Malware Analysis Report

2025-03-14 22:06

Sample ID 231212-e5f4jagcb3
Target c98e8ff8ff04152c062fb39408e19e05.bin
SHA256 feeabd0ec12dfa5f3262e130908a56008d76ef32eb406a72762707bca9331eb9
Tags
dcrat djvu privateloader risepro smokeloader zgrat up3 backdoor google collection discovery evasion infostealer loader persistence phishing ransomware rat spyware stealer themida trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

feeabd0ec12dfa5f3262e130908a56008d76ef32eb406a72762707bca9331eb9

Threat Level: Known bad

The file c98e8ff8ff04152c062fb39408e19e05.bin was found to be: Known bad.

Malicious Activity Summary

dcrat djvu privateloader risepro smokeloader zgrat up3 backdoor google collection discovery evasion infostealer loader persistence phishing ransomware rat spyware stealer themida trojan

Djvu Ransomware

RisePro

SmokeLoader

Detect ZGRat V1

Detected Djvu ransomware

Detected google phishing page

Modifies Windows Defender Real-time Protection settings

DcRat

PrivateLoader

ZGRat

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Modifies file permissions

Checks computer location settings

Drops startup file

Executes dropped EXE

Deletes itself

.NET Reactor proctector

Windows security modification

Checks BIOS information in registry

Themida packer

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Loads dropped DLL

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks whether UAC is enabled

Looks up external IP address via web service

Accesses Microsoft Outlook profiles

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

AutoIT Executable

Drops file in System32 directory

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Program crash

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

outlook_win_path

Checks SCSI registry key(s)

Modifies Internet Explorer settings

Suspicious use of SendNotifyMessage

outlook_office_path

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

Checks processor information in registry

Modifies system certificate store

Uses Task Scheduler COM API

Suspicious use of UnmapMainImage

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-12 04:31

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-12 04:31

Reported

2023-12-12 04:33

Platform

win7-20231023-en

Max time kernel

111s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe"

Signatures

DcRat

rat infostealer dcrat
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\df3c3082-b36d-4721-8ac4-2f526df9bee7\\D9A0.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\D9A0.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detected google phishing page

phishing google

Djvu Ransomware

ransomware djvu

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe N/A

PrivateLoader

loader privateloader

RisePro

stealer risepro

SmokeLoader

trojan backdoor smokeloader

ZGRat

rat zgrat

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\B7DC.exe N/A

Downloads MZ/PE file

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\B7DC.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\B7DC.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A N/A N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4157.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4157.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MZ1kH39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MZ1kH39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gB6wC87.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gB6wC87.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gB6wC87.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MZ1kH39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MZ1kH39.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4WG967Qv.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4157.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4157.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MZ1kH39.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gB6wC87.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\df3c3082-b36d-4721-8ac4-2f526df9bee7\\D9A0.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\D9A0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\4157.exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\B7DC.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A
File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A
File opened for modification C:\Windows\System32\GroupPolicy C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A
File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\B7DC.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4WG967Qv.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4WG967Qv.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4WG967Qv.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6F344911-98A7-11EE-8E05-6267A9FE412E} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6F17B891-98A7-11EE-8E05-6267A9FE412E} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6F3DCE91-98A7-11EE-8E05-6267A9FE412E} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff4b00000000000000d104000065020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 C:\Users\Admin\AppData\Local\943809b2-2de4-4356-9d4d-4439af7b287e\build2.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\943809b2-2de4-4356-9d4d-4439af7b287e\build2.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\943809b2-2de4-4356-9d4d-4439af7b287e\build2.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4WG967Qv.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\B7DC.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2244 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe
PID 2244 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe
PID 2244 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe
PID 2244 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe
PID 2244 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe
PID 2244 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe
PID 2244 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe
PID 1208 wrote to memory of 2604 N/A N/A C:\Windows\system32\cmd.exe
PID 1208 wrote to memory of 2604 N/A N/A C:\Windows\system32\cmd.exe
PID 1208 wrote to memory of 2604 N/A N/A C:\Windows\system32\cmd.exe
PID 2604 wrote to memory of 2612 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2604 wrote to memory of 2612 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2604 wrote to memory of 2612 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 1208 wrote to memory of 1364 N/A N/A C:\Windows\system32\cmd.exe
PID 1208 wrote to memory of 1364 N/A N/A C:\Windows\system32\cmd.exe
PID 1208 wrote to memory of 1364 N/A N/A C:\Windows\system32\cmd.exe
PID 1364 wrote to memory of 2648 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 1364 wrote to memory of 2648 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 1364 wrote to memory of 2648 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 1208 wrote to memory of 2216 N/A N/A C:\Users\Admin\AppData\Local\Temp\B7DC.exe
PID 1208 wrote to memory of 2216 N/A N/A C:\Users\Admin\AppData\Local\Temp\B7DC.exe
PID 1208 wrote to memory of 2216 N/A N/A C:\Users\Admin\AppData\Local\Temp\B7DC.exe
PID 1208 wrote to memory of 2216 N/A N/A C:\Users\Admin\AppData\Local\Temp\B7DC.exe
PID 1208 wrote to memory of 900 N/A N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 1208 wrote to memory of 900 N/A N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 1208 wrote to memory of 900 N/A N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 1208 wrote to memory of 900 N/A N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 900 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 900 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 900 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 900 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 900 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 900 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 900 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 900 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 900 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 900 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 900 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 2756 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Windows\SysWOW64\icacls.exe
PID 2756 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Windows\SysWOW64\icacls.exe
PID 2756 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Windows\SysWOW64\icacls.exe
PID 2756 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Windows\SysWOW64\icacls.exe
PID 1208 wrote to memory of 1480 N/A N/A C:\Users\Admin\AppData\Local\Temp\E380.exe
PID 1208 wrote to memory of 1480 N/A N/A C:\Users\Admin\AppData\Local\Temp\E380.exe
PID 1208 wrote to memory of 1480 N/A N/A C:\Users\Admin\AppData\Local\Temp\E380.exe
PID 2756 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 2756 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 2756 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 2756 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 2988 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 2988 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 2988 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 2988 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 2988 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 2988 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 2988 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 2988 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 2988 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 2988 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 2988 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\Temp\D9A0.exe
PID 1052 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\943809b2-2de4-4356-9d4d-4439af7b287e\build2.exe
PID 1052 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\943809b2-2de4-4356-9d4d-4439af7b287e\build2.exe
PID 1052 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\943809b2-2de4-4356-9d4d-4439af7b287e\build2.exe
PID 1052 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\D9A0.exe C:\Users\Admin\AppData\Local\943809b2-2de4-4356-9d4d-4439af7b287e\build2.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe

"C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe"

C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe

"C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe"

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\AB1E.bat" "

C:\Windows\system32\reg.exe

reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\AD22.bat" "

C:\Windows\system32\reg.exe

reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1

C:\Users\Admin\AppData\Local\Temp\B7DC.exe

C:\Users\Admin\AppData\Local\Temp\B7DC.exe

C:\Users\Admin\AppData\Local\Temp\D9A0.exe

C:\Users\Admin\AppData\Local\Temp\D9A0.exe

C:\Users\Admin\AppData\Local\Temp\D9A0.exe

C:\Users\Admin\AppData\Local\Temp\D9A0.exe

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\df3c3082-b36d-4721-8ac4-2f526df9bee7" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\E380.exe

C:\Users\Admin\AppData\Local\Temp\E380.exe

C:\Users\Admin\AppData\Local\Temp\D9A0.exe

"C:\Users\Admin\AppData\Local\Temp\D9A0.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\D9A0.exe

"C:\Users\Admin\AppData\Local\Temp\D9A0.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\943809b2-2de4-4356-9d4d-4439af7b287e\build2.exe

"C:\Users\Admin\AppData\Local\943809b2-2de4-4356-9d4d-4439af7b287e\build2.exe"

C:\Users\Admin\AppData\Local\Temp\4157.exe

C:\Users\Admin\AppData\Local\Temp\4157.exe

C:\Users\Admin\AppData\Local\943809b2-2de4-4356-9d4d-4439af7b287e\build2.exe

"C:\Users\Admin\AppData\Local\943809b2-2de4-4356-9d4d-4439af7b287e\build2.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gB6wC87.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gB6wC87.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MZ1kH39.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MZ1kH39.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.facebook.com/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://accounts.google.com/

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://store.steampowered.com/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://twitter.com/i/flow/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.paypal.com/signin

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.epicgames.com/id/login

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://accounts.google.com/

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2900 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:275457 /prefetch:2

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://steamcommunity.com/openid/loginform

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://accounts.google.com/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:552 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3004 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:796 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2424 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1260 CREDAT:275457 /prefetch:2

C:\Users\Admin\AppData\Local\943809b2-2de4-4356-9d4d-4439af7b287e\build3.exe

"C:\Users\Admin\AppData\Local\943809b2-2de4-4356-9d4d-4439af7b287e\build3.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 1476

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4WG967Qv.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4WG967Qv.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST

C:\Users\Admin\AppData\Local\943809b2-2de4-4356-9d4d-4439af7b287e\build3.exe

"C:\Users\Admin\AppData\Local\943809b2-2de4-4356-9d4d-4439af7b287e\build3.exe"

C:\Windows\SysWOW64\schtasks.exe

/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 host-host-file8.com udp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 edarululoom.com udp
US 172.67.167.33:443 edarululoom.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 38.47.221.193:34368 tcp
US 8.8.8.8:53 brusuax.com udp
KR 211.171.233.129:80 brusuax.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 185.196.8.238:80 185.196.8.238 tcp
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 transfer.sh udp
DE 144.76.136.153:443 transfer.sh tcp
US 8.8.8.8:53 apps.identrust.com udp
GB 96.17.179.205:80 apps.identrust.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 172.67.139.220:443 api.2ip.ua tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 genesiscarat.com udp
RU 92.118.112.94:443 genesiscarat.com tcp
RU 92.118.112.94:443 genesiscarat.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 zexeq.com udp
US 8.8.8.8:53 alata.com.sa udp
KR 211.171.233.129:80 brusuax.com tcp
KR 210.182.29.70:80 zexeq.com tcp
US 192.185.30.176:80 alata.com.sa tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 109.107.182.45:80 109.107.182.45 tcp
RU 212.193.52.24:80 host-host-file8.com tcp
KR 210.182.29.70:80 zexeq.com tcp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 steamcommunity.com udp
GB 104.103.202.103:443 steamcommunity.com tcp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 www.epicgames.com udp
US 8.8.8.8:53 twitter.com udp
DE 5.75.211.54:1993 5.75.211.54 tcp
US 8.8.8.8:53 store.steampowered.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 www.paypal.com udp
US 8.8.8.8:53 www.facebook.com udp
DE 5.75.211.54:1993 5.75.211.54 tcp
DE 5.75.211.54:1993 5.75.211.54 tcp
BE 64.233.166.84:443 accounts.google.com tcp
BE 64.233.166.84:443 accounts.google.com tcp
US 92.123.241.50:443 store.steampowered.com tcp
BE 64.233.166.84:443 accounts.google.com tcp
BE 64.233.166.84:443 accounts.google.com tcp
US 54.236.192.0:443 www.epicgames.com tcp
US 92.123.241.50:443 store.steampowered.com tcp
US 54.236.192.0:443 www.epicgames.com tcp
US 151.101.1.21:443 www.paypal.com tcp
US 151.101.1.21:443 www.paypal.com tcp
GB 142.250.179.238:443 www.youtube.com tcp
GB 142.250.179.238:443 www.youtube.com tcp
GB 104.103.202.103:443 steamcommunity.com tcp
GB 104.103.202.103:443 steamcommunity.com tcp
US 104.244.42.1:443 twitter.com tcp
US 104.244.42.1:443 twitter.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
BE 64.233.166.84:443 accounts.google.com tcp
BE 64.233.166.84:443 accounts.google.com tcp
DE 5.75.211.54:1993 5.75.211.54 tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 store.cloudflare.steamstatic.com udp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 facebook.com udp
IE 163.70.147.35:443 facebook.com tcp
IE 163.70.147.35:443 facebook.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 8.8.8.8:53 fbcdn.net udp
IE 163.70.147.35:443 fbcdn.net tcp
IE 163.70.147.35:443 fbcdn.net tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 8.8.8.8:53 fbsbx.com udp
IE 163.70.147.35:443 fbsbx.com tcp
IE 163.70.147.35:443 fbsbx.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 8.8.8.8:53 ocsp.r2m02.amazontrust.com udp
US 8.8.8.8:53 ocsp.r2m02.amazontrust.com udp
GB 52.84.137.125:80 ocsp.r2m02.amazontrust.com tcp
GB 52.84.137.125:80 ocsp.r2m02.amazontrust.com tcp
US 8.8.8.8:53 static-assets-prod.unrealengine.com udp
GB 13.224.81.91:443 static-assets-prod.unrealengine.com tcp
GB 13.224.81.91:443 static-assets-prod.unrealengine.com tcp
GB 142.250.179.238:443 www.youtube.com tcp
GB 142.250.179.238:443 www.youtube.com tcp
US 8.8.8.8:53 www.paypalobjects.com udp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 8.8.8.8:53 tracking.epicgames.com udp
US 52.203.233.59:443 tracking.epicgames.com tcp
US 52.203.233.59:443 tracking.epicgames.com tcp
US 8.8.8.8:53 community.cloudflare.steamstatic.com udp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.244.42.1:443 twitter.com tcp
US 172.64.145.151:443 community.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 community.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 community.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 community.cloudflare.steamstatic.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
RU 81.19.131.34:80 tcp
US 8.8.8.8:53 www.google.com udp
FR 216.58.204.68:443 www.google.com tcp
FR 216.58.204.68:443 www.google.com tcp
US 8.8.8.8:53 t.paypal.com udp
US 151.101.1.35:443 t.paypal.com tcp
US 151.101.1.35:443 t.paypal.com tcp
US 8.8.8.8:53 accounts.youtube.com udp
FR 216.58.201.110:443 accounts.youtube.com tcp
FR 216.58.201.110:443 accounts.youtube.com tcp
FR 216.58.201.110:443 accounts.youtube.com tcp
FR 216.58.201.110:443 accounts.youtube.com tcp
FR 216.58.201.110:443 accounts.youtube.com tcp
FR 216.58.201.110:443 accounts.youtube.com tcp
US 193.233.132.51:50500 tcp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.59.81:443 ipinfo.io tcp
US 34.117.59.81:443 ipinfo.io tcp
US 8.8.8.8:53 db-ip.com udp
US 104.26.4.15:443 db-ip.com tcp
BE 64.233.166.84:443 accounts.google.com tcp
BE 64.233.166.84:443 accounts.google.com tcp
US 8.8.8.8:53 www.maxmind.com udp
US 104.18.146.235:80 www.maxmind.com tcp
US 8.8.8.8:53 play.google.com udp
GB 142.250.179.238:443 play.google.com tcp
GB 142.250.179.238:443 play.google.com tcp
GB 142.250.179.238:443 play.google.com tcp
RU 81.19.131.34:80 tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
GB 142.250.179.238:443 play.google.com tcp

