Malware Analysis Report

2024-12-07 22:58

Sample ID 231224-lsqwjabfdn
Target c22faa824eb0e7d3778874b75e8a8f32.exe
SHA256 d7f62a19efdf912aaebe1b29f5622d314a0821c8e6d4bd901c295e965978de1c
Tags
dcrat djvu smokeloader pub1 backdoor google paypal collection discovery infostealer persistence phishing ransomware rat spyware stealer trojan lumma redline zgrat 666 livetraffic logsdiller cloud (tg: @logsdillabot) up3 evasion
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d7f62a19efdf912aaebe1b29f5622d314a0821c8e6d4bd901c295e965978de1c

Threat Level: Known bad

The file c22faa824eb0e7d3778874b75e8a8f32.exe was found to be: Known bad.

Malicious Activity Summary

dcrat djvu smokeloader pub1 backdoor google paypal collection discovery infostealer persistence phishing ransomware rat spyware stealer trojan lumma redline zgrat 666 livetraffic logsdiller cloud (tg: @logsdillabot) up3 evasion

Detected Djvu ransomware

Lumma Stealer

Detect Lumma Stealer payload V4

Detect ZGRat V1

DcRat

ZGRat

SmokeLoader

RedLine

RedLine payload

Djvu Ransomware

Detected google phishing page

Downloads MZ/PE file

Modifies Windows Firewall

Drops startup file

Loads dropped DLL

Executes dropped EXE

Modifies file permissions

Reads user/profile data of web browsers

Deletes itself

Looks up external IP address via web service

Accesses Microsoft Outlook profiles

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

AutoIT Executable

Detected potential entity reuse from brand paypal.

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Enumerates physical storage devices

NSIS installer

Runs ping.exe

Delays execution with timeout.exe

Suspicious behavior: MapViewOfSection

Modifies system certificate store

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Uses Task Scheduler COM API

Modifies Internet Explorer settings

Enumerates processes with tasklist

outlook_win_path

Suspicious use of AdjustPrivilegeToken

outlook_office_path

Suspicious use of SetWindowsHookEx

Creates scheduled task(s)

Checks SCSI registry key(s)

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-24 09:48

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-24 09:48

Reported

2023-12-24 09:50

Platform

win7-20231215-en

Max time kernel

75s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe"

Signatures

DcRat

rat infostealer dcrat
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\2008520e-b425-4948-a168-2bbf422c4b43\\349A.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\349A.exe N/A

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detected google phishing page

phishing google

Djvu Ransomware

ransomware djvu

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Deletes itself

Description Indicator Process Target
N/A N/A N/A N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4bs024Vz.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4bs024Vz.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4bs024Vz.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4bs024Vz.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\2008520e-b425-4948-a168-2bbf422c4b43\\349A.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\349A.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\49DF.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OF1DB27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vw4kr04.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4bs024Vz.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A ipinfo.io N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Detected potential entity reuse from brand paypal.

phishing paypal

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\FA66.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\FA66.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\FA66.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A93B5D31-A241-11EE-9B21-FA7D6BB1EAA3} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "41" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.recaptcha.net\ = "25" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A92D3C01-A241-11EE-9B21-FA7D6BB1EAA3} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A9212E11-A241-11EE-9B21-FA7D6BB1EAA3} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\paypal.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4bs024Vz.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4bs024Vz.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4bs024Vz.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4bs024Vz.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4bs024Vz.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4bs024Vz.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FA66.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4bs024Vz.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1TF80Ie5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1TF80Ie5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1TF80Ie5.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2004 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe
PID 2004 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe
PID 2004 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe
PID 2004 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe
PID 2004 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe
PID 2004 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe
PID 2004 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe
PID 1420 wrote to memory of 2744 N/A N/A C:\Users\Admin\AppData\Local\Temp\FA66.exe
PID 1420 wrote to memory of 2744 N/A N/A C:\Users\Admin\AppData\Local\Temp\FA66.exe
PID 1420 wrote to memory of 2744 N/A N/A C:\Users\Admin\AppData\Local\Temp\FA66.exe
PID 1420 wrote to memory of 2744 N/A N/A C:\Users\Admin\AppData\Local\Temp\FA66.exe
PID 1420 wrote to memory of 2268 N/A N/A C:\Windows\system32\cmd.exe
PID 1420 wrote to memory of 2268 N/A N/A C:\Windows\system32\cmd.exe
PID 1420 wrote to memory of 2268 N/A N/A C:\Windows\system32\cmd.exe
PID 2268 wrote to memory of 3040 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2268 wrote to memory of 3040 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2268 wrote to memory of 3040 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 2744 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\FA66.exe C:\Users\Admin\AppData\Local\Temp\FA66.exe
PID 2744 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\FA66.exe C:\Users\Admin\AppData\Local\Temp\FA66.exe
PID 2744 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\FA66.exe C:\Users\Admin\AppData\Local\Temp\FA66.exe
PID 2744 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\FA66.exe C:\Users\Admin\AppData\Local\Temp\FA66.exe
PID 2744 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\FA66.exe C:\Users\Admin\AppData\Local\Temp\FA66.exe
PID 2744 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\FA66.exe C:\Users\Admin\AppData\Local\Temp\FA66.exe
PID 2744 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\FA66.exe C:\Users\Admin\AppData\Local\Temp\FA66.exe
PID 1420 wrote to memory of 1196 N/A N/A C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 1420 wrote to memory of 1196 N/A N/A C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 1420 wrote to memory of 1196 N/A N/A C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 1420 wrote to memory of 1196 N/A N/A C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 1196 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 1196 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 1196 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 1196 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 1196 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 1196 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 1196 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 1196 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 1196 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 1196 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 1196 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 2948 wrote to memory of 880 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Windows\SysWOW64\icacls.exe
PID 2948 wrote to memory of 880 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Windows\SysWOW64\icacls.exe
PID 2948 wrote to memory of 880 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Windows\SysWOW64\icacls.exe
PID 2948 wrote to memory of 880 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Windows\SysWOW64\icacls.exe
PID 2948 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 2948 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 2948 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 2948 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 1420 wrote to memory of 1480 N/A N/A C:\Users\Admin\AppData\Local\Temp\49DF.exe
PID 1420 wrote to memory of 1480 N/A N/A C:\Users\Admin\AppData\Local\Temp\49DF.exe
PID 1420 wrote to memory of 1480 N/A N/A C:\Users\Admin\AppData\Local\Temp\49DF.exe
PID 1420 wrote to memory of 1480 N/A N/A C:\Users\Admin\AppData\Local\Temp\49DF.exe
PID 1420 wrote to memory of 1480 N/A N/A C:\Users\Admin\AppData\Local\Temp\49DF.exe
PID 1420 wrote to memory of 1480 N/A N/A C:\Users\Admin\AppData\Local\Temp\49DF.exe
PID 1420 wrote to memory of 1480 N/A N/A C:\Users\Admin\AppData\Local\Temp\49DF.exe
PID 2752 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 2752 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 2752 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 2752 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 2752 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 2752 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 2752 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 2752 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 2752 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Users\Admin\AppData\Local\Temp\349A.exe
PID 2752 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\349A.exe C:\Users\Admin\AppData\Local\Temp\349A.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4bs024Vz.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4bs024Vz.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe

"C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe"

C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe

"C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe"

C:\Users\Admin\AppData\Local\Temp\FA66.exe

C:\Users\Admin\AppData\Local\Temp\FA66.exe

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\FBED.bat" "

