d0c999916266c15c499ad2e6262c5a65443b51411ba8b49fd038a8180a6f14e273af58b096ffe447df788b839324fc5b48be0ede345e7f08bda1f8b6a238e

memory/5668-814-0x0000000006E70000-0x0000000006EE6000-memory.dmp

memory/6688-816-0x0000000000E40000-0x0000000000E41000-memory.dmp

memory/6860-817-0x000000001AC30000-0x000000001AC40000-memory.dmp

memory/5668-823-0x0000000006F70000-0x0000000006F8E000-memory.dmp

memory/6552-825-0x00000000009F0000-0x0000000000AF0000-memory.dmp

memory/6860-827-0x00007FFEE0B10000-0x00007FFEE15D1000-memory.dmp

memory/6832-829-0x0000000000400000-0x0000000000409000-memory.dmp

memory/6552-828-0x0000000000810000-0x0000000000819000-memory.dmp

memory/6832-830-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 cf6fbe8bf09d7b1d6308190f0c8c2a9a
SHA1 4f8d8a9db30703b99ad52815159f1a92b2953760
SHA256 8b4783cb57a92d08438fdfadace6728e3c7fb03d83751f4a0d6b902a9ff91a28
SHA512 9012c46a7c11214e6cfc4f6bdb1b45e61839c722f17b23899bd0ae8f39f11c5e169776c2a40222548d29abd91dc458a25f0fe1e4678084698c9dfb98603d3535

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588a78.TMP

MD5 272045f47774d3d877fe1c0b6141a860
SHA1 cc8dddfaf6c9cc137818f43fceb9bc7d606cf4b4
SHA256 cf52db928d49843964168aa0329623a499cc4c6482f3f26f169bafb913df923f
SHA512 3389cefe22b48ade1cd508b7aac0620b37d3aa7588f80c77034cd47ce225307549cf3edd196bfbf24ccf56ddc0a41942b0843074efb5b886d488215f1e2281c0

memory/6712-861-0x0000000002970000-0x0000000002D6E000-memory.dmp

memory/6712-862-0x0000000002D70000-0x000000000365B000-memory.dmp

memory/6712-864-0x0000000000400000-0x0000000000D1B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 9d43026dd5a43f74b72d84c9753992f0
SHA1 c5381580f67608d26da04e7bc4777355b14844ee
SHA256 82713082823104ce6ae1371caf3eb9ba0529db63c341c8cec5be023216028e50
SHA512 04579541327572c0c58a27e3e469dd61a4c678d8b75c5b4abbf5dc2f892b67e8ddf389d21bd64e7fb5a3142b9c11a7d17b4ed8f0919fa187f8a115a1be716e62

memory/6832-888-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3380-887-0x0000000002B40000-0x0000000002B56000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 3f22448bbe9c48efc9eab79097a02b5c
SHA1 9c75fafc0fc8793964a6a378259fa752eb1848bf
SHA256 2446d296f58713575cc2f798a3ef3969a7d6633c4e3254f1d546804c7bb3b261
SHA512 3d03600bc4acc9ef42abfd47f510594f60714e4b2fb995779d01a4f3dfd7813af10278be2f00ea09b08ed0de0622d08ef0a8e6442154f4eef718e25ba158aa5c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589f29.TMP

MD5 838b46f2ea672d508a33a6cc4123215a
SHA1 dc62d38268a6ac6c847a7b0448a20024bf6a20fe
SHA256 2309051f5fda2979aaa0ee5704cc03a1c6be27ce8c5cb90a2cdc6c77338a5ca9
SHA512 5c2f6ffc5f6cd91029aa01ffffdd9cb6f12d4646bb2995f59dfacff0f63f730f7fd05014a40efc038df6a79d94537bd2c42be2a79864027d885d907dd8c75f46

C:\Users\Admin\AppData\Local\Temp\tmpA2BB.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmpA2E1.tmp

MD5 bc741c35d494c3fef538368b3cd7e208
SHA1 71deaa958eaf18155e7cdc5494e11c27e48de248
SHA256 97658ad66f5cb0e36960d9b2860616359e050aad8251262b49572969c4d71096
SHA512 be8931de8578802ff899ef8f77339fe4d61df320e91dd473db1dc69293ed43cd69198bbbeb3e5b39011922b26b4e5a683e082af68e9d014d4e20d43f1d5bcc30

C:\Users\Admin\AppData\Local\Temp\tmpA34A.tmp

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\Users\Admin\AppData\Local\Temp\tmpA370.tmp

MD5 1d693e27a9aebb6d29f70fd50c552f35
SHA1 080c5dc5960d6f286b9e6c456f99b334caa1f21e
SHA256 120e8c84fad58fee07ec088d863c22ff6f8758ed78a20de425039b7596caf30b
SHA512 d698f737f4f7a7bbd4b36c5f087409da86b3cab7ba82f296452a8b86d48db4c66717e7d9e2a0bda9ca3be983ed7a16b4a59dcc50d8171c2b401818e0ae40fb14

memory/5668-1019-0x0000000007940000-0x0000000007990000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpA3FE.tmp