Files

memory/2244-1-0x00000000009F0000-0x0000000000AF0000-memory.dmp

memory/2244-3-0x0000000000220000-0x0000000000229000-memory.dmp

memory/2344-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2344-5-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2344-6-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2344-7-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1208-8-0x00000000021E0000-0x00000000021F6000-memory.dmp

memory/2344-9-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\AB1E.bat

MD5 55cc761bf3429324e5a0095cab002113
SHA1 2cc1ef4542a4e92d4158ab3978425d517fafd16d
SHA256 d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a
SHA512 33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

C:\Users\Admin\AppData\Local\Temp\B7DC.exe

MD5 6545cc6c75d08f789b6f051e0d712173
SHA1 f2d60d8b1bcf8eefe629ca5996a356aad85a5e14
SHA256 d38ff589f43b453dacd3d7203e1129e8797a5953f6c0177f3b9b2477b43395a7
SHA512 eee276708e9f0ccab7fa2399d8987899a7cc8479c4c990dea57b7a9e3f51785223a940c20353caf8420c0ce97393298f324d54085cb88d129207408d7bd8ca5f

memory/2216-38-0x0000000000C10000-0x00000000016DA000-memory.dmp

memory/2216-39-0x0000000076220000-0x0000000076330000-memory.dmp

memory/2216-40-0x0000000076220000-0x0000000076330000-memory.dmp

memory/2216-41-0x0000000076220000-0x0000000076330000-memory.dmp

memory/2216-43-0x0000000076220000-0x0000000076330000-memory.dmp

memory/2216-42-0x0000000076220000-0x0000000076330000-memory.dmp

memory/2216-46-0x0000000076220000-0x0000000076330000-memory.dmp

memory/2216-44-0x0000000076220000-0x0000000076330000-memory.dmp

memory/2216-48-0x0000000076220000-0x0000000076330000-memory.dmp

memory/2216-51-0x0000000076220000-0x0000000076330000-memory.dmp

memory/2216-50-0x0000000076330000-0x0000000076377000-memory.dmp

memory/2216-52-0x0000000076330000-0x0000000076377000-memory.dmp

memory/2216-53-0x0000000076330000-0x0000000076377000-memory.dmp

memory/2216-54-0x0000000076330000-0x0000000076377000-memory.dmp

memory/2216-55-0x0000000076220000-0x0000000076330000-memory.dmp

memory/2216-56-0x0000000076220000-0x0000000076330000-memory.dmp

memory/2216-57-0x0000000077190000-0x0000000077192000-memory.dmp

memory/2216-58-0x0000000000C10000-0x00000000016DA000-memory.dmp

memory/2216-59-0x00000000741E0000-0x00000000748CE000-memory.dmp

memory/2216-60-0x0000000000A20000-0x0000000000A60000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D9A0.exe

MD5 454440503db62af8520be0827389df6a
SHA1 473f9a477bdb8a408e7fad05e858dbbaa76f1dda
SHA256 b816a1f49cf7a431b9c23d32cb60eb6bae72d88b23b19a861e5f690488b00d57
SHA512 6c7f3847a00033394f5b8adb1fadb177b6103ccd6a9205dd2dad45e550805a0cf8295df2353bbf62ce9e629c3218e6c44621f716ebef23931b34ba4102debc15

memory/900-67-0x00000000008E0000-0x0000000000971000-memory.dmp

memory/900-68-0x00000000008E0000-0x0000000000971000-memory.dmp

memory/900-69-0x0000000002250000-0x000000000236B000-memory.dmp

memory/2756-74-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2756-77-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2756-78-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\E380.exe

MD5 ab0443c4b5ae89cd913377183852ecb3
SHA1 23cf5fb65377cfe0af63adede50c50fb24dc32ab
SHA256 8252f99b0f6c26c5c6360c896b26d2acf273ec3c68cf2d883fce4727fe926237
SHA512 149ef11f5b394b29310bb43bac8dc7356fe08c8916359b85de8b05b6033c76cb3e230fcd7098bba9acaf7dfc4570aba479b6e9b05369043f1d24a7f5d78e7d7b

memory/2756-104-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 29bd5918222eeed08259ac046852594c
SHA1 d456a26c3e8e768fa046b7ff2a450976be21109f
SHA256 71abc77a9dd837a4da23276b54bec97db6030960c8da0a417b026333a94eefb4
SHA512 a264aa70e295c475a3eb56326b5354de964ef571b8b0bba88a210643c7ac771e5c067caeb549f4c5cb0b316e52ce7f561caef2439df5e51c144cd8d6d8ec36c1

C:\Users\Admin\AppData\Local\Temp\CabE6DB.tmp

MD5 f3441b8572aae8801c04f3060b550443
SHA1 4ef0a35436125d6821831ef36c28ffaf196cda15
SHA256 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA512 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

C:\Users\Admin\AppData\Local\Temp\TarE72C.tmp

MD5 9441737383d21192400eca82fda910ec
SHA1 725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256 bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA512 7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

memory/1480-126-0x0000000000EA0000-0x0000000000FDA000-memory.dmp

memory/2988-127-0x00000000008E0000-0x0000000000971000-memory.dmp

memory/2988-144-0x00000000008E0000-0x0000000000971000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bfedb94afcad66a28bbc1c851205cea1
SHA1 2de3e908212f9f5c64b62f8b0fce4473b9cea2a5
SHA256 c9dba6d7d03edf346495ed276bb303049f528aeee8a53e08480024dfd7baf337
SHA512 60f455a88113f4a75512cb5e9f6d504bf7e1f647821b5271a83e09ba3d99396cdbcad66e95d413f8e379af8aab175b2a7d0720dafb4fde6e5c887a4d5f36dbb6

C:\Users\Admin\AppData\Local\Temp\TarE925.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

memory/1052-145-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9136ec55b8ffe8689e11455e6de85357
SHA1 67a6f91b0c2619db044f005abe67c150a89afb77
SHA256 89b5e5bb70cf57c00fae8e3c27e296185866474ff6759bd3e0bc7b9ff10d58a5
SHA512 02f093380b363be994e4ddc82ba040168c8107aed10f38376c85d3827fa81ba4ac64644a558130787a2b125c5c8e1e0353ce2448b4661a833e91fedadf0f4c49

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8092e12d98bd6165177fb3bb777767c6
SHA1 ce73ef9b5e22c9b9815a926020c2aab0c3a4a003
SHA256 7b04598f69529cd88a4629c05ed6e22afc345b3c65cd8c3e849342b1fca25981
SHA512 7b56391de26dfe80fd2e720462f206e334a02e2a5c0a7c1ed69b35d6fbd4e320c7c19f4eecbaa5679ce4dd748e9436a6c338c9247a5731538c3305b3c241bdbb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 3e61f1b5c83d57794fb57876a8ce4886
SHA1 d69fb46fde92526ba21a2ee39d9b98445310a71f
SHA256 44c1f59f48fca1dbbcb999232154f060a74d760bdb510accace016de59ed4233
SHA512 1bc86558d62a6730c2ab9b2382d68b5b35feef499b489c595ffc9fc4b776d63c0f23afcaef91b008bee22145d92067c7344d2f45ecc8d78d5bbe64ac1b2a1cdb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 60a0154a2a6bfaa484603549de18d2bd
SHA1 dbe8ae0541ed23b87fb1e017991d19e1b4d3496a
SHA256 c558889bdd05365f3997f8976f04658eb3fef0906bb68dbf947f0d8ea78514dc
SHA512 cbb646603e01dfeb6fdc9575bf6d23bb7b7c8b0c72daa1157034f264a8cf1030274d31d9fa683ddf8d605d092e94118769ccfb6dd99bf10fea660469eae97af3

memory/1480-184-0x000000001AC30000-0x000000001AD60000-memory.dmp

memory/1052-201-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1480-200-0x000007FEF5060000-0x000007FEF5A4C000-memory.dmp

memory/1052-203-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1480-204-0x000000001AC30000-0x000000001AD5A000-memory.dmp

memory/1480-205-0x000000001AC30000-0x000000001AD5A000-memory.dmp

memory/1480-207-0x000000001AC30000-0x000000001AD5A000-memory.dmp

memory/1480-211-0x000000001AC30000-0x000000001AD5A000-memory.dmp

memory/1480-209-0x000000001AC30000-0x000000001AD5A000-memory.dmp

memory/2216-220-0x0000000076330000-0x0000000076377000-memory.dmp

memory/2216-221-0x0000000076220000-0x0000000076330000-memory.dmp

memory/2216-222-0x0000000076220000-0x0000000076330000-memory.dmp

memory/1052-216-0x0000000000400000-0x0000000000537000-memory.dmp

\Users\Admin\AppData\Local\943809b2-2de4-4356-9d4d-4439af7b287e\build2.exe

MD5 2449def686158fff9801f567489d9c1f
SHA1 a26a611f6c8f43745d69a6138e07f8f32b09fa3f
SHA256 4230571aea510591a55384cedd110eb4c220014ccda30d2d7018dcee89c7770b
SHA512 9fe324902e5c31e6db664b40074ffcc03cd1c13606e9e6c4e156e71cb89d1e234477454df3debbccfe5b9e2c88b52e6e8f7746832a6f2f4d4ad6a9eb0d75000b

memory/1052-231-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1052-234-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1052-235-0x0000000000400000-0x0000000000537000-memory.dmp

\Users\Admin\AppData\Local\Temp\4157.exe

MD5 c94f7e84ebd02b3f99d0882032fb42fa
SHA1 175c5802f05860cbfd86c61e382d6934f53a4c9e
SHA256 cfa62b44e6169abdd259296228c197876c90f067df746a574594585b1ef6ada9
SHA512 4c1411934bc349f1f7e3269c7be3f4b9eeea1a860868703e0bcfcd01b840839b8c1df2b7733f946bc9fad4f98036b06cb40dd0f08317b0051965ee9df58da2f0

C:\Users\Admin\AppData\Local\Temp\4157.exe

MD5 ded6dd39012ab76ec877c3b4873b2d85
SHA1 29679f2d3308b9c12f5d136639dfc783a14c3f34
SHA256 b0ccfc16aca0ed3b12572b864c4dd211e776bc70f7b6e8a57b8656e2cd1e08e9
SHA512 7eb6865d56be1536774306b50ad60c02cf60737e9f446754065c4b59721cd327b86bdbdc89266056e89d1d58276fde1d3b8b1f1e27f0eb8ce0df42621e1720be

C:\Users\Admin\AppData\Local\Temp\4157.exe

MD5 999394f796f84b300d37a9aeda47b629
SHA1 cd29d56b6653d2cc3b83300accacc85321c27d3f
SHA256 642e3976f7631bb17b896a3e5466411e1c5cf9e70b1a5871a7f89722a66c2be5
SHA512 b1a1339caa2c7120361baf35f69c8027452e6a97535551b469e91d4b31a766ee437445d31acd068632ca30ac0ffcd06702a5bc33cadc080c7677d65b19a94d71

memory/2216-248-0x00000000741E0000-0x00000000748CE000-memory.dmp

memory/1052-240-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2216-252-0x0000000000A20000-0x0000000000A60000-memory.dmp

C:\Users\Admin\AppData\Local\943809b2-2de4-4356-9d4d-4439af7b287e\build2.exe

MD5 321079932e9d3e793fc464ebb0469e7b
SHA1 436f00137434b488d61e09be954b39ee1a17dd6e
SHA256 8000c394fdc95fc15c73b41cf2a51295da33308d90a7eaf95ef9f332f8d2be74
SHA512 11441d4f14f1cb1575a68649c355595584e44090d25f75554a1a5a54be26383a02751d55b4534b3b31d135cabdcbe0b5875f345542c3bc20afbb813548328e0e

\Users\Admin\AppData\Local\Temp\IXP000.TMP\MZ1kH39.exe

MD5 10717797f5ddae7a871e7f45ba05a6c7
SHA1 287307a480189de891280385c2ef87b1c18a8d83
SHA256 b1a97e720122e976cf585ef2c7fbb5f24eec32e53b388c937e794cd945f89dd9
SHA512 d52f6a0ab742ba6abb70ede3a3bfd820f99496f6e3ca6e4e5a6619c63a3dd9556cfe2e4e8616c80a6e66e1877650730b7945d02a4a4cb9fcb35033da9e26e1e9

\Users\Admin\AppData\Local\Temp\IXP000.TMP\MZ1kH39.exe

MD5 6db036fd17708400b2043dce8c14263f
SHA1 c4213c8818bd31c99b8ef914ef24b8530dbbab14
SHA256 ca3591a5a413c2bb591046c05e534eb6095b74fff79130343cfdfaa5c13664cd
SHA512 a4c73973638f2ba5890c6fc5f6b7c55ab1236b81fb7efaabede4a365958dbab6a235f8f4f15e37ab48e8e56bb48f808980ae81eee55bac7661b3a18fe1742924