C:\Windows\system32\reg.exe

reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1

C:\Users\Admin\AppData\Local\Temp\FA66.exe

C:\Users\Admin\AppData\Local\Temp\FA66.exe

C:\Users\Admin\AppData\Local\Temp\349A.exe

C:\Users\Admin\AppData\Local\Temp\349A.exe

C:\Users\Admin\AppData\Local\Temp\349A.exe

C:\Users\Admin\AppData\Local\Temp\349A.exe

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\2008520e-b425-4948-a168-2bbf422c4b43" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\349A.exe

"C:\Users\Admin\AppData\Local\Temp\349A.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\49DF.exe

C:\Users\Admin\AppData\Local\Temp\49DF.exe

C:\Users\Admin\AppData\Local\Temp\349A.exe

"C:\Users\Admin\AppData\Local\Temp\349A.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OF1DB27.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OF1DB27.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vw4kr04.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vw4kr04.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1TF80Ie5.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1TF80Ie5.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://accounts.google.com/

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.facebook.com/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://twitter.com/i/flow/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://store.steampowered.com/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://steamcommunity.com/openid/loginform

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.epicgames.com/id/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.paypal.com/signin

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.linkedin.com/login

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4bs024Vz.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4bs024Vz.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:620 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1844 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1076 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1160 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1044 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:840 CREDAT:275457 /prefetch:2

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 2484

C:\Windows\system32\taskeng.exe

taskeng.exe {FC59A61E-6F72-4FC6-9A06-C2AD2AB4CE46} S-1-5-21-3427588347-1492276948-3422228430-1000:QVMRJQQO\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\gvvugfe

C:\Users\Admin\AppData\Roaming\gvvugfe

C:\Users\Admin\AppData\Roaming\gvvugfe

C:\Users\Admin\AppData\Roaming\gvvugfe

Network

Country Destination Domain Proto
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 host-host-file8.com udp
RU 158.160.130.138:80 host-host-file8.com tcp
US 8.8.8.8:53 galandskiyher5.com udp
RU 158.160.130.138:80 galandskiyher5.com tcp
US 8.8.8.8:53 brusuax.com udp
KR 210.182.29.70:80 brusuax.com tcp
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 olivehr.co.za udp
ZA 41.185.8.154:80 olivehr.co.za tcp
RU 77.91.68.21:80 77.91.68.21 tcp
US 8.8.8.8:53 elamer-llensha.com udp
US 154.49.138.36:443 elamer-llensha.com tcp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 twitter.com udp
US 8.8.8.8:53 www.linkedin.com udp
US 8.8.8.8:53 steamcommunity.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 store.steampowered.com udp
US 8.8.8.8:53 www.paypal.com udp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 www.epicgames.com udp
US 104.244.42.129:443 twitter.com tcp
US 104.244.42.129:443 twitter.com tcp
US 13.107.42.14:443 www.linkedin.com tcp
US 13.107.42.14:443 www.linkedin.com tcp
US 154.49.138.36:443 elamer-llensha.com tcp
IE 163.70.147.35:443 www.facebook.com tcp
IE 163.70.147.35:443 www.facebook.com tcp
BE 64.233.166.84:443 accounts.google.com tcp
BE 64.233.166.84:443 accounts.google.com tcp
GB 104.103.202.103:443 steamcommunity.com tcp
GB 104.103.202.103:443 steamcommunity.com tcp
US 151.101.1.21:443 www.paypal.com tcp
US 151.101.1.21:443 www.paypal.com tcp
US 2.17.5.46:443 store.steampowered.com tcp
US 2.17.5.46:443 store.steampowered.com tcp
GB 142.250.187.238:443 www.youtube.com tcp
GB 142.250.187.238:443 www.youtube.com tcp
US 3.95.123.252:443 www.epicgames.com tcp
US 3.95.123.252:443 www.epicgames.com tcp
US 8.8.8.8:53 static.licdn.com udp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
US 8.8.8.8:53 community.cloudflare.steamstatic.com udp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
GB 142.250.187.238:443 www.youtube.com tcp
GB 142.250.187.238:443 www.youtube.com tcp
GB 142.250.187.238:443 www.youtube.com tcp
GB 142.250.187.238:443 www.youtube.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 8.8.8.8:53 store.cloudflare.steamstatic.com udp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 facebook.com udp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
IE 163.70.147.35:443 facebook.com tcp
IE 163.70.147.35:443 facebook.com tcp
US 104.18.42.105:443 store.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 store.cloudflare.steamstatic.com tcp
US 8.8.8.8:53 fbcdn.net udp
IE 163.70.147.35:443 fbcdn.net tcp
IE 163.70.147.35:443 fbcdn.net tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 193.233.132.74:50500 tcp
US 8.8.8.8:53 www.paypalobjects.com udp
US 151.101.2.133:443 www.paypalobjects.com tcp
US 151.101.2.133:443 www.paypalobjects.com tcp
US 151.101.2.133:443 www.paypalobjects.com tcp
US 151.101.2.133:443 www.paypalobjects.com tcp
US 151.101.2.133:443 www.paypalobjects.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
US 8.8.8.8:53 t.paypal.com udp
US 151.101.1.35:443 t.paypal.com tcp
US 151.101.1.35:443 t.paypal.com tcp
US 8.8.8.8:53 fbsbx.com udp
IE 163.70.147.35:443 fbsbx.com tcp
IE 163.70.147.35:443 fbsbx.com tcp
IE 163.70.147.35:443 fbsbx.com tcp
IE 163.70.147.35:443 fbsbx.com tcp
IE 163.70.147.35:443 fbsbx.com tcp
IE 163.70.147.35:443 fbsbx.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.200.4:443 www.google.com tcp
GB 142.250.200.4:443 www.google.com tcp
IE 163.70.147.35:443 fbsbx.com tcp
IE 163.70.147.35:443 fbsbx.com tcp
US 8.8.8.8:53 www.recaptcha.net udp
GB 172.217.16.227:443 www.recaptcha.net tcp
GB 172.217.16.227:443 www.recaptcha.net tcp
US 8.8.8.8:53 accounts.youtube.com udp
GB 142.250.200.46:443 accounts.youtube.com tcp
GB 142.250.200.46:443 accounts.youtube.com tcp
US 151.101.2.133:443 www.paypalobjects.com tcp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.186.192:443 ipinfo.io tcp
US 8.8.8.8:53 zn1ynnliufrct75cb-paypalxm.siteintercept.qualtrics.com udp
US 8.8.8.8:53 apps.identrust.com udp
US 104.17.208.240:443 zn1ynnliufrct75cb-paypalxm.siteintercept.qualtrics.com tcp
GB 96.17.179.205:80 apps.identrust.com tcp
GB 142.250.200.4:443 www.google.com tcp
GB 142.250.200.4:443 www.google.com tcp
US 8.8.8.8:53 ocsp.r2m02.amazontrust.com udp
US 8.8.8.8:53 ocsp.r2m02.amazontrust.com udp
US 18.165.189.160:80 ocsp.r2m02.amazontrust.com tcp
US 18.165.189.160:80 ocsp.r2m02.amazontrust.com tcp
US 8.8.8.8:53 static-assets-prod.unrealengine.com udp
CH 13.224.103.40:443 static-assets-prod.unrealengine.com tcp
CH 13.224.103.40:443 static-assets-prod.unrealengine.com tcp
US 8.8.8.8:53 tracking.epicgames.com udp
US 54.89.57.250:443 tracking.epicgames.com tcp
US 54.89.57.250:443 tracking.epicgames.com tcp
US 104.244.42.129:443 twitter.com tcp
US 8.8.8.8:53 play.google.com udp
FR 216.58.204.78:443 play.google.com tcp
FR 216.58.204.78:443 play.google.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/2004-1-0x0000000000580000-0x0000000000680000-memory.dmp

memory/2004-2-0x0000000000220000-0x0000000000229000-memory.dmp

memory/2276-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2276-5-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2276-6-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2276-7-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1420-8-0x0000000002A80000-0x0000000002A96000-memory.dmp

memory/2276-9-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\FA66.exe

MD5 3ce7f5fa5d7361a108dfc1856e1257e4
SHA1 cd5813e80a1d638e504edaf194ffb6791d740666
SHA256 fc75dbfdf2addf607446b85bfe7271ff42dc6eda289090ce365e55938f9da844
SHA512 75d2a46c74721af5e05a3edc3ec8c0316ba8a0ea523fffa08baed3f423dd0a59aeda83e18d6f97844b5f9bb12f09bf481905e097259dec2504413f0f29828d5c