MD5 f706c91c5c1c1dd7d24e99c636b7bbcc
SHA1 ba35836e4b4c79d05abe56f035321ff3b781c21d
SHA256 8103de1d65f172256d2da37aeb1999b604300b447df1f45d0f70d1c14599f4ba
SHA512 c45416e00d64378f63331048cf1915687128c2b38af333df05f91622ad7e6492b163e7efee4abfff65572e224999bf4fbd7883072b85344e5c3feb0ea0624063

C:\Users\Admin\AppData\Local\Temp\tmpA449.tmp

MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

memory/5668-1071-0x0000000072F70000-0x0000000073720000-memory.dmp

memory/6544-1072-0x00000000028E0000-0x0000000002916000-memory.dmp

memory/6544-1073-0x0000000072F70000-0x0000000073720000-memory.dmp

memory/6544-1074-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

memory/6544-1075-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

memory/6544-1076-0x0000000005200000-0x0000000005828000-memory.dmp

memory/6544-1077-0x0000000005110000-0x0000000005132000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dycurzbo.5be.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/6544-1083-0x00000000058A0000-0x0000000005906000-memory.dmp

memory/6544-1088-0x0000000005A80000-0x0000000005DD4000-memory.dmp

memory/6544-1091-0x0000000005EC0000-0x0000000005EDE000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f4452278-0a1d-47f0-889b-e4988725faf0\index-dir\the-real-index

MD5 128914a0f8f8cf7ebc9224f62d8b986a
SHA1 47a215c8323c8cac38cf0f5c6babaa80c127ac6b
SHA256 29a1181e5ea99913881a451852934cf050e01e15819e3e2323bc8ee27d5bb643
SHA512 e5cdec79da246c41e2e479485c980244144a382cc4d36dcd993de10f514d56094ec960a57df849ee128c1d6a149cf8df88532b8f410cbfb95bf432473e65b2a9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f4452278-0a1d-47f0-889b-e4988725faf0\index-dir\the-real-index

MD5 1e50c9bec32534c5e43af87809dd074f
SHA1 e26ae58a60785923f8e8a2eb877f8b636840d4f8
SHA256 e7c60e4e82dcdeca0356fdfe197ba91751b700d1d83b539b429c629d23febabd
SHA512 d7b3630318614700ac238182e91b850e9ca0fcf31469d9a3d4b0c0cd0c8b69f9677c06531f40763d3a77c7fa73567dc3c1b1eceb63e4dde4af5e24d28feb5a66

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 cd3ee7bf80494159747a7967b207c4fb
SHA1 e331899f1dac4edd72dfa7bdfc1f24ffd523ca17
SHA256 225bac9a51273f9a9d3d96fc3dd18e6d9f1c2fd788fe539fd9acae0981390697
SHA512 8db4cfde06869d7a679565ffad08a19cbc036df362e8f7a752a2384ee30b391f147d9f37b97962d7111553cc2b780c471e2cfe8b3c82ee6a844d05b748ab6195

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 67a442be1c7d5077ab29c8196b2773d3
SHA1 5298db71f6788e5f55093b5d633e1fae90c2ca08
SHA256 42b3444305726d8d86ea36edfa6023cbde805bb00f95474cf03f1e97b296fb5c
SHA512 c2087bd188e1dae5b398c4fa747699d3773d430d48be40b15e6693a824f55a7370795c75a17c051e9597f5d63d3295168f9f904993e0ed4cb7b467c16b549198

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\cc7f9d79-b648-495f-b951-7c709cdf8554\index-dir\the-real-index

MD5 ca78ce922d1c2a79a9fa99c037de8ce8
SHA1 09f9788573fa3ebd0a61b5ae4fa5a1921b3a04ee
SHA256 76888077c828061bd871226585963d55bb1f422662ffb373ecb8c82c3b3d481b
SHA512 64c24a78e485d326faeb7aca92ff00010edd2f17a694221f58d265c3ed362f68f2852b1353cae048ff5aaeddbc48593bbd323411fcd5afaf8dceddc310617dbd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\cc7f9d79-b648-495f-b951-7c709cdf8554\index-dir\the-real-index~RFe58cf90.TMP