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MZ1kH39.exe

MD5 8ef436623381fa255695b75a237ee7d1
SHA1 3b24feb13d5988b7e5d97e658da6b7f9cce238dc
SHA256 44898256f18ef48c7169129a007231babf0ab5445550576dda8fcaeeb1d498da
SHA512 f37d94e59af6340f49d66ec6b18336bd4524eb0fbb0bf78037e4d6bf4ec0be3f8a9a452e9825d4ffc263116e50a749b41013c0be0921ecc0fc7c52d34c780018

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MZ1kH39.exe

MD5 82fe718fbf1f270a452933dae30abf94
SHA1 6d82cfe904609ff92b4232ee71e09a4fc8e25706
SHA256 4bd8a2e6a1b45f6df84bb22d8b60c54489bb000bbd21622c06b9203c63da0772
SHA512 e3f52fb3d0de2ba1e95958def0c9a64cab3f75bc77fd6c3d381fd10e73b35a986165ebf2790ce8c19c53beb5c45cecda497bcabc3a13d364f396e1bf7929f448

C:\Users\Admin\AppData\Local\943809b2-2de4-4356-9d4d-4439af7b287e\build2.exe

MD5 54b16cb8eff6f2fa2cd85f69f9cadf1c
SHA1 fc829f8f793ddc5163cbcf86aef29770dbbde8d1
SHA256 f0d2fb3e5a33dbfb53c74c9103127ee61fd20be70f5f5774bb11723422e6849b
SHA512 076531b9b0f076728986ee072480ce6647bfdfde962f4601be44a8cdea0bbce2c58d022a8246a6c25bb2b46aa7cbc507ca701f831e8f301eefb0e25f7cfef5fc

memory/2196-254-0x0000000000990000-0x0000000000A90000-memory.dmp

memory/2196-256-0x0000000000230000-0x000000000025B000-memory.dmp

memory/2584-255-0x0000000000400000-0x000000000063F000-memory.dmp

memory/2584-272-0x0000000000400000-0x000000000063F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gB6wC87.exe

MD5 9e8c4f1304e70cd3d1b22f4643f71b20
SHA1 0e9af12771104f93ce71718cc73076d718ed5b0f
SHA256 b1858c3f9f86749f2feb69bd5115bf0f9770ab32ba2c780bb9472870621172c2
SHA512 9f0f4ef1a74706d9a09c800aca5b52c52516df0e62bb9f22bcbc0e7e0d916cd410cc36fa614b0b978447ded57c26b35e1e23971fb1e0a5694e23f32b52853315

\Users\Admin\AppData\Local\Temp\IXP001.TMP\gB6wC87.exe

MD5 6ce2769e4c41b1cb4734da78d5973210
SHA1 2159525534f3b92313f665871e4acc2aa8106660
SHA256 396a1d5dabad89e238e3c1177df44bced2b5f54980e8ee665d9eb571d2676075
SHA512 b00c1962281a17a1d7b931bcfbb7e8daa7ed2f77696f419a944de40a894bd40d64b403d321e5f0949774db9bb9c92bf19ab6b0a6802b601862f9cda6b64cfbf5

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gB6wC87.exe

MD5 d00a8d7942c02e78b455806bff713fc1
SHA1 2d5f261fc075ca08a253daf196f617cfde3b0c73
SHA256 ee20278043988f90ef82bb0a1a3d444ada113fb175923d670d5b0da735f17b56
SHA512 546ccb42d261a6f0d7161aebbff35ea6b345c45dbaff1477bf93f433dd68a6264d85016a1dc0a8ad4ffaaee253857845b8f142b17c51295149dadf34d26aa5a5

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe

MD5 4a278b28709938fb068be07c5436620e
SHA1 3eecf68fa5fef16c66dfd0b4467ae1dd02b5aed6
SHA256 bf36cd1ff550a69b27ff30ebc47e770b13d920be47032089ba7f7763e73c23a6
SHA512 aae951852a2d2a255e260c423a360e52b47b7fc1c6a9b674dda23266dc06b4ff8299768fb5b0fe42a587cdd4fe5f771d799c3fa228d29aa83f14ff6925189f55

\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe

MD5 fe3be124f7c28d8111a22c78ec4ebe2c
SHA1 13eab765268e7d35b2856576f7bfb101926ab243
SHA256 d197977b4156be12760c3ed1db033aa8d6df4c4ae6bdc72a13c5a434ad7828fc
SHA512 3fad160da07513c75fd9f1462968e292279e454a2c881522247546851a8b9d043b0fe4e673bd77fad98c6e300a4681f172315c7050778bc4e5ab101f40ffff33

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe

MD5 4ba5afa4a43b535665601109ee20b282
SHA1 784e25e3ece9c55ff50342e15e5f013978cbc6bf
SHA256 8ecc3321059a0e562edd4ea1549a6513e8a73b6a11e9f2c932ebf6dbd425ad9e
SHA512 3f4b1be15d9ac63cea38d0b22d322d41db8c255e3983b9263e8430fc3680c5f4ea85bfd05a704db06597602b387409645b240d96f36452e7af7767219d147095

\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe

MD5 0eab1da09847e02f3218f73650292639
SHA1 5f978e6a50203a12adcd81d4c982ad556bb087d2
SHA256 33693bb619a4f19ce6d2cae47fd22e4ba5e6099fc518003909598a3487dc772f
SHA512 fac46b9e4862ee07f562506a601f68f4fde3c6ac5134774bdd3585fb45ca2c9d380b02b4b146d97e0f082f350cf37722bb5ad2d89dacad4127c91903d0616865

memory/2584-280-0x0000000000400000-0x000000000063F000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP001.TMP\gB6wC87.exe

MD5 ed0c5856d1f5e13e58060cf44b5233f0
SHA1 aedcc213d48f711a9d06f9550184edaa8d131cdc
SHA256 3f22cf82da1366cebfbba4821e97c357737b5d50708a3f8a5216ed2c63dd410e
SHA512 9839e7e5eed2d3a596bb7c0e2e8b8c1363d86bd5d7f7c82302d8297c43b12630974d715d49c35314bf5d48bec44b5997a9f1bef45cc4a75bdc332095b20f55a8

\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe

MD5 f81df6508fd2e5072a98b1f98e15d53c
SHA1 e797ec58573cc9e3290d4ad8088b58df7d6feb0a
SHA256 a1ca908fe1fa951b36caf2cf07a3ddb90bb279bee14046799ef9c02efbae00da
SHA512 a48dc64be86e41fb1f7528e009f918c01d1e6c2ff479d889e3ac4aa59d4120bd04ca92923d654b512d2438fcb09423451978e443b0c2a150a1f0509925abcb66

memory/1104-328-0x0000000000380000-0x000000000039C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe

MD5 e829279ff2ce0d314b41aefca27d810b
SHA1 10460cba71726efed02901fffe97c36de58379cb
SHA256 f2da17e28e9d2a6a6bb1fb94147b9718649c00ef32244225ec3c401b924bed74
SHA512 c9b163ab69c38ac4b9c9d1f0b15a7f989497a4f5bd69417d11849fb5ce94a86e5d468087725f655e8c03406ea6ad6366181dedd7595170371d07fd352e3d4778

memory/1104-342-0x00000000004C0000-0x00000000004DA000-memory.dmp

memory/1052-344-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6F2AC391-98A7-11EE-8E05-6267A9FE412E}.dat

MD5 2b083b5e690361806529d3506d92a057
SHA1 cc6ecd7c4e90f4ec03de346c4580f41fda28b5f7
SHA256 51bfac370e83867cb2f336dfa5a5da0be2d6141e4196cd8cc59f0b590c8bb380
SHA512 ca484d864783c14a716e63aacfc65fe3fc57ccf123eae8919ab4974d1085c4ffd855fa5739018fb9e85c00d85c101b22c6451003b3bb6fe97225e2ca76e911db

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6F2AC391-98A7-11EE-8E05-6267A9FE412E}.dat

MD5 e7ec7ffbb2737a3571e2f4f483246e13
SHA1 3d369872d08f9c00be4f96bc5da15ee170c29a9e
SHA256 4a600d472ab50d2d638933e3f8dd6747a13736b95b466f16401cff5e3e8e5f81
SHA512 2a60ae76dca56f8f72762588a655814e3f951c022e72c961065dfd46233b8bc9bfe8c472ad7bd952c4cb80be5f2ce5165e9d639f244e415f8497ce254d8465a2

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6F1EDCB1-98A7-11EE-8E05-6267A9FE412E}.dat

MD5 74a96db8c35df89dedf7590fe3c96009
SHA1 4589a666a494ae0d12d361e32b316ed333ac5d9b
SHA256 c0c836f7d9a6b1ed5a233890b3f7c15fbcfde6e37c098a2c0469d436ea6f1458
SHA512 ec5e7de196295d1340b5282dc04da84900814bb7a9f2f7d318d802aedb3612d211b5d17a34f8a081320ab45a40f1862b2af8c27602f58c89d4df4a2730586f91

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6F1EDCB1-98A7-11EE-8E05-6267A9FE412E}.dat

MD5 ab87363314b5844795b990c642ec16b3
SHA1 15c0b81489003dae6aab7043f5388118f9e6b634
SHA256 a8025ce5d343efc2a23dc738e032b477ed60175fa91bb64eea531974bbe20b52
SHA512 a749f866888c6a494d6dbe19eddc38d88caffa330f9409eab68a0b109b6a51b5c06b092964cbc9e3c5323b26862aaa8dfe1c1d43db5abd7b7d8e6d6c083c9176

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6F155731-98A7-11EE-8E05-6267A9FE412E}.dat

MD5 991c9378838a725c84327bf4829c7d99
SHA1 640c17911f328971a69e41cc2079586fc7d640e6
SHA256 2a8ddefe44d939460acffd23c93a3bd444351c05204a896737af35391d5e8c72
SHA512 a572389c601a92a1791ab353a3f5ffe0a7cebd0294d8d9f6ab569b84bfbec2d1c8c7eb4f7a844f14e9d2c2dca48fee2d407bd8bf9ac92ce1d30e2a5ecb67f1b8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7dc2828e9c2bc6d4cf4c4319faa8abac
SHA1 a9c6295eb6890729cc11d6e367ee8662bb71fc05
SHA256 4feb438b6008163e08829a7fac8644358129741988ca9729ace574f59ecee45c
SHA512 e6aaa29f7fc9ced155125651e3ef4d83558e3be078d00131df6e092f5b0c719c53baed23a016186976f66f0c4faefc1b4127cff07f103c3b1ad13aa6b06c2ccb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 d2eb87a7d3e5c42f78b78d9a977b78b8
SHA1 be3369cb87c30e2b92042d28114972af66d46644
SHA256 0f0dcf71e91af229fae5c7a391a9d3c95fb7ad45f83f1332214da026ea9b23ac
SHA512 69ef23ccb9f5fc28b36880f032686a384add465f08518d7f66475ac3b08fee0caf2cd9490d3f6152b3344f35dd3ac4f80faa10711894dc52a90c5d6a1fc73e8b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

MD5 ad019e60f88e06bf9fbf6929579a62ad
SHA1 a2993c04fd45f31a5c7e277936e5ff0c73b64850
SHA256 143ceff03f84e7a559b8394fcf0d9fef72ec4b6fe368c83146e7e0840f7333ce
SHA512 8bcf08ebd15f96b0868eca57aa6094eb412a03d2f8926c07495915c7281c6f3d565f41e693a59dcf735b0a183cf3b7ad1ecd9668365535d9265f2d9568729bcb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06

MD5 7c4843f65b4b371812504a447efffcc9
SHA1 415173ed8d52ed443fcdb8ef772e49f4f9cbeff1
SHA256 2e16ac6d5b240079c9fd457e5fc23ba257f8a222517798dc31b7ab56ffa4fe05
SHA512 70c6196ddbc45657449d7177a6288f4355158bff4561826481fdc797d6e038639d39ff5c81235b068101db7c799d08e5bfbf39d6ec6afe5f193c45b1a3642d3b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06

MD5 b503bbe4735e84275c4458c352e6c9df
SHA1 b1a5767a5665392799901a8c36a80ff96d6017ab
SHA256 cf90881bc9c71b2601af49b0cac1d9830e00d1cb8cae4984f87a72c51a3993b1
SHA512 4582316a97e2dde3b8df4bf41ee7c12bc6d85c5ff8e81f1d7120dfd1f83a8e1d6d0395dce1a3e90b22a164b8f066b6fb95d47e203665706d6b24ec04c9d6cdbe

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_BFB422D89E28A298A60024A8D8A2EA06

MD5 8e3fdc6eb297d0d3db458374caf30540
SHA1 0bb2d4ae08a060f5969b72e3e39a5a2d396db0ba
SHA256 7edd220370f0e5576978d9151102e977d27691eabfdfd437a46c031ae87e6b34
SHA512 9d330ba2ca13c43e438ec711ee665fdf4d24ba3b6615d56651a73b34b98da9dbb834e0713e81fb3354d275bb757d82e9ed9e4cfff064a408de56fc00b8ca5fc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 13e6354d118fc192c2645b162c5181cd
SHA1 56ba93e0cceab7f52d136f68c0af3093ed9315ef
SHA256 3e83996795491132f97da097de832f531529c0d3cf9647fd494066673b0d927a
SHA512 843878c8c83941d32e47053f60b827fd56115211677d2fbd02b9faa94e03a4d0507debff297cdea2753bf4a3940dfd7570fa245cd1b8981fe0aceafb55f19721