C:\Users\Admin\AppData\Local\Temp\FBED.bat

MD5 55cc761bf3429324e5a0095cab002113
SHA1 2cc1ef4542a4e92d4158ab3978425d517fafd16d
SHA256 d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a
SHA512 33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

memory/2744-33-0x00000000004F0000-0x00000000005F0000-memory.dmp

memory/1420-39-0x0000000003990000-0x00000000039A6000-memory.dmp

memory/2628-40-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\349A.exe

MD5 b14631815380f58d5402272c0e7cbd20
SHA1 67febac115dc9ba7c3e2d9eac27db2ba5be6bad8
SHA256 7ca97325291a5fffe1124f9704acd4a2d56c2fab56036e020e35da1c8a084118
SHA512 a76606d85ba9753e57c9f52202ee78e86a4e658c7cb40e6d0b5709650b52c4ffd33a269478ec27c8e29ca1b2a364b6d1fcf8ff993f3fb5d15c913d19d97263b6

memory/1196-50-0x0000000001CA0000-0x0000000001D32000-memory.dmp

memory/1196-51-0x0000000001CA0000-0x0000000001D32000-memory.dmp

memory/1196-54-0x0000000001D40000-0x0000000001E5B000-memory.dmp

memory/2948-57-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1196-60-0x0000000001CA0000-0x0000000001D32000-memory.dmp

memory/2948-61-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2948-62-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2948-83-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\49DF.exe

MD5 903e5550cb35b7a55d259122555988e7
SHA1 b4844e363dc1299009d6da3e7fd9a8df80cc8317
SHA256 85da9f704995d35026bc0660a3a558c2c12f8032430ba5d00373e977c9df9a34
SHA512 1a2c2c93b68817f9b84061a4760c699540bd1e235c46ce33f6f8948e94eb641bb7767581f42ed25f225af84a8700a0dd8d083b3207c9634a0f3f798cd2044b91

memory/2752-95-0x0000000001C20000-0x0000000001CB2000-memory.dmp

memory/2752-96-0x0000000001C20000-0x0000000001CB2000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP000.TMP\OF1DB27.exe

MD5 36332e696329dd9a898f381903ec8af8
SHA1 93b7fa10ba6ecb9546f0b2f73d944879e8687415
SHA256 b0cb493a4c7ee58acc0c20289b96b50fe178ffe0b98355e9b4607260889f9b98
SHA512 d12320dbb1731768c2ccfa896ccc57b4e7ec4b26ba1c72ac01afc9b48f6c64027ce2aab07ca5d91fcb904ceaba6e8849b06379c7db5fb0fc8a23ac5427edf6ce

\Users\Admin\AppData\Local\Temp\IXP001.TMP\vw4kr04.exe

MD5 0f7d40ed2c6703e901582687e9fa0c27
SHA1 e32dceb183b3be665803db51014016467d7a9df4
SHA256 10a55ad2e6294fb7a5a14c4b97fb2cea0b2caabb8db52b4677e4c3a1f8f4479d
SHA512 351e752065bed7a1a7e5b33b3d9ac4052e51ab2757e20f33a0bc3bac4ce54f4fc0496933e89a1da28dcba06dfc3c7afd5ca9fa6750f7c606646b63be8e721233

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vw4kr04.exe

MD5 81851f1ca015d134cdf160c7f0e5880d
SHA1 617412ad328df9c8418b43a1635b6e15a3193e83
SHA256 e6912e76651cea04372bd32056ba76bb82a869e7eb56814ec0e7bef4fb4040b1
SHA512 da5b4def4b39814ab0eb9d5de4d5cdb71681a9004f5a101e7412686a1c4fd68de9daefb3f8e817d5cfcdfc2fe82b80cb3f6d18393ff08c7912fbd52e6b80acb4

\Users\Admin\AppData\Local\Temp\IXP002.TMP\1TF80Ie5.exe

MD5 a01189ab5f5d208346ef580d9f3245ee
SHA1 672dd598bb4f75b77cd9f6bc97ce637501490ba2
SHA256 01bd0d4b86bf83fe30fa323e463c6ec5e6f4cb014bdc10cc2bcf495be93e7193
SHA512 03739f7bf34fe91eb6fee8c1ce6299037264efcf385f89a9fd5ae5e04bf54a48802052f1d139f9e62f239e3e5d0266899db60c4cb7e8f11ed3066b20b0ec15b7

\Users\Admin\AppData\Local\Temp\IXP002.TMP\4bs024Vz.exe

MD5 c27ad4078641061c0e777add1c7e912f
SHA1 3bafdef76913c28097ca5854910a3de317df4c8f
SHA256 9f2bd0d3b103a8b4e9a45a0381974efa444e807719f5d9cf3243fa73982e69dd
SHA512 07053240d7ae8abb840a3477e1eecfe43adc131d47fc9d40f12b75c1021fdc1451cc35f5036fa47c9c402b7d132ee01434a02c754ae51a3fe1b26ecb352f88f1

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A925F0D1-A241-11EE-9B21-FA7D6BB1EAA3}.dat

MD5 0b87bd6775fd540f3ed3ec9a640c6718
SHA1 947feb61bc9c4391a7463d6e49062f3639a69878
SHA256 8e4eea98c64371a992a17adf727f3a2ea34b0aa7681391542ebd4cd7e1419768
SHA512 9215138f27bdddade1d4906b2db933f7315ce01ec9596560aef865abaa83d56f27e8b1688ebf8878f5bdeb4953efd8ca5a127512b491d2e48bd6b21056032777

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A92D3C01-A241-11EE-9B21-FA7D6BB1EAA3}.dat

MD5 b1dadbc5dfa66ef6326d8c78d7fcba09
SHA1 f714e98e4ae1a677bc725b4aeea7fa0ab15a2acc
SHA256 b2d628b1f2b9a28fa4fc2b7b19754e645d4ba06badc36d11738291e4ae25b976
SHA512 2877a2aa2ef64827dd3c411a8579903c84a9a5ffec8446d2a88e479dc1c0441cbddaf9ef9b5073e27c60d8d3925acf2488e853ba06678979fdc27407b052b754

memory/1164-136-0x0000000000EA0000-0x0000000000F6E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A92D14F1-A241-11EE-9B21-FA7D6BB1EAA3}.dat

MD5 e5837d523e36ec5b4caadba08a13ada7
SHA1 a193a85536f06df61d580c948cea6fb07a2d4149
SHA256 c87802fa61c3a6f71edd70e8f06445029f3eb46545fcfe72cc0c7433e6f7fd2d
SHA512 08ea7356be281cbed47fb15faeb549b24abb33bc56cddf57334d19814edb8698cb0ff5653e101b43a67cd599f17fe5bf254925399328c7746e85009896345bcc

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A9212E11-A241-11EE-9B21-FA7D6BB1EAA3}.dat

MD5 ed1616dff272ab16609d8150e95df6ad
SHA1 eb7062490a174456e58ab110f5c6d08a15099450
SHA256 eca7d96b9b978986f51ddc21feba2e5241127f0f1055f060a353060b6a88ae3e
SHA512 700f3d5506eb0fc09600f52bb9fcf16659687a57eadd69d7179c09b80e17b3979f9de931a4d4ced4d7cea8c19fcc8464c1acbb3f8ef33dcc56befcbf59f04393