MD5 388327e196e373aca087de533643f6aa
SHA1 28d2757a68e90941b81481879ba7697ab10333ec
SHA256 97bccc336a41000e95d8fc2fedbafff1f6e02ff628f6597f5444019125c92f4f
SHA512 4d15a1ea7acb8e9844cedcfd31ea065261a4547df0402cf71ef6a0b421b637e86f053f9f36857d7b92ffeadd24305389362cb45957eb73a5fb0ca6492963b7c4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 b991b8ff9db1e49cd7c4f77358b4bba4
SHA1 2ad06c5f0c4c0e818a7553092fa14e5711189182
SHA256 0f1efd8ca6c93393521ce81118bebac7ca182a667ab7585417cad1485826c259
SHA512 a706980f2af2d9164fed1a3448896614f55a7ea1eb33aa15441ffb684643c6d1ab5c96b478cf3be2413aa2cb5cca0399992497bd5e16e41528a116ff7878194a

memory/7012-1214-0x00007FF6889E0000-0x00007FF688F81000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 3bb06e51da09e33d9c5812b6417aa0b6
SHA1 ed605874ca433ec490de611ecba886e62052a8bf
SHA256 352552a7f464e3663572cd10b0e0755de8f86dc89fef224cb5b75fcc8b404aa5
SHA512 169e3aa5137093879bbb21305420b6c24c196730d20d4046d36b967e79b3c9fe772c130e91177192a3ec94f87e7919fac2d5ec686c455b0d3bff6f05e21f6e35

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 5d3e933c3bdeb20192bb8a888b4f7e6f
SHA1 a03bbf460f03c4e6dc114a482c6c9ea52062209f
SHA256 de5e8be0e1f267231e4f970dee45d83509c398a9f15e4162b73accc6e0335c03
SHA512 a694c168dd1b38fd5e49d843868db8cbae3142695f2d990290c7c4846ad510c5c5d88db26a8775aebf1c7c19ede2496f632fba23c84d799e3f24952a7424c620

memory/5596-1365-0x0000000000F30000-0x0000000000F6C000-memory.dmp

memory/7152-1366-0x00007FF619360000-0x00007FF619CC6000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 4bd536ef690129905a64adcf7e713152
SHA1 f007f5f53596b2156f0bb222d25f214da22b127d
SHA256 77bea7684b749bc647d41bc0a69ef6397d5fd4d91459c7836940c33ee95af078
SHA512 93c1de970c1536174fa9311fb7b48c83029ef1f1b45c8d3ce445d463305287a62d2aa4221da3b11cc0abcb79437aa3051715c12e406ced51f767ddcc2967ae98

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 364a82ef9964c62d99d6f8c7093a8522
SHA1 eb9487ee4a31b549a1d96dc32f7ce1fe5133f57b
SHA256 21c00f02ca1152fac6adc9513b1a813ec5008bba50b614ef9c6bca510ac73a91
SHA512 954b16072c5fff54513a66949b457b5c59acc3e220295d2a82469d08ab71f675748eacab3d587482dd030ecf490eeb73211aba7289f36a95a3b8254d6f0c41b0

memory/6688-1456-0x0000000000400000-0x0000000000965000-memory.dmp

memory/6712-1457-0x0000000000400000-0x0000000000D1B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 66cb74400963de937bc85b21312c6f57
SHA1 7fca668847be7b24e5838f2f71f1bfdf007303a7
SHA256 49071e82aeb0aa5e624e69ac9b7f1f20d67d9ec6e2ebb0998da4c3f6fb0e3aac
SHA512 ac24388bb1c5d66ad9eaa304f8ee0c8252f9c914550ffe066a67637c08495d00e55bc541875271b29a1134ec97ae459a845906b5cf42f9f490b2001ed4ed2444

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 db2b450ae66bce1b4f55644024260576
SHA1 d4e5df10ac368f37795c54db96f976d6961cd686
SHA256 974ceb5a7313d98777f144092e5d35dbdd87a0bc3bbe3ab5b814b94865e8014f
SHA512 0e3425e050148ffb4648ab9b11e10906d7ea81469308c74411840e227f225ce791af04c1934b8912e422050e4c57be50f7a84a3f80486e63c04f114110927bb3

memory/7164-1490-0x0000000000400000-0x0000000000D1B000-memory.dmp

memory/5156-1491-0x00007FF7F6BD0000-0x00007FF7F7171000-memory.dmp

memory/6884-1492-0x0000000000400000-0x0000000000D1B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 9ee3bdd348deef83580d2226a5c2324f
SHA1 797e2c0930b0080e714f1a20eb1cd55c3ab639c4
SHA256 3a42f8d2579742d1a14694cc56f7ea6eb990969f661cc4d370404c50b5d3fe5b
SHA512 4a0e42faf7b980992783b2b866e3609df1131aa4500b50716bc58340c861e784e7bbdc50e6b6f8b4e5620510e9077c490331a3ccd4879bc8432a9cd031254693

memory/6884-1623-0x0000000000400000-0x0000000000D1B000-memory.dmp

memory/6184-1667-0x0000000000B90000-0x0000000000BB0000-memory.dmp

memory/5156-1666-0x00007FF7F6BD0000-0x00007FF7F7171000-memory.dmp

memory/1096-1673-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/6884-1674-0x0000000000400000-0x0000000000D1B000-memory.dmp

memory/6688-1684-0x0000000000400000-0x0000000000965000-memory.dmp

memory/6884-1687-0x0000000000400000-0x0000000000D1B000-memory.dmp

memory/6688-1689-0x0000000000400000-0x0000000000965000-memory.dmp