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

MD5 7b7e238a656e0f5a05a8aecb3749a364
SHA1 bef2258396f4d91e4c9c1742b05f6e811953a925
SHA256 f602b8dd36d465d0609990f759fc9e6928fa970b9563d69287d3d73016849caa
SHA512 bccac7b7dca807d03e67570d493aef524991070a6ee4da2c7a945d6e6385d44e9fd30ab4ae9772b1461329c2fd5a057a88a640d82170ad96535b0438bfa4fd3b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f726f42532307f3b977a5cf2247b0262
SHA1 e11b49c21564d1a30f01d105754f78f620a91c0e
SHA256 b72bc528acd648660ae4ecd7c62f9622a3b18c33130ba7d2120adb162ee65145
SHA512 f288248dd3dadcdbda6f4fa4d116cf42f9ffb934f9247ee30f4734f7bf1cb9acf4da898ee0e48335fe0f94d43065e9831fe18a388e8a161a98b325c3a347d78c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fdffc9e00cd53eb74d343bbf5b63a752
SHA1 a425023aec82c2b2272749778b4f2035a1ec5870
SHA256 75b541b7a817bea9687f7c0b6a935b617cfeaef873470d6c502a3b7ad0e994e4
SHA512 a47d8fa56e24d2544bf0014df85bc6a3029f82e094727ae04100622fc38fba3cfcf8411e4ea60d760305e2703e97a7ac2519261b757b7105935bdfb11f1f69d0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0fb6d754d2e0b54973b76b68a1a096da
SHA1 3c5338fa078906effabe2fa711c3a639bc7fb5d5
SHA256 41dee82c37c2b2cd4ceca2df4a3e38940d6b052e32f2d17663d1a2845d1818b1
SHA512 97e55da84a19b4f8bd53f2b749a040bd649ef6bb11a500f76dac75c3a685fe21ea04a9cb7e99d41f1e2a5fd1a1c1401e8beba723135c4a1a342c7587f4483f42

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

MD5 5bc2d970f96d46b8e635c315eed6be6f
SHA1 cc66b7dad7beca8a76921bcb36b6e40a1c6d9aa7
SHA256 d8b4e55a7d3bde7405a1173ab5891b90019ea079d7fb60a5c7f8428b7351592b
SHA512 8e95212de7a7a8b26b0bd995dd59dade817276485742531f77f18b92af14333b9aeee282364be2d59561fb94fe021e4625883f217b6ecbcac81c417cab690dd2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 99f2a171fa2e2e495929546cbcef118c
SHA1 fdfe435387f354557f9e5b16b13ee589b2213695
SHA256 9a231c55ceeedb1d54fa99976fd9768c15eff60917a289d90d14182be61bf2ff
SHA512 f350a63f2a0ccd3dba0c80f3d305ee5f6a7bceaa63879bf31337bf949003642d8d1283195178851ecdcbdbfc723088b9b86a46b313d63de2bac53ec7de677bd7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

memory/1052-869-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\943809b2-2de4-4356-9d4d-4439af7b287e\build3.exe

MD5 41b883a061c95e9b9cb17d4ca50de770
SHA1 1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad
SHA256 fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408
SHA512 cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d7a0dea654bbe5a8ff214a8067534b15
SHA1 6ab81a8d160ebdc6ebb2c977f9202ee99d46ffee
SHA256 f41f3064cf8bdd87200d5da7c894e71b38cbda6412f408c3ae316d650a2410b7
SHA512 71422426b8b52b9edef40fbc633b0d8b5ac23da2611a52b89fefbcdc7ccd6cb3b499acdc67dec326fb1519e5a530764499b416e582000361202c529390bc987d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 95a66e88032e0f459a62bfe9658325cd
SHA1 309afb850b469c0e9b519d1b47676549a866b786
SHA256 6cb92a24e5b660bdf16e8bcb38769d4a280d80c4a503eb82c26196dd140104fb
SHA512 94491528f4a5012927b0399b61dd6fa1e0d6e880928007aeb567ea7b00feecedd921172af627e2c4364066c55457cd9ad5a4fdf2ee663f37b9bc4ddb7f073565

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 71ec38cf9fea281688316d563ba197e3
SHA1 ed275b6116dc8897e2dc5bb6134d99ef16e6ff42
SHA256 5e92137b71adb2fcd824da2da201e76fd5e8751170cb980281dfff34d9030985
SHA512 538b9d7f1eb1cd8660d56c32087e866facc36a02a78cf6266821c89b0b5ab1f2182a6ff132b42f7683ad289ea4d941c83c2d14b7fa8a90f57edf563ba3f2f154

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cbd416f70b15f087255cc666ad463051
SHA1 5b0e9012e20d6f037096d7782f892891bd1c8d7c
SHA256 7122ff2102a50a4ed3bccbdfa0716e35596cde9a4ea583e79bd038e9dacc72ab
SHA512 e9c7e1c5c20b6f44e8b07e400a2fac17921c1be7dca5673d6e78c8657b81b21a9b1a2db13de873bf35fe8485748a60e1d1ee0dea9050d058ec501c55cef9f17d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 91de6641ad3540e71311b1a019839350
SHA1 6ce6b266237debb6f0e947cf90cda5aec7478b62
SHA256 ab13f5813bedd7c42acea8e68088f88964d9111255eb1e9529a8b1f2f68e00b0
SHA512 81614cdeb7e054991e63d6e3278a4443cf4526031a8f4923d8677e8b1600dfb04723127a6a764683a5f2a5b8a8919e1ebe61df4cd48a527a20b0b62d422f4167

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7d1e13010400607fe51e178894bcdf88
SHA1 f5ff4309f4cbcc3d7016e18d080037552d65c313
SHA256 63d48012f60028e7329f5eae9508da1297a5546872ae96a9b9a8cf794ad71028
SHA512 c6194abf89fcb8b02c98dbae5af6639740384f1d800bf5b4a4e7baf28d610f2bac3099a52636f51b4e5caacb7d0e60b8744e1fc9b7dd36a2780df592cfb6c21b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5 6147a08ac6f80eb59c9e32bf19bed69f
SHA1 9259e7f9463c48af1654369acd27a13ede05fd5d
SHA256 abd09312c5e97d41bb0ccf5985c61c06025595f0bb044a51b9d9fff3e5180bf9
SHA512 9ec8bc064e12dde335830053964f74764bceecd28338ee6e8963c104be9ba7c4afba34cf6464e2a061ef37119b9e637f6deafc8e984568b0b6c2ae2e3dca8689

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5 62cdc9d3b689e0980c6aab6eaf300b6f
SHA1 e47514ce2b3a0a42186b0d56eef888154eb29143
SHA256 3024acf432710416f357c2c428af969385ea670e4c2e3c8b010b4252e4afa3de
SHA512 db9bf9ae956c08368fe7ece2de82601aac4b2664bc41ef5a2a31799d90eac05c41079891c92301eac48685b0ad57713714ca11a05f8a5805ad22ffcc6d3d60fd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5 27c7be9746c904ec0a4d238e6ffbc36a
SHA1 ce8b9fbb09791e940b5e6b9f191d9eb32da729b5
SHA256 de83a7f002fbc605f382f32bdbbcdeefbfa6627b60ba2e36529fcf00166fe5b8
SHA512 c91c60f5e4c154980a29c7a02454f4057a075cc3a7b4cd3b6aa3763bd92facb3a630e055f1b0c1b420289b09de09382b6ade650ae286d3978adcddf5e92070d6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5 263280f93a09eb1492d16fb0ff576d4a
SHA1 07a0cae432f3583067e120843e150fdf53e6ce61
SHA256 1d07b61c1ca135168b034e08827ff7d148aa0bda2040238e73d707515221826e
SHA512 9b9a822afd3b62e2a708dadf536cd21920e5296218655f7db8feab8505afc8532a441c1ed1b3a3e840dc2287104c416102c7f1a0adb329035b641eb5377dac7a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9ee3aaa6b3667b805229490239b8ae34
SHA1 23bf7f037d4b415b2c16354ba587dbcf9d90ce44
SHA256 27b8cfd35399d4a31e142380b8319cd65ac6fb23874918cfd608941c2455cc59
SHA512 fe6538945ff7a3b0ece5c58c01e7f3b6d3a94141031f430a0b5242cbc011c0efc73b04f30912c37606efdf75469f8c20f1a1f69afa07146729aa47827cc28f2d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 98c6e8c9111494a8a9c95d8c0bf58757
SHA1 188976370bb73f7410bdc847ae12ca2b62fcb1ec
SHA256 5d05951bf368ed89f0f4a227ddb25fc2a92206b0927241c6499c6e0efb574d0c
SHA512 ac55314dba980539019af88aa02a019977f71545f109c833a693e40adf38711eb698bb1fe9884693afa0efaa6e7535a3106b9c83ba295d64f4d330016d8611bf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 47f85c6d3103c28019f54b82abd122a2
SHA1 68c8c3c2f4c72a040986681c8f0081f8884ec5aa
SHA256 dd376db852bd3fcc3b64bad94eaab1c6a1aa47052492fd8a0533a3f79e7579aa
SHA512 9dec932dd140bf4462d898251db5e96879c5de1de43958f8aefba8684a02444cad38ad1b10051e37f20c5af6ea382b175b80c09289b53d0339cc6c7d2b040e6d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f2eafa5fc194ceb729c0666e604f71f4
SHA1 815839593fa9769913eda53f155b73a9ca838951
SHA256 6bb466c74e1e5ee0df07fab3dfecf17310c7cd979903db13d19f2aac0150e66c
SHA512 736eb8f87f3d4e9c182179e1712dbf611ef3436bf94ea83baf1b2606fb8bd3ca6516d13b3cbf53425c66e50ab6b292d399cfb3768ea5833074a178b859e5e136

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9c6cf88580d32a485239ac2482c8498d
SHA1 eeb536d9ec5618f289f178ade4816c6200b4c5c1
SHA256 6f879d6d5e0ffcbfc113b8b3be4e066fe0c82e51742f7964f61acd5f938f673a
SHA512 5e05cfa20f38aede8a342c507bb684331df9ab81fe6d60d61a6350eaf147deed701c35fb908ac4efb9c2b050870e1ce26d1c3dc389040810593be55ee2fc073f

memory/2584-1975-0x0000000000400000-0x000000000063F000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 92e98f65f70f77a5172e7c07173af49a
SHA1 7c6b77c174058285e64dd847e383a4441e636770
SHA256 7878b8902cf203d8740f3218b96a16a61b29ff4c358bf4f0aaa2388d15ac6285
SHA512 1cb2d05a89e1e9e183bb067f24b01150b239c066927a0072becbdc31bc2e86166436f65d4f14ea15f73089dc7515f6382221173e8a41ff4cdbffe1490c0735cb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0e0c1662c8508e107517062f0534e67a
SHA1 7c3220ec4cae3194b984a4a71a95794eb0f1f8e0
SHA256 e662052eb14b51b41eac77289a0e8043642dc479c84695f1b0ab8231c21a6f45
SHA512 032f8d113a840c91d1e1ff5736b61a550f2a388c5eee5cbde542454818a6ebad9fbed8c1c23a33e8d3f951356e904d165f64f621d7e0dd232fa119e46853d32d

memory/1480-2077-0x000007FEF5060000-0x000007FEF5A4C000-memory.dmp

memory/2816-2078-0x0000000000130000-0x000000000013B000-memory.dmp

memory/5028-2085-0x0000000000020000-0x000000000002B000-memory.dmp

memory/2816-2084-0x0000000000130000-0x000000000013B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4WG967Qv.exe

MD5 9ac2d409d53ee85ceb60058a8bcc33d9
SHA1 2dc44451f40097305f330d7fc51f6dbf39c8465c
SHA256 871cfada7e4391fdbb6bb8aaff7adf6bd1e4c30699f6bc0f6be4606256cddbfd
SHA512 3585e04d38e4d359321e7793e2db93ca29d6784a768466c97fa92f443dc8eec403d4267e812c4775394af1ac84a009c580ecb4e4d0ab7b986ab31ef75c403534

memory/5028-2097-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e3c79e7a10fd6a456edd1dd5933637ab
SHA1 0dd94b777333ceef489ed23c272efd0da4e5d9df
SHA256 d466a6b6679e89352c99f54d99e0d1dedcc2a61b1598d2362c3c549ebb876b63
SHA512 9216c9c8b16c9573fc8fd8818ac1955ce3c33385d5fdc8821cdb5f223f8683268607fc043836ea9c7137438ca71055657442995b425c9fa14b8e12ba0d036a52

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c69752e6a4895d66ac9f0ccda33d33d9
SHA1 5a2ffb78052340f5675141f6d4c744b5ba381e5e
SHA256 5a37d0be21066bcba6619a4fabd45d14525c2b0c6248c47b8695336eee3d5771
SHA512 36c47460d81e702bf239817cb523b3804fdbae795a591674a69f4d86fd77d847dc0553ee8ba7f04f28b92ce80fd2499e58f0f6f6d63f54a7d66034b3cdec32c2

memory/2584-2294-0x0000000000400000-0x000000000063F000-memory.dmp

memory/1208-2345-0x0000000003960000-0x0000000003976000-memory.dmp

memory/5028-2359-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe

MD5 6abd6ed23a406a48aa439134f5d32301
SHA1 918ae7d9e51608a2cdc65ed1adc4833bda84deb1
SHA256 f99a06a609b21d922eec4a897e2078ad334df11bac719049862fd64d7a8a5ed5
SHA512 3f089a6ef5b72462742e3bedda5596434bb5ea27c9fa12ae16f95af8402b8b7fad82bb200b3ba44b1f82c3b0cd9cce990d0d5890d8ae8918e4d4e230ad524750

memory/5040-2366-0x0000000002300000-0x00000000023CB000-memory.dmp

memory/5040-2367-0x0000000002300000-0x00000000023CB000-memory.dmp

memory/5040-2368-0x0000000002630000-0x00000000027C5000-memory.dmp

memory/5040-2369-0x0000000000400000-0x000000000090C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R0SO7ESW\buttons[1].css

MD5 b91ff88510ff1d496714c07ea3f1ea20
SHA1 9c4b0ad541328d67a8cde137df3875d824891e41
SHA256 0be99fd30134de50d457729cebd0e08342777af747caf503108178cb4c375085
SHA512 e82438186bfc3e9ca690af8e099aafbfbc71c9310f9d1c8cb87ffa9e7f0f11f33982c63a2dac95c9b83fef1aaa59178b73212fc76e895d13a1ffbbe3c1adfa4c