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A93B5D31-A241-11EE-9B21-FA7D6BB1EAA3}.dat

MD5 94ce892f1578fc88c48edb47f1098f2d
SHA1 ace8eb5936cf34a67611527d867379cfec181be0
SHA256 6b3d66d772496f3e9911a5a2f350bb8c2722a77df59f615f11e3ed8c6525add8
SHA512 b6cd3fe15a0938ee05691bc7d8d6323f2add3339dda812a4fba92a374d672aefa0947cebd72607cefa245fc9af066b7a3aee9898cc3b85f3dced9354084571ed

C:\Users\Admin\AppData\Local\Temp\Tar5C18.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\Local\Temp\Cab5C05.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bffea334dd42f5b38e03e22d36e54df1
SHA1 b821e2760ee3a01702f0d29dae144831ccce280b
SHA256 085861f03977161462888484cbfb1eb289a83183d35d39daf4089391e65a6c15
SHA512 75bdae4a490ddfdb35183578cee545807ce072b3ac5cc468aa4ff2dd2e72e1df58d2f8d20986cecfd58898a544d0704d6f2d3cc3a9f4b9f78c3730e344b215b9

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A9428151-A241-11EE-9B21-FA7D6BB1EAA3}.dat

MD5 9a29ad8e6fa61eb58307a27d903768df
SHA1 527ccf4f69b435061e4de0bbb8fb74d77ce19684
SHA256 75997f38f0c1b4ec593bc69f71e007d4781fe7c885bc4ed52b4c1fadfc5a8c5c
SHA512 0794b9a2cdd91e0703e9407217d165c445f452b7351f9efe39183e2389f978fadb1c9934d42c48350df4fdc86144165a1beaf5a0796fe2f4a648ea8cfa2ff637

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 0393540e9370fc2d737dcf6137760203
SHA1 673e9f609a69395b5847d885f8e4fa607c234251
SHA256 f3500fbeabb279ac13a4a8f4fd5f04d7818ad5c7de20b9fa2b10e3cf9f3a9306
SHA512 910ba122b12ecf81efe2b934d21ef35f760ebba50ef65f9032a3962a2aae345e47f92073c121f89f5e149c909a29c23e60444dba6bbd26c4692e65d4d0ba986a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 689debe12da8ec9d66475373227ce275
SHA1 f5846544fad76906b44075b8943bd8a7ed995250
SHA256 f5942712b26c96e04bd4ecb6e321ab3fe07ab221124dfa56125ffa2a68dec97c
SHA512 fb8e7b8208d31f7f6f38f0d336f62ea26356391e0d238eb0fc5472b9d307c3baef21ea6ecfdc11114793e45d27f53eacec2d4a16384b86b128f9df570fa43e33

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 95ec9e6b323def7af08d1078e0067816
SHA1 72d4b18fedf38e9ce3d04a0c82c30cd52241daac
SHA256 cb6375748a2a390a9170406f5c6e966dd0cec9d6d6faa818feaa3821fa0f6c56
SHA512 9a05f95a36ad256ee48243e8a1baf2f9a08dee0fb6021cf736066069a99b343c4f130050bfc4941ad961f59b09fd7ec53dd4219415e09a0ac066f5f1e45b963e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c57faf922bfbf57d39633e0c6cc66390
SHA1 56d888d0be808a25116b5600ab335a972bd039e8
SHA256 7d8b2d37d984108e1337959095afd32fbe67386d3fd35aba78ff749ca29956fd
SHA512 8b22024b40905608ae0d2d67171b9178560d848a3b72a27ba21da553da00f3818f91d112780e901db1bb847cd833ad12278a59e711aeeed4c001678689b053b5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fd34757ff310221c430b7c87ece62d69
SHA1 83d1d6569f0d6830cb1cff351b00cab5aada802b
SHA256 dd57f0406c1e96c33fca0891180993943f3072addb909a817b48fd96ef459aac
SHA512 1c009ddd03916ca2c70a86d8e9b1cebeb5d7f373b8a2263ba45285565ea7f383f47f47fe6f85e0e3f5ebde7705b065977d561e7893c55fa59c628ba1996e1096

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6ae0bf8a577f5624549a29a280cb9117
SHA1 2ab08847386c14ebc0220d2f162e8eb5fb24879f
SHA256 b811a16f9710b5b911c5433805dec75df36c3a28508fe1e25d1502e4e6e6773f
SHA512 d74efe5ffbdee416f208c9f173f7dc093a69b927105808b612df814958b50e90c370408f86b7c9e9f9a878aa2d902d5632578519f42037619daad1d1c1565cb7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1515b173e30ed36fc737be605cd943aa
SHA1 6fc855a3b63a5babd9d780bc7ccd37035303bf90
SHA256 d97da99a5c51b51ab825e32d4ff6e6867b5c194e3792e278842eb39ca008a85c
SHA512 a7936c43cad3dc01db87fd11350bfbd0130534792d414c9d317e54284d92124fd5c3a0379e09a10f7deaded79d21c4b9745c798578d94c684ca1f3c5d94083f7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

MD5 3a01a8cac73fccf677c0cff463f89790
SHA1 23635e9dd1d9acd3772bed727bd253d01835a5a4
SHA256 695ae53996eef0845de4b84c489759df9705538a2f65288f3b803d769d7e646a
SHA512 7cfc59374948210ec8e0e43a19309e50452a3db9e609b9374355f517ccc835efb533f618043dfa6f743e8c3e643c7f84f01e226dbf47df30d5bfbdb8052004c7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 96413da17c241a4758da4b3a3bcd7e0b
SHA1 6202ab234cdfa47ac649ac3adeddea7302395cf4
SHA256 6073962e920bc651f6eaa8075b67bfd7a3ca27b99c350f00468096d166a0ad06
SHA512 74662815df4b0c1738d7e6ebdba043626d9dad18971b06afeb557dbb65c3b4c86cef19d25b8effe9d5919d2f4ccaa19310d4581a535562bb126f1e362a11c588

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 61e87559ef754d7411c1edc7446fdaac
SHA1 9c1f85ac5c5837d69e128745b29037e2227c1b77
SHA256 e5ea1d7ba7664d217a1d6f30c3c04ec3461349d9dce8697e7c7a76bfd3a4cf9e
SHA512 b8e6cae132798201d7df5820d8ccc1128020625da7dc844884fc6779fa4418ca03aad8a6a0894a4ee46c2ef2fb59301230ab69d49545f50868176d4935af45bd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

MD5 1e6f2cb03d651af5658c007f79993ac6
SHA1 e04727073e4cc5fa9fc2f86ef70aabf1204bb670
SHA256 bdf20b1e5f49640c9c760cccf22bc61216bae12019b70071b33b66004abcb03d
SHA512 d891ec83066cc6ef80190d3ef36c1a71c225a6cc1d53f4e34b7ca3c4858453d4f791ced5ca96de66db7fdb8245a4aef36ab27ccd1c2c3acf8c63263e41d69570

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

MD5 c75704e6a73ff87a9dd0110240b649e6
SHA1 e06db5983b83e9906cf369eef9f560df1d3de345
SHA256 d29f483e91c4adb5775365216a5177fb9cad2fb549485a2577ea685b1d1c8206
SHA512 db98d380c593313e3a0d635965b261f75382db89fef6785d957a75a055101a9788d2e48784b4614e4e728f46028918fa8e8d7c84282873ea4bb13b3383e1e71c