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R0SO7ESW\shared_global[1].css

MD5 cfe7fa6a2ad194f507186543399b1e39
SHA1 48668b5c4656127dbd62b8b16aa763029128a90c
SHA256 723131aba2cf0edd34a29d63af1d7b4ff515b9a3a3e164b2493026132dd37909
SHA512 5c85bb6404d5be1871b0b2e2d2c9053716354acd69c7acca73d8ce8bf8f21645ae11f788f78ef624444016cb722ecbd6213e771bda36717725f2b60f53688c6b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X62LAKSP\shared_responsive[1].css

MD5 2ab2918d06c27cd874de4857d3558626
SHA1 363be3b96ec2d4430f6d578168c68286cb54b465
SHA256 4afb3e37bfdd549cc16ef5321faf3f0a3bf6e84c79fc4408bc6f157280636453
SHA512 3af59e0b16ef9d39c2f1c5ccdbd5c9ea35bd78571fde1b5bf01e51a675d5554e03225a2d7c04ed67e22569e9f43b16788105a0bf591ebba28ef917c961cc59e2

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X62LAKSP\epic-favicon-96x96[1].png

MD5 c94a0e93b5daa0eec052b89000774086
SHA1 cb4acc8cfedd95353aa8defde0a82b100ab27f72
SHA256 3f51f3fb508f0d0361b722345974969576daef2c7d3db8f97c4ca8e1ff1a1775
SHA512 f676705e63f89d76520637b788f3bac96d177d1be7f9762aeb8d5d1554afd7666cbd6ef22ce08f581eb59bd383dd1971896231264bc3eaabf21135c967930240

memory/5040-2474-0x0000000000400000-0x000000000090C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R0SO7ESW\tooltip[2].js

MD5 72938851e7c2ef7b63299eba0c6752cb
SHA1 b75196bd3a6f9f4dfc1bbf5e43e96874bcd9ce4e
SHA256 e2d4e0e1d3e162fdc815f16dfff9ae9b0a967949f0f3ae371f947d730a3f0661
SHA512 2bb6c03a1335ef9514d0d172a4284d82a29d1783a72306bdcb8af3185d5cd2ff16303355aa4b05086d2fa0b5b7c7159cfa67de4a6175095ff0e68adec2a56ac1

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R0SO7ESW\favicon[2].ico

MD5 f2a495d85735b9a0ac65deb19c129985
SHA1 f2e22853e5da3e1017d5e1e319eeefe4f622e8c8
SHA256 8bb1d0fa43a17436d59dd546f6f74c76dc44735def7522c22d8031166db8911d
SHA512 6ca6a89de3fa98ca1efcf0b19b8a80420e023f38ed00f4496dc0f821cea23d24fb0992cee58c6d089f093fdefca42b60bb3a0a0b16c97b9862d75b269ae8463b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2WGHIKMU\favicon[1].ico

MD5 f3418a443e7d841097c714d69ec4bcb8
SHA1 49263695f6b0cdd72f45cf1b775e660fdc36c606
SHA256 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA512 82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\32uxyeo\imagestore.dat

MD5 96eca10b02af5c544c88428cf5818f04
SHA1 7161d3a6af016b03abf98c9f9e2d0bd04bced035
SHA256 3fc4a37772b2deef70026422f31cf9accb0393cf462fc1a83c38e0f6724dbd53
SHA512 eb82cc7895017962449c5174486641a8e545da0a3315abef95e0fad0072312b5d74f581e7f80b3304943f3ca65eb868f118006966214373e43a0d931d86b68b4

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R0SO7ESW\shared_global[1].js

MD5 f94199f679db999550a5771140bfad4b
SHA1 10e3647f07ef0b90e64e1863dd8e45976ba160c0
SHA256 26c013d87a0650ece1f28cdc42d7995ad1a57e5681e30c4fd1c3010d995b7548
SHA512 66aef2dda0d8b76b68fd4a90c0c8332d98fe6d23590954a20317b0129a39feb9cd3bd44e0c57e6b309227d912c6c07b399302a5e680615e05269769b7e750036

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X62LAKSP\shared_responsive_adapter[1].js

MD5 a52bc800ab6e9df5a05a5153eea29ffb
SHA1 8661643fcbc7498dd7317d100ec62d1c1c6886ff
SHA256 57cfaf9b92c98541f769090cd0229a30013cea7cfafc18519ca654bfae29e14e
SHA512 1bcacd0ec7c3d633d6296fff3325802d6352805f0d2cf1eea39237424229ecffad6cb2aee4248e28b1eca02ff0646b58240851a246bbcf0aa1083830d5d9081e

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X62LAKSP\favicon[2].ico

MD5 231913fdebabcbe65f4b0052372bde56
SHA1 553909d080e4f210b64dc73292f3a111d5a0781f
SHA256 9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad
SHA512 7b11b709968c5a52b9b60189fb534f5df56912417243820e9d1c00c97f4bd6d0835f2cdf574d0c36ecb32dbbf5fc397324df54f7fdf9e1b062b5dbda2c02e919

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R0SO7ESW\hLRJ1GG_y0J[1].ico

MD5 8cddca427dae9b925e73432f8733e05a
SHA1 1999a6f624a25cfd938eef6492d34fdc4f55dedc
SHA256 89676a3fb8639d6531c525e5800ff4cc44d06d27ff5607922d27e390eb5b6e62
SHA512 20fbee2886995c253e762f2bb814ad16890b0989deab4d92394363ef0060b96a634d87c380c7ba1b787a8ab312be968fed9329a729b4e0d64235a09e397db740

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2WGHIKMU\pp_favicon_x[1].ico

MD5 e1528b5176081f0ed963ec8397bc8fd3
SHA1 ff60afd001e924511e9b6f12c57b6bf26821fc1e
SHA256 1690c4e20869c3763b7fc111e2f94035b0a7ee830311dd680ac91421daad3667
SHA512 acf71864e2844907752901eeeaf5c5648d9f6acf3b73a2fb91e580bee67a04ffe83bc2c984a9464732123bc43a3594007691653271ba94f95f7e1179f4146212

C:\Users\Admin\AppData\Local\Temp\grandUIAQgiJEtFCyfqMS\information.txt

MD5 e3ab20858bd9df489491f66f2878914a
SHA1 69569b1936bffbb8c9cbdd1e6ed82392adeafb36
SHA256 9cbf06d71fcb1d2ae19faaee1b944fc7818506e945472f847bfe77c8b2524823
SHA512 7f0defc75c6e6aa61d3b20a59addab7c668712707f9e2c1de28387655317569b4d00ea5d552e989aa545962b18f9d24fdb3b0768d90d723a27a5ab562d06d897

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2e4f9f4f7fe2d46bffdebf22e0054052
SHA1 e029682416aa43889a544e7973d856c1082ca50b
SHA256 cfaaa66b21472235ab9cab0a281270a54b5628812d2d2899cdbe6299b3b6abc1
SHA512 c5acfdae6ae4ab35fb16031e08b9ee0f4bfddf41eddd89f7326c8c84cc1ab5fb5d99d848b7f638234517e803f56be3a068a85c782dc980e981189fe4e6166390

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1d87492137b200261aa200711c5261b8
SHA1 cf36521d0dc0dea76044787456af09aad2578c42
SHA256 0f509a1ecc1c7e827fd90e3d35392734d7710fd132f090646fae2b3271103065
SHA512 7d4539915893b938ea269876db7601116bce927898758cb291b4aa733680c6d94030bfcafbca5f1f8610a0af33fe1dec76eaad9005ea38be807372120b68698a

memory/5040-2879-0x0000000000400000-0x000000000090C000-memory.dmp

memory/5040-2880-0x0000000002630000-0x00000000027C5000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d0714c89d2e59bdba5cd2e26f1f4afd9
SHA1 31a17e9e4bae1fc3ea50e6b54efa5a2d36c44daf
SHA256 51747897fe01da96ac5b72eaec6fa1722124b99ca79e23a6149c95b4583a3cbf
SHA512 3f6f737a2d4bdb6b2158ba7ea503794727d9e237e2d7c7ab08b024082fd4ede71e3712eba88f92e399e10bce461ccc4cb6e8ede893697bca9375756d5d414831

memory/3520-2921-0x00000000009E2000-0x00000000009F3000-memory.dmp

memory/3520-2924-0x0000000000220000-0x0000000000224000-memory.dmp

memory/4756-2920-0x0000000000400000-0x0000000000406000-memory.dmp

memory/2216-2929-0x0000000076220000-0x0000000076330000-memory.dmp

memory/4756-2930-0x0000000000400000-0x0000000000406000-memory.dmp

memory/2216-2931-0x0000000076220000-0x0000000076330000-memory.dmp

memory/2216-2935-0x0000000076330000-0x0000000076377000-memory.dmp

memory/2216-2934-0x0000000076220000-0x0000000076330000-memory.dmp

memory/2216-2936-0x0000000076220000-0x0000000076330000-memory.dmp

memory/2216-2938-0x00000000741E0000-0x00000000748CE000-memory.dmp

memory/2216-2937-0x0000000076220000-0x0000000076330000-memory.dmp

memory/2216-2933-0x0000000000C10000-0x00000000016DA000-memory.dmp

memory/2216-2932-0x0000000076220000-0x0000000076330000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 57ef9d2f8fed6be441e383c2f7bcbb30
SHA1 171b645ccd7b8d03ec4a7900a6aa5aa78449b30b
SHA256 a59799f301ea1dbaddd91ea8eb1ceb8ab6f6a03195d69b5e004c09d41a721a23
SHA512 93306d60f3e53240581b7c8912b25549947b4aee2ca93aad44a5e9b8f7feca3ac8e017a2f99f85b697c59cc4ea8083ef06b586de7db72748918c5c9b95f26be2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 06fd0f063d15cf37be2a889a0a514654
SHA1 8e3985acaf409a66d31e3853eccaf568045b742d
SHA256 54345faa5abd63d88671e4369a5ef47a3b4f06460678aea855fd4177ebdd8b77
SHA512 9be07cadc0eb46f7854bd9a0aacfaa0fa8aac9f4145f17734ce2e81712e9683ac8c6cfd39636bbd77e8e3dd816e613db135646dfd1fbd5dc5b20aaf284bbd55b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 57b9dbe9817f63225b2e1caaaae14c8d
SHA1 64112a4831a7251dc3df71130242e2ace5133f8c
SHA256 1fe6cd6a9464a88ac67f78620b0d15b4d80720c0d5af52d8d2df82e3f3050d0b
SHA512 656f93bc18f63645140683b975682cdfc7b744cd50af168f5be02903c13d82c639c839ddd0de8cdc53a056d5ebc512c02a0ba5b8149127b04b0ff683bc6c026c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9029bf6da86e4112b66cb4e635483241
SHA1 0319227b9e6f93764008e7ecf2bcc45a2a69c0c5
SHA256 ab72f7405acb3be3957a0b360dec543a8cc7a9f2c8fb721be579367ca68d3cdc
SHA512 a53c9c7234c12c02c407b3a20621b68ce2c72098beb1cc810e38f47add2eef3d4c81ce8ad59bc3571de781fc029be5ebb0601ba1be04d49205661a224da63ac9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b9213d4b8417096ab636b0f4383b8fd9
SHA1 b12dd2f8a9e2c32ebb770f92a0e8e90a2d889330
SHA256 7b43f39bad7ee679c9e6a07440fcda5dffa569208c4c0bc858d27bb0d28ec673
SHA512 e74454e5d4cbc17f34d9e92aa1b4d99b850d088a3383776d9c38d945c8fdbd2c47ca2ae155e31ed86c3f096811991c8540c64bd452e8f52c3c03545a5e86b95c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 edd96f2527ad673d0e08dc2b75e42109
SHA1 468661d0b072c940953031c3fd8fa2d45732c687
SHA256 c9172992c3cb63cd2cf3c6cff7899f6dfbaab1d324327f109e22c7ea424c6348
SHA512 966f554476328b3d47f08f0a6611af0cd3c111016e86c17cf7030a3bdac5fe83c2b0f58272ecf3f7c9a61c02e8a1233803ea0ca21762b9d3d876dac549e2e4f8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c98fc4e440826a0ecd865714aca3bc5b
SHA1 798b02ad52ae34d4407b75f1440c936af35dd8aa
SHA256 117846d5b42ae87ea58cc8e162570975b4065f0ba07b25fec0b31a0b2c24e3c3
SHA512 1b9fc67ae00f5962060ddefd8fb6d4a1562e35905d2872e77ae87d550c828a8e26854add37b6e929bdd387b9e036881ca14969460462a11cb18d2a8b61fdd8fa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7a21f9fdbe9607280ef598e23f5c14cc
SHA1 ce3e1e742d34b18e84d24195a42d80c11df3514b
SHA256 868221446562e33774c33f3b601731791229a9d33516b63d2ecebb459a8d1619
SHA512 6d30a0edbc4fcfd91dcc0e1b1c8e7cc8e52689d0c6100ab2e9bf397dbc8fdfc50fdb67fac2bd60643b982797ff649b36ba09fe37efcd8e8c90492f60ed3e75da

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 96a3552b1b3b1d119076670198a417cc
SHA1 039a1ccb64ae61ca8b99168486d1daacfa39db32
SHA256 f0e7ecbda9d72e2a94fcfd2e1680464adbe034fd6fb6bd5e51f4e31f89a1f10c
SHA512 03c2c62265ff9f894130ed624dee408a29ff45c2246f1acdf24ea6efd38bbdedba57ac1662ff3f724f2492ae1268bc7c13205e1261e09f3f3b537680c11dfc86