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk

MD5 fb3d25f84e2d6f423b49297680676e52
SHA1 fb47165711095c6986f0f23759adcfa5a72a7860
SHA256 453af65accc836b70ce6396ffeea7ad8553b5961de3d14a24ae1def88e3f2d41
SHA512 714eb0eaae7eae9408dedd9bd827e4b9d3d7441a6abf048e7c6315b8b0409096c977ff3773a6b0bf042655a73821e6b730fe13fff511b0e8a8eeef6647865f28

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 eda145c4dd86c114762a7acdf4ed7c9b
SHA1 56270de2e6e969e824e896b1933a792a73a12a98
SHA256 94e881e5c79a63fd040c5e8d2deb105d4f0411e3e1b37b590cbe003d196d358f
SHA512 295136373c2c928b95abd57d1508a64dcdba3d2b3df54b4049815b15cbd4d720a46d22a51ecda06a5fa87c33e4098ce7b053180a745acc2f5cd19854c75e77d6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c75aa3d41ef5b69e664b2bb4776e61ae
SHA1 069ea3d06dc11f086080074b28706255b0e4844d
SHA256 a01ab84cfdf2b4ce719844ede6ab5235d062c06766917d69b15b33f63130f410
SHA512 b3598dedc0eccc30ecf5aeb0d5452f74f5ef53ebbc35803d60be8e0617533dcea2bfad7c2673cda4e41e612058e068e972d93f975878ac7ca9b15465153b2d28

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0d0264fe90ffb6010d72b1e0f9a877de
SHA1 0cfd54e6eaf255dd38429c4ccfd7772493b8b893
SHA256 788911ea923e3a4e472d868c3acec939ce9163efd85711fef14df1f3dbf2f362
SHA512 70d1261e58c22b2cbc0007d6194d4d87506984c48c9653d1e7cc6c38ea8a50cec52ef0e666fc1805084fdbdf5a41ecd675b1645413d3b184ea75ef6bc1f37281

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 da32f3b872e46009595d1270fed3fcf0
SHA1 1739c28b8ed534959cb5f55ad9c4fad70ea23b90
SHA256 893a9a91160e382757f55ce8d94343b98935ef001a04ef51c0c80048d871e4de
SHA512 b01292857c2328517cca39c51dcf82958c3d52e2cc04323a85643049b08a2d3fb4f5a8ac9e883c95f25cf5044d071e32ea6385272879fc6bdab08427715e7f58

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5 9ec78d3c4b821083d6c90af097ca2827
SHA1 bcf99c2f99bbcf4c500e8f3f8a42da9dcebbeb9e
SHA256 d3ee0ce795c3777f315338955ec8ca6ae58259dee2acaf446af544260bbceb3a
SHA512 5cda3b01690d81189d88ec9aac2ac460d7afe397213842e77d5075f4476effb75a10f7fac8cd987939c324ee17da4155507a2702b2e4823e8933be6ab5d3fefb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5 a3439917990e5cd5314d5a740519aee0
SHA1 f1397e00f11294b832072f8e7fa50f90b5d7e074
SHA256 c080b9412c1bb875cb3e4b4fb963e8d960624fd6b7988475f03a8215e8d2e6fd
SHA512 b826e108ebf553b8d4f2d08a1cc05c4a5d0d2a4dd2723c10edea3381c4f134589535f39e2b2e0db815fe0a63dbe8bda2456be856f7323fb912b03839e9012786

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5 4a97b8d88963d18906570af1da7570e9
SHA1 deb60b47394e93151b2392433ff1195432f1a309
SHA256 6dab682e2f59b6452cd4fc48443b943c6bfd6c680a572c179687a1d19f932caf
SHA512 9daac663c45e9a5965df93c1c7eb12943e9f3d1381653bb6a4d0c69364ab40ef2daa4e7ab96ff4bf9cec2e8dd2a9e4f3cc5bd37c1cbd4fc48d6d4febfaa6001c

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\53STNJLW\shared_global[1].css

MD5 a645218eb7a670f47db733f72614fbb4
SHA1 bb22c6e87f7b335770576446e84aea5c966ad0ea
SHA256 f269782e53c4383670aeff8534adc33b337a961b0a0596f0b81cb03fb5262a50
SHA512 4756dbeb116c52e54ebe168939a810876a07b87a608247be0295f25a63c708d04e2930aff166be4769fb20ffa6b8ee78ef5b65d72dcc72aa1e987e765c9c41e2

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\buttons[1].css

MD5 1abbfee72345b847e0b73a9883886383
SHA1 d1f919987c45f96f8c217927a85ff7e78edf77d6
SHA256 7b456ef87383967d7b709a1facaf1ad2581307f61bfed51eb272ee48f01e9544
SHA512 eddf2714c15e4a3a90aedd84521e527faad792ac5e9a7e9732738fb6a2a613f79e55e70776a1807212363931bda8e5f33ca4414b996ded99d31433e97f722b51

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\53STNJLW\favicon[2].ico

MD5 f2a495d85735b9a0ac65deb19c129985
SHA1 f2e22853e5da3e1017d5e1e319eeefe4f622e8c8
SHA256 8bb1d0fa43a17436d59dd546f6f74c76dc44735def7522c22d8031166db8911d
SHA512 6ca6a89de3fa98ca1efcf0b19b8a80420e023f38ed00f4496dc0f821cea23d24fb0992cee58c6d089f093fdefca42b60bb3a0a0b16c97b9862d75b269ae8463b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

MD5 808d123a1fa019aabdab1de4e8a7bf08
SHA1 348e4e5fdb4636f750c424ca1894a11ef3b5f00a
SHA256 432d6805744343749d3a10e9eec06b05ceca791f757cc7dd2a9029e1a45de743
SHA512 db8992469057ab69f60ebd01b78df74fad64d60e6620ae3a71c83b0bd11a12d1fd9d7c1a82a8132f6985321b6213dd36098d97decaadc3285ffbac0f00dfd615

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\favicon[1].ico

MD5 b2ccd167c908a44e1dd69df79382286a
SHA1 d9349f1bdcf3c1556cd77ae1f0029475596342aa
SHA256 19b079c09197fba68d021fa3ba394ec91703909ffd237efa3eb9a2bca13148ec
SHA512 a95feb4454f74d54157e69d1491836655f2fee7991f0f258587e80014f11e2898d466a6d57a574f59f6e155872218829a1a3dc1ad5f078b486e594e08f5a6f8d

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M2VO416U\shared_responsive[1].css

MD5 086f049ba7be3b3ab7551f792e4cbce1
SHA1 292c885b0515d7f2f96615284a7c1a4b8a48294a
SHA256 b38fc1074ef68863c2841111b9e20d98ea0305c1e39308dc7ad3a6f3fd39117a
SHA512 645f23b5598d0c38286c2a68268cb0bc60db9f6de7620297f94ba14afe218d18359d124ebb1518d31cd8960baed7870af8fd6960902b1c9496d945247fbb2d78

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W79VKSP8\tooltip[2].js

MD5 72938851e7c2ef7b63299eba0c6752cb
SHA1 b75196bd3a6f9f4dfc1bbf5e43e96874bcd9ce4e
SHA256 e2d4e0e1d3e162fdc815f16dfff9ae9b0a967949f0f3ae371f947d730a3f0661
SHA512 2bb6c03a1335ef9514d0d172a4284d82a29d1783a72306bdcb8af3185d5cd2ff16303355aa4b05086d2fa0b5b7c7159cfa67de4a6175095ff0e68adec2a56ac1

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W79VKSP8\shared_global[2].js