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 88f5205f80905524f34f67b308b1691a
SHA1 074b6ec37d5f6969fccdec9cfef9ae032fe35f19
SHA256 f9d7b54770c539502efdad52f490bcda34edf07c2053b74609879d7ca2c6507b
SHA512 c24d8f0a9833dc5047a3e0d2da3b312ff1d936d4bb8fec3cbe8c7ebd8e2f553e30a5e2336b106104f688548c38510ef7a14b6461e12809fc2ed14cbad8f8cfdd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c48f59a475c1517e884fa4066ce4a558
SHA1 c86260c3b4bbc9e55361a834fad635c002074b30
SHA256 637c3690ebc3793a527958757db049093ec1935a0a3fed2297950d9cf4323740
SHA512 381b29b17d4156d3824a9ae381e4023f265f6f474e67b018dbb06ac464064bac3b5073e854784ffaa1084824b232e913b15c44cf5c12784903f1a1740d4adec3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2c813346cc327bf5aa941e4d21fdc005
SHA1 d087a5deb9d59e9fcf58fe6f9f12fd311d709dae
SHA256 1a6df705551f35c6e29fdc7b0e0f3b6a0f8a45b2195740795f6196d442f1cf35
SHA512 4b48170681e48ee788c1751ee852bd0f07704bd689fc62d0e448076e4c2594732557fa52812c4ec4ed9ec973362baf7c5433794c8cd06ec2b0ee69f5a732f51b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fa3f914661ddbb8517a221aa3ab583fb
SHA1 5f3657659a815d7717262674c1c078e13ffec459
SHA256 07a7a408b5f3797f4fbb8e12e10853abb9a392c0c58c725cd7b4d703aa48f387
SHA512 1dd777430a37b85a42d46cebba9cabfa7f5764999ed6498c9fb93559d7223b9222d6db4861901806df8e6ca115f21081ca25ea809345043dd5863df8008dd79f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ac49c7a9463831be758800ab5189edaf
SHA1 ba253b50b00bbb314b2837dbf574991ec1da7379
SHA256 22bed9337c21de38b09a290dc2ef096d195e30cf0e7bb5f4ca79e57ed0e35d93
SHA512 d92c2bab596e807b890c6b4abc6985a4ca566f40c6a7ab4230913a45e4b017f1caf0ebe928ac7813e6477960caf67e1966b917d852a806002e8869bdde9bc1a8

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-12 04:31

Reported

2023-12-12 04:33

Platform

win10v2004-20231127-en

Max time kernel

150s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe"

Signatures

DcRat

rat infostealer dcrat

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe N/A

PrivateLoader

loader privateloader

RisePro

stealer risepro

SmokeLoader

trojan backdoor smokeloader

ZGRat

rat zgrat

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\C323.exe N/A

Downloads MZ/PE file

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\C323.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\C323.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\D66D.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\C323.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A N/A N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\F2E2.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MZ1kH39.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gB6wC87.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\dd8032d2-9f19-4b6f-908f-0ed659910701\\D66D.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\D66D.exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\C323.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A
N/A api.2ip.ua N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\GroupPolicy C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A
File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A
File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A
File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\C323.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4WG967Qv.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4WG967Qv.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4WG967Qv.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4WG967Qv.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\EB30.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\C323.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\DF58.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2152 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe
PID 2152 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe
PID 2152 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe
PID 2152 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe
PID 2152 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe
PID 2152 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe
PID 3288 wrote to memory of 1844 N/A N/A C:\Windows\system32\cmd.exe
PID 3288 wrote to memory of 1844 N/A N/A C:\Windows\system32\cmd.exe
PID 1844 wrote to memory of 3700 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 1844 wrote to memory of 3700 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3288 wrote to memory of 4884 N/A N/A C:\Windows\system32\cmd.exe
PID 3288 wrote to memory of 4884 N/A N/A C:\Windows\system32\cmd.exe
PID 4884 wrote to memory of 1572 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 4884 wrote to memory of 1572 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3288 wrote to memory of 4756 N/A N/A C:\Users\Admin\AppData\Local\Temp\C323.exe
PID 3288 wrote to memory of 4756 N/A N/A C:\Users\Admin\AppData\Local\Temp\C323.exe
PID 3288 wrote to memory of 4756 N/A N/A C:\Users\Admin\AppData\Local\Temp\C323.exe
PID 3288 wrote to memory of 740 N/A N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe
PID 3288 wrote to memory of 740 N/A N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe
PID 3288 wrote to memory of 740 N/A N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe
PID 740 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe C:\Users\Admin\AppData\Local\Temp\D66D.exe
PID 740 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe C:\Users\Admin\AppData\Local\Temp\D66D.exe
PID 740 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe C:\Users\Admin\AppData\Local\Temp\D66D.exe
PID 740 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe C:\Users\Admin\AppData\Local\Temp\D66D.exe
PID 740 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe C:\Users\Admin\AppData\Local\Temp\D66D.exe
PID 740 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe C:\Users\Admin\AppData\Local\Temp\D66D.exe
PID 740 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe C:\Users\Admin\AppData\Local\Temp\D66D.exe
PID 740 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe C:\Users\Admin\AppData\Local\Temp\D66D.exe
PID 740 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe C:\Users\Admin\AppData\Local\Temp\D66D.exe
PID 740 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe C:\Users\Admin\AppData\Local\Temp\D66D.exe
PID 4764 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe C:\Windows\SysWOW64\icacls.exe
PID 4764 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe C:\Windows\SysWOW64\icacls.exe
PID 4764 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe C:\Windows\SysWOW64\icacls.exe
PID 3288 wrote to memory of 808 N/A N/A C:\Users\Admin\AppData\Local\Temp\DF58.exe
PID 3288 wrote to memory of 808 N/A N/A C:\Users\Admin\AppData\Local\Temp\DF58.exe
PID 4764 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe C:\Users\Admin\AppData\Local\Temp\D66D.exe
PID 4764 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe C:\Users\Admin\AppData\Local\Temp\D66D.exe
PID 4764 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe C:\Users\Admin\AppData\Local\Temp\D66D.exe
PID 4388 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe C:\Users\Admin\AppData\Local\Temp\D66D.exe
PID 4388 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe C:\Users\Admin\AppData\Local\Temp\D66D.exe
PID 4388 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe C:\Users\Admin\AppData\Local\Temp\D66D.exe
PID 4388 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe C:\Users\Admin\AppData\Local\Temp\D66D.exe
PID 4388 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe C:\Users\Admin\AppData\Local\Temp\D66D.exe
PID 4388 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe C:\Users\Admin\AppData\Local\Temp\D66D.exe
PID 4388 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe C:\Users\Admin\AppData\Local\Temp\D66D.exe
PID 4388 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe C:\Users\Admin\AppData\Local\Temp\D66D.exe
PID 4388 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe C:\Users\Admin\AppData\Local\Temp\D66D.exe
PID 4388 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\D66D.exe C:\Users\Admin\AppData\Local\Temp\D66D.exe
PID 3288 wrote to memory of 2416 N/A N/A C:\Users\Admin\AppData\Local\Temp\EB30.exe
PID 3288 wrote to memory of 2416 N/A N/A C:\Users\Admin\AppData\Local\Temp\EB30.exe
PID 3288 wrote to memory of 2416 N/A N/A C:\Users\Admin\AppData\Local\Temp\EB30.exe
PID 3288 wrote to memory of 1432 N/A N/A C:\Users\Admin\AppData\Local\Temp\F2E2.exe
PID 3288 wrote to memory of 1432 N/A N/A C:\Users\Admin\AppData\Local\Temp\F2E2.exe
PID 3288 wrote to memory of 1432 N/A N/A C:\Users\Admin\AppData\Local\Temp\F2E2.exe
PID 1432 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\F2E2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MZ1kH39.exe
PID 1432 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\F2E2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MZ1kH39.exe
PID 1432 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\F2E2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MZ1kH39.exe
PID 4796 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MZ1kH39.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gB6wC87.exe
PID 4796 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MZ1kH39.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gB6wC87.exe
PID 4796 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MZ1kH39.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gB6wC87.exe
PID 560 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gB6wC87.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe
PID 560 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gB6wC87.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe
PID 560 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gB6wC87.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe
PID 2944 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe

"C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe"

C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe

"C:\Users\Admin\AppData\Local\Temp\c98e8ff8ff04152c062fb39408e19e05.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B769.bat" "

C:\Windows\system32\reg.exe

reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B9CB.bat" "

C:\Windows\system32\reg.exe

reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1

C:\Users\Admin\AppData\Local\Temp\C323.exe

C:\Users\Admin\AppData\Local\Temp\C323.exe

C:\Users\Admin\AppData\Local\Temp\D66D.exe

C:\Users\Admin\AppData\Local\Temp\D66D.exe

C:\Users\Admin\AppData\Local\Temp\D66D.exe

C:\Users\Admin\AppData\Local\Temp\D66D.exe

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\dd8032d2-9f19-4b6f-908f-0ed659910701" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\DF58.exe

C:\Users\Admin\AppData\Local\Temp\DF58.exe

C:\Users\Admin\AppData\Local\Temp\D66D.exe

"C:\Users\Admin\AppData\Local\Temp\D66D.exe" --Admin IsNotAutoStart IsNotTask

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5048 -ip 5048

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 568

C:\Users\Admin\AppData\Local\Temp\D66D.exe

"C:\Users\Admin\AppData\Local\Temp\D66D.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\EB30.exe

C:\Users\Admin\AppData\Local\Temp\EB30.exe

C:\Users\Admin\AppData\Local\Temp\F2E2.exe

C:\Users\Admin\AppData\Local\Temp\F2E2.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gB6wC87.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gB6wC87.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MZ1kH39.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MZ1kH39.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffebf9f46f8,0x7ffebf9f4708,0x7ffebf9f4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffebf9f46f8,0x7ffebf9f4708,0x7ffebf9f4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x16c,0x170,0x174,0x148,0x178,0x7ffebf9f46f8,0x7ffebf9f4708,0x7ffebf9f4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffebf9f46f8,0x7ffebf9f4708,0x7ffebf9f4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2524 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffebf9f46f8,0x7ffebf9f4708,0x7ffebf9f4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,2886089277515987251,9168032825719720703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2308 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2428 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4312 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffebf9f46f8,0x7ffebf9f4708,0x7ffebf9f4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffebf9f46f8,0x7ffebf9f4708,0x7ffebf9f4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffebf9f46f8,0x7ffebf9f4708,0x7ffebf9f4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffebf9f46f8,0x7ffebf9f4708,0x7ffebf9f4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x80,0x170,0x7ffebf9f46f8,0x7ffebf9f4708,0x7ffebf9f4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1519108092937694364,6216025800450785669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffebf9f46f8,0x7ffebf9f4708,0x7ffebf9f4718

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4WG967Qv.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4WG967Qv.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,18019736446971617123,8347678862629736409,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2328 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18019736446971617123,8347678862629736409,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18019736446971617123,8347678862629736409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,18019736446971617123,8347678862629736409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,18019736446971617123,8347678862629736409,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18019736446971617123,8347678862629736409,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18019736446971617123,8347678862629736409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7QM3sU32.exe

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18019736446971617123,8347678862629736409,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18019736446971617123,8347678862629736409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18019736446971617123,8347678862629736409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 7128 -ip 7128

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7128 -s 1780

C:\Users\Admin\AppData\Local\Temp\DF58.exe

C:\Users\Admin\AppData\Local\Temp\DF58.exe

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,18019736446971617123,8347678862629736409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,18019736446971617123,8347678862629736409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 /prefetch:8

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2416 -ip 2416

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 1220

C:\Users\Admin\AppData\Local\AceFlags\oqababl\ContextProperties.exe

C:\Users\Admin\AppData\Local\AceFlags\oqababl\ContextProperties.exe

C:\Users\Admin\AppData\Local\AceFlags\oqababl\ContextProperties.exe

C:\Users\Admin\AppData\Local\AceFlags\oqababl\ContextProperties.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 host-host-file8.com udp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 24.52.193.212.in-addr.arpa udp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 edarululoom.com udp
US 104.21.42.224:443 edarululoom.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 224.42.21.104.in-addr.arpa udp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 brusuax.com udp
KR 58.151.148.90:80 brusuax.com tcp
US 8.8.8.8:53 90.148.151.58.in-addr.arpa udp
US 38.47.221.193:34368 tcp
US 8.8.8.8:53 193.221.47.38.in-addr.arpa udp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
RU 212.193.52.24:80 host-host-file8.com tcp
US 185.196.8.238:80 185.196.8.238 tcp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 24.65.21.104.in-addr.arpa udp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 238.8.196.185.in-addr.arpa udp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 transfer.sh udp
DE 144.76.136.153:443 transfer.sh tcp
US 8.8.8.8:53 153.136.76.144.in-addr.arpa udp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 genesiscarat.com udp
RU 92.118.112.94:443 genesiscarat.com tcp
US 8.8.8.8:53 94.112.118.92.in-addr.arpa udp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 alata.com.sa udp
US 192.185.30.176:80 alata.com.sa tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 176.30.185.192.in-addr.arpa udp
RU 109.107.182.45:80 109.107.182.45 tcp
US 8.8.8.8:53 store.steampowered.com udp
US 8.8.8.8:53 accounts.google.com udp
US 92.123.241.50:443 store.steampowered.com tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 104.244.42.1:443 tcp
BE 64.233.166.84:443 accounts.google.com tcp
GB 157.240.221.35:443 tcp
US 8.8.8.8:53 steamcommunity.com udp
BE 64.233.166.84:443 accounts.google.com udp
GB 104.103.202.103:443 steamcommunity.com tcp
US 8.8.8.8:53 35.221.240.157.in-addr.arpa udp
US 8.8.8.8:53 1.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 103.202.103.104.in-addr.arpa udp
US 8.8.8.8:53 www.paypal.com udp
US 151.101.1.21:443 www.paypal.com tcp
US 8.8.8.8:53 www.epicgames.com udp
US 54.236.192.0:443 www.epicgames.com tcp
US 8.8.8.8:53 21.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 0.192.236.54.in-addr.arpa udp
US 8.8.8.8:53 www.youtube.com udp
GB 142.250.179.238:443 www.youtube.com tcp
US 8.8.8.8:53 71.10.230.54.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 238.179.250.142.in-addr.arpa udp
GB 142.250.187.227:443 udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
FR 216.58.204.68:443 www.google.com tcp
US 8.8.8.8:53 68.204.58.216.in-addr.arpa udp
US 193.233.132.51:50500 tcp
US 8.8.8.8:53 51.132.233.193.in-addr.arpa udp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.59.81:443 ipinfo.io tcp
US 8.8.8.8:53 81.59.117.34.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
RU 213.21.220.222:8080 tcp
GB 142.250.187.227:443 tcp
GB 142.250.200.35:443 tcp
US 8.8.8.8:53 222.220.21.213.in-addr.arpa udp
US 8.8.8.8:53 udp
RU 212.193.52.24:80 tcp
RU 81.19.131.34:80 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
GB 142.250.200.35:443 tcp
GB 142.250.200.35:443 tcp
GB 142.250.200.35:443 tcp
RU 81.19.131.34:80 tcp
US 8.8.8.8:53 3.173.189.20.in-addr.arpa udp

Files

memory/2152-1-0x0000000000B10000-0x0000000000C10000-memory.dmp

memory/2152-2-0x0000000000B00000-0x0000000000B09000-memory.dmp

memory/2020-3-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2020-4-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2020-6-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3288-5-0x00000000009C0000-0x00000000009D6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\B769.bat

MD5 55cc761bf3429324e5a0095cab002113
SHA1 2cc1ef4542a4e92d4158ab3978425d517fafd16d
SHA256 d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a
SHA512 33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

C:\Users\Admin\AppData\Local\Temp\C323.exe

MD5 d2e51964c34d7b0572f90ad3c496466e
SHA1 fedcf11c7f18b3c6e0e53d7c6bfe0584d3fb073a
SHA256 186023e6180f0e2c51a519427362bfae15708257f2744604477c7c30311716e3
SHA512 b3affe943b692b7d9406353d59f1e876117f0583be6fc4b08a09c20e2838d2d5c22472e1f792db47d9eb4c36c5541b15acf0ee02cd9090c5316cb9d09042fb63

C:\Users\Admin\AppData\Local\Temp\C323.exe

MD5 70e4d975f15d4933da2e2e4772523883
SHA1 bd36fb823e470883efcb0ae955634f552cf9556c
SHA256 e6934d21a8f4d72eac7cadb2f5d3b9b8d7ece47118cbb96a23faefce4c2787ce
SHA512 ea6db17a7640a2b90d6d5ca5e129632abad6eaa125a8d309534e0b07c72b2da82b45494c9a6f368e1bad6cb93030c7f7d4bbe2c476c7eb1f500bb3549bddd236

memory/4756-25-0x0000000000D30000-0x00000000016EC000-memory.dmp

memory/4756-26-0x0000000075C70000-0x0000000075D60000-memory.dmp

memory/4756-27-0x0000000075C70000-0x0000000075D60000-memory.dmp

memory/4756-28-0x0000000075C70000-0x0000000075D60000-memory.dmp

memory/4756-30-0x0000000075C70000-0x0000000075D60000-memory.dmp

memory/4756-31-0x0000000075C70000-0x0000000075D60000-memory.dmp

memory/4756-32-0x0000000077B54000-0x0000000077B56000-memory.dmp

memory/4756-29-0x0000000075C70000-0x0000000075D60000-memory.dmp

memory/4756-33-0x0000000075C70000-0x0000000075D60000-memory.dmp

memory/4756-36-0x0000000000D30000-0x00000000016EC000-memory.dmp

memory/4756-37-0x0000000008490000-0x0000000008A34000-memory.dmp

memory/4756-38-0x0000000007F80000-0x0000000008012000-memory.dmp

memory/4756-39-0x0000000008110000-0x000000000811A000-memory.dmp

memory/4756-40-0x0000000009060000-0x0000000009678000-memory.dmp

memory/4756-41-0x0000000008A40000-0x0000000008B4A000-memory.dmp

memory/4756-42-0x0000000008340000-0x0000000008352000-memory.dmp

memory/4756-43-0x00000000083A0000-0x00000000083DC000-memory.dmp

memory/4756-44-0x00000000083E0000-0x000000000842C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D66D.exe

MD5 454440503db62af8520be0827389df6a
SHA1 473f9a477bdb8a408e7fad05e858dbbaa76f1dda
SHA256 b816a1f49cf7a431b9c23d32cb60eb6bae72d88b23b19a861e5f690488b00d57
SHA512 6c7f3847a00033394f5b8adb1fadb177b6103ccd6a9205dd2dad45e550805a0cf8295df2353bbf62ce9e629c3218e6c44621f716ebef23931b34ba4102debc15

memory/740-51-0x0000000002650000-0x00000000026E4000-memory.dmp

memory/740-54-0x00000000026F0000-0x000000000280B000-memory.dmp

memory/4764-53-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D66D.exe

MD5 a99b339b78da4b4c8b8db75fafabfb0b
SHA1 83f65ab67f97e36362376bcf51360188ce381c18
SHA256 fb755d4e0893611c4ce3bc56309a2a80cdf9adff782d7f3f10a4948f1f4f511c
SHA512 76fcec8b4ceac23950582da271a7acac2af7578f56c0e979718d02002ba9d9c18dff832bb1a2f49a8c84ad8d1fe0951e57024fb80758cde313cc516b591fbd45

memory/4764-50-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4764-55-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4764-56-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\dd8032d2-9f19-4b6f-908f-0ed659910701\D66D.exe

MD5 38896a361ade17512c264b1608c721cf
SHA1 40ac678d12fbee6fc5750b83c1d9d56e17763fea
SHA256 f5ee18d20a089d206f28a6aebde1f010c569242fcc708e6eeb77f0db5fc53bce
SHA512 54782549b707a6c9889dc1ffad8a6f654b942fe9c7b0fdd1d6e64c8b2278511675e0000e7c43602e4bdf005ee118787fb72a49458070da24352dd48b53a0ec3b

C:\Users\Admin\AppData\Local\Temp\DF58.exe

MD5 20ccaf9d91a78a59c086d53e22a7bb6c
SHA1 4b3c875227bbeb4742b2633e0e93e83e1634f6a5
SHA256 359eb7858b4c873b7dee6fa8b9d19b4f58c6e9bbf4c323dd44e962ba783b2fd0
SHA512 fdf33ed9812d49baa2c4fdc3ced2d3c5470ec8f5510744633fbd7b9b272bb09715eabf05326059e2169803ca01a36cf906a577fad55fd085aa79f03950626b75

C:\Users\Admin\AppData\Local\Temp\DF58.exe

MD5 489cff10aa13658719dadd92187b70c0
SHA1 27aa602226af41d3a79f4e3365f90b402c4ed9f5
SHA256 aaaf003879e29c3ae3c10502313ecee2e2d04c4dd4e947863345624e171ef40d
SHA512 330a44eb1ba08b77903bf5c58aa38bff82b00ce4f00084d7de082c58a1a079f7b7cbbbac7b7f7577fa68f5e35854ff2a76206bd3f0bb31d6b72f124b485c1ea8

memory/808-71-0x000001CB60160000-0x000001CB60290000-memory.dmp

memory/808-70-0x00007FFEBE6D0000-0x00007FFEBF191000-memory.dmp

memory/808-69-0x000001CB5E2F0000-0x000001CB5E42A000-memory.dmp

memory/4764-73-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D66D.exe

MD5 79d5f69113af1d589e36929bc3d5fe22
SHA1 66774180d78f74e07d7ee11a4fad1d107f24c545
SHA256 9a138db343ad3bab20bc20108957de668216e29313712101f5b374e5024f24f1
SHA512 9b41988e9aedb6595440aea1eb3c7410ba280355ee54b3b05759b93b43094913fb1016e6a43e414f7264452f00a4b33a9fe078f3839f6c4a2b793f9178a4fd4b

memory/808-75-0x000001CB60160000-0x000001CB6028A000-memory.dmp

memory/808-76-0x000001CB60160000-0x000001CB6028A000-memory.dmp

memory/808-78-0x000001CB60160000-0x000001CB6028A000-memory.dmp

memory/808-80-0x000001CB60160000-0x000001CB6028A000-memory.dmp

memory/808-84-0x000001CB60160000-0x000001CB6028A000-memory.dmp

memory/808-87-0x000001CB60160000-0x000001CB6028A000-memory.dmp

memory/4388-89-0x0000000002400000-0x000000000249E000-memory.dmp

memory/808-90-0x000001CB60160000-0x000001CB6028A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D66D.exe

MD5 14405897240db0a621e2bdf8e0751aad
SHA1 9ce03a5290c7571ac196b9a311a07cf4244090b2
SHA256 506d22e07b9c4ac24a57b693deaa7158f72c904d221e5ef7d3710911c7a38a37
SHA512 044ed9cb6247025956f20002f0a13017cf966102d851b20610b13f5145276889257716edfe1f1d5f14e7384091d9204991e7805317c87f71dc2e48530c705bd5

memory/5048-98-0x0000000000400000-0x0000000000537000-memory.dmp

memory/808-101-0x000001CB60160000-0x000001CB6028A000-memory.dmp

memory/808-104-0x000001CB60160000-0x000001CB6028A000-memory.dmp

memory/808-106-0x000001CB60160000-0x000001CB6028A000-memory.dmp

memory/5048-102-0x0000000000400000-0x0000000000537000-memory.dmp

memory/808-97-0x000001CB60160000-0x000001CB6028A000-memory.dmp

memory/808-108-0x000001CB60160000-0x000001CB6028A000-memory.dmp

memory/5048-96-0x0000000000400000-0x0000000000537000-memory.dmp

memory/808-110-0x000001CB60160000-0x000001CB6028A000-memory.dmp

memory/808-114-0x000001CB60160000-0x000001CB6028A000-memory.dmp

memory/808-116-0x000001CB60160000-0x000001CB6028A000-memory.dmp

memory/808-118-0x000001CB60160000-0x000001CB6028A000-memory.dmp

memory/808-112-0x000001CB60160000-0x000001CB6028A000-memory.dmp

memory/808-120-0x000001CB60160000-0x000001CB6028A000-memory.dmp

memory/808-126-0x000001CB60160000-0x000001CB6028A000-memory.dmp

memory/808-128-0x000001CB60160000-0x000001CB6028A000-memory.dmp

memory/808-124-0x000001CB60160000-0x000001CB6028A000-memory.dmp

memory/808-130-0x000001CB60160000-0x000001CB6028A000-memory.dmp

memory/808-122-0x000001CB60160000-0x000001CB6028A000-memory.dmp

memory/808-93-0x000001CB60160000-0x000001CB6028A000-memory.dmp

memory/4756-141-0x0000000008C60000-0x0000000008CC6000-memory.dmp

memory/808-82-0x000001CB60160000-0x000001CB6028A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\EB30.exe

MD5 8a6a030b76420293e06eb991d9c2ac18
SHA1 bddb19ec73fce6989848e3ac3dbcbbbec80dde0c
SHA256 3104772921fe88ca534cd942dd78930127792b34e8406e6d748d6be47e0450ef
SHA512 5fb1ed6b48ea9143d4070b814301950c192ee6de36c64d94e26a2e4e08ebcb59b00c499350736f93e33715bb4ab6ac866330cfcdda38ed5bed202d0f0fe64e12

C:\Users\Admin\AppData\Local\Temp\EB30.exe

MD5 cfb853c31d54e2979f33f9786cf568e4
SHA1 07513be8c48e8ac035f10f7e7802f2f9e0a04426
SHA256 d690eb2918fcac3fa38e251dd34c51332ba70ae726d1e3ba5141a4250879869f
SHA512 a6609ed1f25028cd6b1131e99411bae2bf17b025f586ccd04b5e1bfe7be5ebb98c52fc9048e217d8da519468d6abdefcf7cb462a108739dc3963a3e696115298

memory/2416-171-0x0000000002870000-0x00000000028BC000-memory.dmp

memory/4756-173-0x0000000000D30000-0x00000000016EC000-memory.dmp

memory/2416-178-0x0000000000B30000-0x0000000000C30000-memory.dmp

memory/2416-181-0x00000000024D0000-0x000000000251F000-memory.dmp

memory/2416-186-0x0000000005000000-0x0000000005010000-memory.dmp

memory/2416-183-0x0000000000400000-0x0000000000875000-memory.dmp

memory/2416-189-0x0000000005000000-0x0000000005010000-memory.dmp

memory/2416-196-0x0000000075040000-0x00000000757F0000-memory.dmp

memory/2416-177-0x0000000002A10000-0x0000000002A5A000-memory.dmp

memory/4756-199-0x0000000075C70000-0x0000000075D60000-memory.dmp

memory/4756-175-0x0000000075C70000-0x0000000075D60000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\F2E2.exe

MD5 8c155067b5c9b4b4b26ba3a4b3818033
SHA1 b5abbe1264f97b845c1029861cd19f8ec35d5d8a
SHA256 f2e490c03d65ecdd3e3c07d36f58cc7840d14f1adb60e875c445d87504aca9f6
SHA512 f84e61a78889fe60d84c631491d042a37da1d11bde56e368ffdf446a23554dc8b53085d4b091622033ea18fbd48a642d2bcbdd0747baa3c05a8a02874e85debd

C:\Users\Admin\AppData\Local\Temp\F2E2.exe

MD5 c22c92b2213c34bd3099cb624a2d2654
SHA1 d760ca6d47d6e0fa748e782bf3ed4f96e49e42a9
SHA256 9024d30357b911eed2eaf58cb247a6b5a4f4f6fd001f75fa5fcab0e52e6cc10c
SHA512 d4276bd118c636b65db2679214938ceee757054a41b51c92f4ebe8e9fadf05453fc9cc101837f87760520dd35eaaedb3f40ee8cad51724bd1dcd0e1d3efb932b