MD5 b071221ec5aa935890177637b12770a2
SHA1 135256f1263a82c3db9e15f49c4dbe85e8781508
SHA256 1577e281251acfd83d0a4563b08ec694f14bb56eb99fd3e568e9d42bad5b9f83
SHA512 0e813bde32c3d4dc56187401bb088482b0938214f295058491c41e366334d8136487a1139a03b04cbda0633ba6cd844d28785787917950b92dba7d0f3b264deb

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\0ptx2pp\imagestore.dat

MD5 c9946704aee3a28a1ea01de0638e3387
SHA1 fba178330e0a32f2f3d5dfa8cb139df012d6a0e3
SHA256 27f64620681dc4fdc230bc042c300ab85ef6591744df9eb2f8c57035bb235de9
SHA512 1d5c0868c1848993f046758f266c1962bb5f4078612d058b5ba6c9911880de16f37dc67193b56bf2bb854c9de762f7914ee2caf24416b7d81248dcfdc626ada2

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W79VKSP8\favicon[1].ico

MD5 f3418a443e7d841097c714d69ec4bcb8
SHA1 49263695f6b0cdd72f45cf1b775e660fdc36c606
SHA256 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA512 82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W79VKSP8\shared_responsive_adapter[2].js

MD5 a52bc800ab6e9df5a05a5153eea29ffb
SHA1 8661643fcbc7498dd7317d100ec62d1c1c6886ff
SHA256 57cfaf9b92c98541f769090cd0229a30013cea7cfafc18519ca654bfae29e14e
SHA512 1bcacd0ec7c3d633d6296fff3325802d6352805f0d2cf1eea39237424229ecffad6cb2aee4248e28b1eca02ff0646b58240851a246bbcf0aa1083830d5d9081e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 34f263ddeb78be4e5008933d475d7081
SHA1 d7b25745ca06c50b8b2ac71c462ae80db48c9fdb
SHA256 5e0bc0df12266e71f08ef40d1638e9cb5fb0333a02548682382025e41d0cdc60
SHA512 bf9f000b04e39e197305b6ba82964e902fc62124e12dcdc8b65218214c6123ad675de4603c878bcd231ad3603dd0219c74708d88690196f069914f1159deb9e3

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\favicon[2].ico

MD5 231913fdebabcbe65f4b0052372bde56
SHA1 553909d080e4f210b64dc73292f3a111d5a0781f
SHA256 9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad
SHA512 7b11b709968c5a52b9b60189fb534f5df56912417243820e9d1c00c97f4bd6d0835f2cdf574d0c36ecb32dbbf5fc397324df54f7fdf9e1b062b5dbda2c02e919

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\53STNJLW\recaptcha__en[1].js

MD5 37c6af40dd48a63fcc1be84eaaf44f05
SHA1 1d708ace806d9e78a21f2a5f89424372e249f718
SHA256 daf20b4dbc2ee9cc700e99c7be570105ecaf649d9c044adb62a2098cf4662d24
SHA512 a159bf35fc7f6efdbe911b2f24019dca5907db8cf9ba516bf18e3a228009055bcd9b26a3486823d56eacc391a3e0cc4ae917607bd95a3ad2f02676430de03e07

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W79VKSP8\pp_favicon_x[1].ico

MD5 e1528b5176081f0ed963ec8397bc8fd3
SHA1 ff60afd001e924511e9b6f12c57b6bf26821fc1e
SHA256 1690c4e20869c3763b7fc111e2f94035b0a7ee830311dd680ac91421daad3667
SHA512 acf71864e2844907752901eeeaf5c5648d9f6acf3b73a2fb91e580bee67a04ffe83bc2c984a9464732123bc43a3594007691653271ba94f95f7e1179f4146212

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\4RN4PA8J\www.recaptcha[1].xml

MD5 1db3bd2be061de6eebf34625dea29472
SHA1 92d04f7331e4dce2cb04e3aefa322eb89680dc58
SHA256 465241d9c2c63ef1ed5ccd10a7c12368283d94e94cf42938a63fc2caaec9ad1f
SHA512 f940dfd7e502abe5c1a17685764eedc795d8a1058ed9ae7bc192e82b6f0c7a5a3e013cb7e64e9aca88d15e88002c7a1dfac0b8836da6e1ea6104eaa7eaf20026

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W79VKSP8\hLRJ1GG_y0J[1].ico

MD5 8cddca427dae9b925e73432f8733e05a
SHA1 1999a6f624a25cfd938eef6492d34fdc4f55dedc
SHA256 89676a3fb8639d6531c525e5800ff4cc44d06d27ff5607922d27e390eb5b6e62
SHA512 20fbee2886995c253e762f2bb814ad16890b0989deab4d92394363ef0060b96a634d87c380c7ba1b787a8ab312be968fed9329a729b4e0d64235a09e397db740

C:\Users\Admin\AppData\Local\Temp\tempAVSXeS33QCNRzda\zdBec0sdnJC9Web Data

MD5 c5ab22deca134f4344148b20687651f4
SHA1 c36513b27480dc2d134cefb29a44510a00ec988d
SHA256 1e9bd8064ca87d8441e2702005ef8df9a3647d5542740737abb8a70be7ec9512
SHA512 550f45132525e967d749106b9d3b114d17b066967527bfd5c66613d61b6f3995f87b0f3c09def19eed14b5b757f2501645b5103505d126f1dd66994f50e1257e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 81e6f22dd15bdb4a623e03c4fdf8509a
SHA1 bcaafe37c668d2974f2775ca7b112ec7e102503f
SHA256 5ff9d44524132d87a8fbf58cdf0066d9d9fe36cae5839d99e9f5d6aa214ac022
SHA512 cc112b242b9d32e77b4072733ea1e7af0ccb4a9cc6649f0050c6d1346afaa9aa1cdd5f50f38c6ec39db9be9aeab712b1bbcb9ce9b125e175d066f2ecf093bd2f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 25b5498bfd4505801f7a42cbfe60ef42
SHA1 04cfcc8f2f1ddc896e0f8081c6883669c754ddc4
SHA256 0d96bbc606fd4c61e81abe310e07d836102316f322c81168fb44874f31e13c9c
SHA512 c9a1a3a23de1425b0b6b867387555b29ae3b5fd6ef9c319feb24afa52355cefb88c6cd7b509553c0109eac9bcb479ad0812b6978cbef85b0e154b0502748c753

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W79VKSP8\epic-favicon-96x96[1].png

MD5 c94a0e93b5daa0eec052b89000774086
SHA1 cb4acc8cfedd95353aa8defde0a82b100ab27f72
SHA256 3f51f3fb508f0d0361b722345974969576daef2c7d3db8f97c4ca8e1ff1a1775
SHA512 f676705e63f89d76520637b788f3bac96d177d1be7f9762aeb8d5d1554afd7666cbd6ef22ce08f581eb59bd383dd1971896231264bc3eaabf21135c967930240

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\4RN4PA8J\www.recaptcha[1].xml

MD5 1f0aaa76d10c72af4c708b6578a840f2
SHA1 72945033e605104336920af6cfc08818f6c0dd11
SHA256 e57604c5570296844df055724c06f26775a9744d1cd98ca30262da5dae1a0048
SHA512 99b5c6b792a9069bc086844464c6c3cfc350ef815c82757d8c6c3d3f66b8d82b732fc3905d81678c88756bf7264d375cccd6871e470e5680b1c750750efc2430

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\DU4NR7UJ\www.paypalobjects[1].xml

MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\4RN4PA8J\www.recaptcha[1].xml

MD5 aaedcfb732273bc94bf9366e803790d6
SHA1 c6e2a9ecb456dd0831781e934f03c1715d618ab1
SHA256 995247b802f6e44aa68311e7950deac10b018d90622cf6b77aa784b01e8e93a3
SHA512 37858140fb82b6620425f10ad1264732d8db004d4c60a565672a1c9debed853d80aac5e0a28fd54a0ce6b91fdf5020347622fb884f4b416e81b224f2572d6f1f

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\DU4NR7UJ\www.paypalobjects[1].xml

MD5 c4abf0a03c8145097f7be8465045ef99
SHA1 bbf84aa32de048a0d46b5793515f2f14b7f08e8c
SHA256 8da26fa16e5473bbbd889d092176098420b1771a23e86ef3fb8fc60e6860043e
SHA512 1796b742c649ea58a98dc072657a6c802126441697b56d90fb2a073d132de313b97eccf40fd5a12a876796f7daf401fcf0f73c25578ee34ad7b48181d0b735e3

memory/2696-3479-0x00000000004C0000-0x00000000005C0000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f5ad527c4e2a7c42480a70b36927043d
SHA1 dbbb6aa58ad9c662d010f81b15ecdc2f6cc3a7d8
SHA256 16f3a13da94175064e9a5d0079ac6d0575d0a8cbfade448426d2ea60cda4845e
SHA512 fda4442bed12060f47184c8c06838451d22b74fcb873f81df5b1276f855f805c6dc7ff5d604074fe91f4b9d28f7937ef6d32c96d2103dae23e803223c2d19baf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a3f1cb887b658779c86da54eadf14d93
SHA1 f744dee2d97ebef3bf95502fe9be6afbeba12262
SHA256 6181e61bad154f021351d3bcc5e1cdc22681dc6d0a2a3d881333c4b5404d3a92
SHA512 adc99e0fc515838fcead3621edf1b84c7ded25e5f31a85b9445bc7a547bbaac3428001ada1db20cd58241c5827718189cf84a542c7638a03c8d27c8df22f550b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fc0ccba79eca77b2adcc2dbd3c5fe209
SHA1 281f58b705ab73616bcbab11ec3a9003fd54314f
SHA256 6757f4bd9215865cf347e91c8be725baae7b7b5e65803cad3bb271b9b7012ec7
SHA512 03e38c6ddaee2feff7a359f3d0772be8c319619af358b86a16bbc80957d463e3df96e1f2085305e2de6c4b474cb1686fb7156641a4f9459e929fc87ad7b39cdd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 80667eb075dc57346086ae20d5195abd
SHA1 747bb460a4e14ae53ce6fc23ee3fc521380f5f2c
SHA256 586186b97f6f70378fcc962d081f70bcff63a2d305388d6260a8015f9ab68c3e
SHA512 4fb49b3a0f5d2032a04d5cb2068ce8bcb8394122bd549ffa98e94bee1cf9389f563a5640c571bb0f67d0b73a03ec1becab8947ad3f264b299199b4b2da0319fd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f40c893cdd672f56a8b590401478d0f6
SHA1 b3a16dcabd20db74f70cc50c3b1fa800d113f003
SHA256 e5f1d0c8a6bf2870e02168563711b34e8c110d01adb45c3cf16a803d6f85aebf
SHA512 e7d262dca087185371d4ca57bad38adc632dc6de7d4bd05e279928cc3dfaecd7df410f4d221759411f6e13ad584493f7bc8a76d9713a523f1d8e3435448a7259

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 98e7b4191bba3a733d81eb664a1cb5a2
SHA1 e2747c6904ffbccca03cf09e4b7b866973e56161
SHA256 1809b685f8a54054f632788dcb214033c87c9e254c5c0fd8907f964c84d7ed82
SHA512 f386a0138e76358c633ae896646107dbf3d8de44898fae084fd31048d12b11d54e126a2df04ff3f5c728fbda6b5dfbd598e9cd6fcbb4dc3c48083cd47c5f0f0b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 79ceff0036333a7e839b7e80b5094150
SHA1 c6bf2d703224d049d7afbafe88371c82e4e406f9
SHA256 8040427bea25d478cf0b78248aa7d51fb84d6d8de91c94efad06163ffbba9cb4
SHA512 0e76b2449e0bfa89376211cb58c21e679fe393a9b3a4f651d97653e00c8e1a6b0be9d23a9512db19731f0fdcbc18c2eaffc14a3c99ca4d1bcac92e5ef1cd27c2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2e63ab01b7f470d1b7eecb38bb4f4f19
SHA1 2863e00b3cf8e9ea9c78752a8cded3fba0ad9b87
SHA256 6af8c5691f266a8db08a74ccf7b0e20e3db19a98e3ca2d07c6bcc50403bff1cf
SHA512 b84ef3ce9368b5769c323b6d68cee7b5f5ba5f1f13f999c9a0ab580249579e2957396732c94f4be68adf7c853a0f17f54091938028b01e1b976c1be70692312a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 68f411f5cac29a2bdbbfdb43dbf5dda5
SHA1 f9585d99013f91fdbc8a81346a82d7f7895cb4ba
SHA256 90aa6438236ee5dd97c43650a14c9789f12f6d118b33d91793a6d025ee53ea99
SHA512 5b75deebf060f3759be624db7473269c8959635e3db9aac5eb18ee0f7e788de0e485c0647d87e0741f1905d0cea60aa17eefebdf853ec248dddbf85d1fe8d34c

memory/3236-3794-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1420-3793-0x0000000003F40000-0x0000000003F56000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 42993555f8611f5cb16fc41699274866
SHA1 dc23fbae9e223276b02d3f2bbf9bc6942c230802
SHA256 54c84c8d18034c6d8bc2402147a327478837fd140c3fc3dec3c1edd7de16fb10
SHA512 bd016aa7f5761b659e3c9de659149385c80fbb25c1893c93574bc3cb9b685e9c4f18ae8829648158ed11d5350dc1a341844d42160d5449d7cae419c10d938ffb

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-24 09:48

Reported

2023-12-24 09:50

Platform

win10v2004-20231215-en

Max time kernel

67s

Max time network

115s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe"

Signatures

Detect Lumma Stealer payload V4

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Lumma Stealer

stealer lumma

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

ZGRat

rat zgrat

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A N/A N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Legitimate hosting services abused for malware hosting/C2

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\A6EE.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\A6EE.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\A6EE.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Runs net.exe