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gB6wC87.exe

MD5 1263e6b198d4a20f570074cee23cce4d
SHA1 9cd9a1865feec0c2470738d0290de0e031f6141e
SHA256 e8600c33ad435ceeea03e0ac870c703fded5f928cf645651445e8fa3fb69bb1a
SHA512 12a0dc7671deb15a39aa58d478a9c33b26bec87ae1521a0f47dbd81509452da6b6366a6ba812e37046c2d7ef9114507ebc87f0912612657fc3560bf3fbd5dff7

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe

MD5 e851174f45457b44a92ea796a05378d4
SHA1 65128a993d07867eb080d8f0410263e86d5b7056
SHA256 e914efa498c98cfdb9b2661e9bc3416bc5b9671a1840712d7fcfabc09252689e
SHA512 f0765bf9a8a02eb2ca15ae5fa1766df4c3762d33a8f622d7e05ad29b5b37ad59818dfd8f348d03e93c8cfc77e01a591c3c7cc84b3d78a59ec42e7383268374aa

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1pV81kt4.exe

MD5 c71139dbb3a5a7cdd21a6faaa86d35e1
SHA1 ab8f23d4c689536c2ac331477abe3cf48a689426
SHA256 f943626c5ddf1d6f121ef90c0ee2124c36ce6f747cae9447952cd542d4f0caca
SHA512 80ed898acaf98a716b868816021968ff3b7bc0eb4ea45bda3b1d98ca2acf3f13905f9b4e43d6fc418d34ff8d97ad4b471d657519915ffd98fe9c9ebd7a0d25c2

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gB6wC87.exe

MD5 18f22f6769d72a82cd2f08150157dcdd
SHA1 8c14398b66fb5aa0c84d807636cb66e2c565ed68
SHA256 49909a5b1190b08648c4115bd8e88c8efb005ff7f31273f46b77d8d3cc85be1b
SHA512 52200816592c72c7aa483852e8add90eb1efc6b8abdb66b39a9086539789f52ab8f4430e8901a7ce8386555af1161bc00ae695dd8c678e2967bd24f7cf6ba9f0

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MZ1kH39.exe

MD5 12ff7a3ef2a3b88706fb58c7feda73de
SHA1 1ca23327274e573f510a898c361c965e1581de04
SHA256 76522bf4426b1dc477c6a14a0e2fde2580b50fdecb8f1a861d508d3e0ce11b78
SHA512 b03412ce57ab34f9563448346e35a92321f6a4b5670ebd15c95dce9a98dd06532245bb554277e2b7757ea8694ce0dded05c57c5074effb62b7c961216d54efe4

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MZ1kH39.exe

MD5 2c60868fd3ba715c67fb11bbab61f485
SHA1 0f057bdca748cd011fe5b8e0002a57631c0ef1be
SHA256 bc5b5adf3286e620a47806a692a917141bd8e0378fbff8ca73d4dfcf4812ef04
SHA512 c8f222f7d1d324002a6dccc00606dfdbb21e5e770799ec838328dbbcf93e186751eab0dea399f840e3ff195a71c9c48239a781514f0860e835424e9b45b8d933

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 e5c27b4a4d5a3c9c60ba18cb867266e3
SHA1 dea55f1d4cdc831f943f4e56f4f8e9a926777600
SHA256 860ed0acc83eb0096cc8911725e2c631ff879ad8c35854577651af502c4b69c9
SHA512 56eda28e9c61e8081dadc220d23e7bb3320a9ba557eb7511d17a3d2836aa61f301d1d714a3d611eedd7c4b91886c790af7366b01acdb3b637f3dc4fb024f3f6b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 e3936bdf35c1e26def3effb316e9b419
SHA1 79223aedf4a08bc22448493ce46841961f5c6791
SHA256 4584bd1815d9476f80aa6032992e791f966102003ca05f51b977b2887faa63be
SHA512 11f6dd3e352433ebb113751dc5505d679fda308a0279fd930f635f727396528690a9a536b578122a3bfb10b80e2fa513f2d27464296e6b4066f6bdca9230c744

\??\pipe\LOCAL\crashpad_1268_RFDSQXXTQWYTWYQP

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/4756-519-0x000000000A780000-0x000000000A942000-memory.dmp

memory/4756-526-0x000000000AE80000-0x000000000B3AC000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 3e61f1b5c83d57794fb57876a8ce4886
SHA1 d69fb46fde92526ba21a2ee39d9b98445310a71f
SHA256 44c1f59f48fca1dbbcb999232154f060a74d760bdb510accace016de59ed4233
SHA512 1bc86558d62a6730c2ab9b2382d68b5b35feef499b489c595ffc9fc4b776d63c0f23afcaef91b008bee22145d92067c7344d2f45ecc8d78d5bbe64ac1b2a1cdb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 7dbb296dadd0f058e3aaafc85a9d7524
SHA1 e2bbe1bd4ca6fa71eb9f2f4c8309c139cdc1bbec
SHA256 8fb2661ec6a94139cbe64bcf4da97ccd5131cfc367dbc7b333b421639a40ec40
SHA512 aa16865c2dd0e7a9ed7fde87a7065c1021ea35188e0de0ebe8bccb8db8832fde5e93ec3a7b66c38a182c8a2150546ee6b7f8428cc9652d8a19c1159bdb7e8ae1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\61401a62-fab6-4d83-ba10-424b7fe83620.tmp

MD5 d44e2ebfacbda456cbe5e9afb8cd8ec4
SHA1 5d6533ad3a2bde32a45ec26e0bbbbb328ac492bc
SHA256 c14290832768aa3abf494e16c7478c1ebba626ad9c33098596fea04c86d2b9d3
SHA512 531904778dbe0783f2089582776d791fc98f70508fa77da2c288034593e2dea53944c4403f8dd52c32a0408fc9e7a9951da9983c77e5fa87c72ecd598b677394

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2eU4365.exe

MD5 e829279ff2ce0d314b41aefca27d810b
SHA1 10460cba71726efed02901fffe97c36de58379cb
SHA256 f2da17e28e9d2a6a6bb1fb94147b9718649c00ef32244225ec3c401b924bed74
SHA512 c9b163ab69c38ac4b9c9d1f0b15a7f989497a4f5bd69417d11849fb5ce94a86e5d468087725f655e8c03406ea6ad6366181dedd7595170371d07fd352e3d4778

memory/6260-634-0x00000000021C0000-0x00000000021DC000-memory.dmp

memory/4756-643-0x0000000075C70000-0x0000000075D60000-memory.dmp

memory/6260-641-0x0000000004990000-0x00000000049AA000-memory.dmp

memory/6260-651-0x0000000004B60000-0x0000000004B70000-memory.dmp

memory/6260-648-0x0000000075040000-0x00000000757F0000-memory.dmp

memory/6260-659-0x0000000004B60000-0x0000000004B70000-memory.dmp

memory/6260-656-0x0000000004B60000-0x0000000004B70000-memory.dmp

memory/4756-662-0x0000000075C70000-0x0000000075D60000-memory.dmp

memory/4756-665-0x0000000075C70000-0x0000000075D60000-memory.dmp

memory/4756-1053-0x0000000075C70000-0x0000000075D60000-memory.dmp

memory/6260-1260-0x0000000075040000-0x00000000757F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4WG967Qv.exe

MD5 9ac2d409d53ee85ceb60058a8bcc33d9
SHA1 2dc44451f40097305f330d7fc51f6dbf39c8465c
SHA256 871cfada7e4391fdbb6bb8aaff7adf6bd1e4c30699f6bc0f6be4606256cddbfd
SHA512 3585e04d38e4d359321e7793e2db93ca29d6784a768466c97fa92f443dc8eec403d4267e812c4775394af1ac84a009c580ecb4e4d0ab7b986ab31ef75c403534

memory/6508-1280-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

MD5 838a7b32aefb618130392bc7d006aa2e
SHA1 5159e0f18c9e68f0e75e2239875aa994847b8290
SHA256 ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa
SHA512 9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

MD5 f453cde2367807df0a452cc2891814bd
SHA1 29833b82a96fa84724507b5f89ca03e8a0bbb5e6
SHA256 f14ea17ecea0740d5b7674fdab8df6205bf89773a0534214e0a439109bf45035
SHA512 508648965ae5c06b6c3ccb257b69d00bb512425d0d1ec6b40e7d257921af3e5e597ef4a1f0b5f9222312bbc3bd6e766d6c2fb9e7a518783e8a072e171d94e3d8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

MD5 5bb09788c9541ba2d13fa1729fcf1160
SHA1 650626af286f93e2a92930dd45fbcab95101af2a
SHA256 c0c89f1301f81cf2639f9d5fedc9cab8fafc6d3bd2d5cf4711cb5f42a9511c47
SHA512 bb20ca5b2f07756e697c5c9955f186727df41fedd29a489540acf0091e4b6a7da9a010001a43071c3b229947ad0678d1ddaf3755e7059ed471d34c6debfc563a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons-journal

MD5 39b7c2536ef3619f381f98922a40aee1
SHA1 579659030fa4ffe085e38766e95b2b63b5f7ea0a
SHA256 907f6f69ea7f0ac924485cd33c337a8efd40c11d7c915d6f5b6e6be001309fba
SHA512 bb0aafaee55da0b801bd92a9e88cbee5b64fee1ab7dcf8621dad3c42244ca35363fb5b61eb2f5fcf9c5929e5d173a576cbaec337432c81a574cce6bc3143d5fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 7ee07b80c55c972f8fdcc56d4129733a
SHA1 4b24307850f55f31d1b87b7798b3b29c1edf46d1
SHA256 5e694fe488825cd3af0ff4d9096b0900ff822ea1319a426c147e1c79562347b6
SHA512 76857e8a8117946f6172af72cab8c4aa58f58c1d5d27649fa18101692907397c1ffce2de6557f57ff6fd4c767c27d439849c618d4910b028bc5ea3cfe98cb495

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

MD5 4131fb09888f94509ef8d8cf7fd13566
SHA1 af7a348603f16b8ca5eef5d7dbf0b68062285400
SHA256 72f19c27e8253d51fc32941370ea6fe2f6b649e2dd3f5e52df3bd8ca8ec15780
SHA512 fd0712ee9be1cdeccb4255149fd904f7eb5c967a80ee6ed92a25a48c125ef63236b1649d14084768e5235b97d471000bd3d88a4cc8f5831177ebf77ca4d33ecb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 46b95103da3b7301cb24c9a11b0f2384
SHA1 10935f9ac19a553815734e78c68af4280452ea71
SHA256 6399c2554073dba13a7359f6d0b880f315a2374440a7fed6000e6dc032a0ebee
SHA512 11525501e1273b71ea945ae8689be534b914c3e729f2d5ef94b3b6962ef6341d16373f83789be1806255caa43138fd4f7488e1cddf3b4e50cc281afc5e5d764e

memory/4756-1466-0x000000000A0D0000-0x000000000A120000-memory.dmp

memory/6508-1489-0x0000000000400000-0x000000000040B000-memory.dmp

memory/7128-1525-0x0000000002580000-0x0000000002659000-memory.dmp

memory/7128-1528-0x0000000002660000-0x00000000027F5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exe

MD5 6abd6ed23a406a48aa439134f5d32301
SHA1 918ae7d9e51608a2cdc65ed1adc4833bda84deb1
SHA256 f99a06a609b21d922eec4a897e2078ad334df11bac719049862fd64d7a8a5ed5
SHA512 3f089a6ef5b72462742e3bedda5596434bb5ea27c9fa12ae16f95af8402b8b7fad82bb200b3ba44b1f82c3b0cd9cce990d0d5890d8ae8918e4d4e230ad524750

memory/7128-1539-0x0000000000400000-0x000000000090C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 a9ff728b9ea310d06daacb6f957cd1f2
SHA1 7f79e12ac73eb9255feceb048c34f238857657f7
SHA256 d2106c7b7c2e8d684762a09cf66131e6b815ee9c92e4c19437590e99daddf5ec
SHA512 ffbc06dc78beb5d707b93291d06455ea425560e7477da43cdd2fc9ffcafad884be352392f1b64a243b44860b175b25d958ae61b66795d92b279f231a9a9c1150

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 dc1e433c1609f1f0215b2df2844524ec
SHA1 729c8de60e59c584e1a22f01dc3602447b848b7f
SHA256 90285c031bf8a37098d4860f9160cc512405ce64a1a2a4b49fd181017a84ce5c
SHA512 55cc14a1549c17e6da92e072c813cc58ee8973386b63ef729f5611020eeff26c972e1c9e93b3336968add1a54cab47e349a52184d03f332c39dae73ef15622d1

memory/4756-1787-0x0000000075C70000-0x0000000075D60000-memory.dmp

memory/4756-1801-0x0000000000D30000-0x00000000016EC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 e30738d93d6789672ce8e1c4bfe275a8
SHA1 ce2195ec1f2e3830b9a106a9dc8d7fa5397d10fc
SHA256 7d60046d1238ff11bdf616d83c212ad6866a7cc630ee9be8580050dee7f74832
SHA512 e39c9590f558477a1b823de555bf27542a725566d8bd839a1c493459444d49d755445d8ff34f59681ede12a8e654c5a7fc34b6008c9abcfd65d09f6b1b523a65

C:\Users\Admin\AppData\Local\Temp\grandUIA5yzqZi02IJtBw\information.txt

MD5 ea782c31dd81b3db45a4888fe31c3393
SHA1 1c12e7df01933caf3f15de29023ae74689d10623
SHA256 81be61dca23447b9a0c5ff85fc72635826700220fc5c16d99ab7141c36552d1d
SHA512 7b7c9d26b17f26f0c38d5a60fa3a7e5a7826d1066499c8b3e4e87edc8eeedffa28aaa155e6d4146e98dc73b96afd623d4e413307694caf898c425a7c6c164c45

memory/808-1965-0x00007FFEBE6D0000-0x00007FFEBF191000-memory.dmp

memory/7128-2173-0x0000000000400000-0x000000000090C000-memory.dmp

memory/808-2194-0x000001CB78B50000-0x000001CB78B60000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d