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\A6EE.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2032 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe
PID 2032 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe
PID 2032 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe
PID 2032 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe
PID 2032 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe
PID 2032 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe
PID 3472 wrote to memory of 3364 N/A N/A C:\Users\Admin\AppData\Local\Temp\A6EE.exe
PID 3472 wrote to memory of 3364 N/A N/A C:\Users\Admin\AppData\Local\Temp\A6EE.exe
PID 3472 wrote to memory of 3364 N/A N/A C:\Users\Admin\AppData\Local\Temp\A6EE.exe
PID 3472 wrote to memory of 3744 N/A N/A C:\Windows\system32\cmd.exe
PID 3472 wrote to memory of 3744 N/A N/A C:\Windows\system32\cmd.exe
PID 3364 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\A6EE.exe C:\Users\Admin\AppData\Local\Temp\A6EE.exe
PID 3364 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\A6EE.exe C:\Users\Admin\AppData\Local\Temp\A6EE.exe
PID 3364 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\A6EE.exe C:\Users\Admin\AppData\Local\Temp\A6EE.exe
PID 3364 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\A6EE.exe C:\Users\Admin\AppData\Local\Temp\A6EE.exe
PID 3364 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\A6EE.exe C:\Users\Admin\AppData\Local\Temp\A6EE.exe
PID 3364 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\A6EE.exe C:\Users\Admin\AppData\Local\Temp\A6EE.exe
PID 3744 wrote to memory of 2348 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3744 wrote to memory of 2348 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3472 wrote to memory of 4848 N/A N/A C:\Users\Admin\AppData\Local\Temp\4BBC.exe
PID 3472 wrote to memory of 4848 N/A N/A C:\Users\Admin\AppData\Local\Temp\4BBC.exe
PID 3472 wrote to memory of 4848 N/A N/A C:\Users\Admin\AppData\Local\Temp\4BBC.exe
PID 4848 wrote to memory of 3308 N/A C:\Users\Admin\AppData\Local\Temp\4BBC.exe C:\Users\Admin\AppData\Local\Temp\4BBC.exe
PID 4848 wrote to memory of 3308 N/A C:\Users\Admin\AppData\Local\Temp\4BBC.exe C:\Users\Admin\AppData\Local\Temp\4BBC.exe
PID 4848 wrote to memory of 3308 N/A C:\Users\Admin\AppData\Local\Temp\4BBC.exe C:\Users\Admin\AppData\Local\Temp\4BBC.exe
PID 4848 wrote to memory of 3308 N/A C:\Users\Admin\AppData\Local\Temp\4BBC.exe C:\Users\Admin\AppData\Local\Temp\4BBC.exe
PID 4848 wrote to memory of 3308 N/A C:\Users\Admin\AppData\Local\Temp\4BBC.exe C:\Users\Admin\AppData\Local\Temp\4BBC.exe
PID 4848 wrote to memory of 3308 N/A C:\Users\Admin\AppData\Local\Temp\4BBC.exe C:\Users\Admin\AppData\Local\Temp\4BBC.exe
PID 4848 wrote to memory of 3308 N/A C:\Users\Admin\AppData\Local\Temp\4BBC.exe C:\Users\Admin\AppData\Local\Temp\4BBC.exe
PID 4848 wrote to memory of 3308 N/A C:\Users\Admin\AppData\Local\Temp\4BBC.exe C:\Users\Admin\AppData\Local\Temp\4BBC.exe
PID 4848 wrote to memory of 3308 N/A C:\Users\Admin\AppData\Local\Temp\4BBC.exe C:\Users\Admin\AppData\Local\Temp\4BBC.exe
PID 4848 wrote to memory of 3308 N/A C:\Users\Admin\AppData\Local\Temp\4BBC.exe C:\Users\Admin\AppData\Local\Temp\4BBC.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe

"C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe"

C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe

"C:\Users\Admin\AppData\Local\Temp\c22faa824eb0e7d3778874b75e8a8f32.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3712 -ip 3712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 328

C:\Users\Admin\AppData\Local\Temp\A6EE.exe

C:\Users\Admin\AppData\Local\Temp\A6EE.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A7CA.bat" "

C:\Users\Admin\AppData\Local\Temp\A6EE.exe

C:\Users\Admin\AppData\Local\Temp\A6EE.exe

C:\Windows\system32\reg.exe

reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4872 -ip 4872

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 328

C:\Users\Admin\AppData\Local\Temp\4BBC.exe

C:\Users\Admin\AppData\Local\Temp\4BBC.exe

C:\Users\Admin\AppData\Local\Temp\4BBC.exe

C:\Users\Admin\AppData\Local\Temp\4BBC.exe

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\a907a0aa-c27b-4ea7-941b-1e58b9526f34" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\4BBC.exe

"C:\Users\Admin\AppData\Local\Temp\4BBC.exe" --Admin IsNotAutoStart IsNotTask

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 584

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4308 -ip 4308

C:\Users\Admin\AppData\Local\Temp\4BBC.exe

"C:\Users\Admin\AppData\Local\Temp\4BBC.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1TF80Ie5.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1TF80Ie5.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vw4kr04.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vw4kr04.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x16c,0x170,0x174,0x168,0x178,0x7ffbf79846f8,0x7ffbf7984708,0x7ffbf7984718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x16c,0x170,0x174,0x168,0x178,0x7ffbf79846f8,0x7ffbf7984708,0x7ffbf7984718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffbf79846f8,0x7ffbf7984708,0x7ffbf7984718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x78,0x170,0x7ffbf79846f8,0x7ffbf7984708,0x7ffbf7984718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffbf79846f8,0x7ffbf7984708,0x7ffbf7984718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform

C:\Users\Admin\AppData\Local\Temp\5FD2.exe

C:\Users\Admin\AppData\Local\Temp\5FD2.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4179754512819182896,5920911860395579881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4179754512819182896,5920911860395579881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffbf79846f8,0x7ffbf7984708,0x7ffbf7984718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4179754512819182896,5920911860395579881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4179754512819182896,5920911860395579881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4432 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4179754512819182896,5920911860395579881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4179754512819182896,5920911860395579881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffbf79846f8,0x7ffbf7984708,0x7ffbf7984718

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4bs024Vz.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4bs024Vz.exe

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4179754512819182896,5920911860395579881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2160,4179754512819182896,5920911860395579881,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6640 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2160,4179754512819182896,5920911860395579881,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4844 /prefetch:8

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5320 -s 872

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5320 -ip 5320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.linkedin.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4179754512819182896,5920911860395579881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4179754512819182896,5920911860395579881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffbf79846f8,0x7ffbf7984708,0x7ffbf7984718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4179754512819182896,5920911860395579881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4396 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,16813404962137064920,15837760103495390294,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1464,15280453521702228719,12338143634103007194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4179754512819182896,5920911860395579881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4179754512819182896,5920911860395579881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffbf79846f8,0x7ffbf7984708,0x7ffbf7984718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4179754512819182896,5920911860395579881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,13284131661903798024,16522131987667019327,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,13284131661903798024,16522131987667019327,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,4179754512819182896,5920911860395579881,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2468 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,4179754512819182896,5920911860395579881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,4179754512819182896,5920911860395579881,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OF1DB27.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OF1DB27.exe

C:\Users\Admin\AppData\Local\Temp\5BDA.exe

C:\Users\Admin\AppData\Local\Temp\5BDA.exe

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,4179754512819182896,5920911860395579881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7260 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4179754512819182896,5920911860395579881,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7364 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4179754512819182896,5920911860395579881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7320 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,4179754512819182896,5920911860395579881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7260 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4179754512819182896,5920911860395579881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4179754512819182896,5920911860395579881,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4179754512819182896,5920911860395579881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7692 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf79846f8,0x7ffbf7984708,0x7ffbf7984718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,14987588589846030840,10985034950111644340,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,14987588589846030840,10985034950111644340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2512 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,14987588589846030840,10985034950111644340,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14987588589846030840,10985034950111644340,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14987588589846030840,10985034950111644340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6200 -ip 6200

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6200 -s 3096

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6US2GY9.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6US2GY9.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14987588589846030840,10985034950111644340,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2148 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14987588589846030840,10985034950111644340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 7932 -ip 7932

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7932 -s 980

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Cc6xa24.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Cc6xa24.exe

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,14987588589846030840,10985034950111644340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3580 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,14987588589846030840,10985034950111644340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3580 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14987588589846030840,10985034950111644340,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14987588589846030840,10985034950111644340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14987588589846030840,10985034950111644340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\FA7D.exe

C:\Users\Admin\AppData\Local\Temp\FA7D.exe

C:\Users\Admin\AppData\Local\Temp\BF3.exe

C:\Users\Admin\AppData\Local\Temp\BF3.exe

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

C:\Users\Admin\AppData\Local\Temp\tuc4.exe

"C:\Users\Admin\AppData\Local\Temp\tuc4.exe"

C:\Users\Admin\AppData\Local\Temp\F11.exe

C:\Users\Admin\AppData\Local\Temp\F11.exe

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 6424 -ip 6424

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\nsh15F2.tmp.exe

C:\Users\Admin\AppData\Local\Temp\nsh15F2.tmp.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6424 -s 892

C:\Users\Admin\AppData\Local\Temp\is-VJCE9.tmp\tuc4.tmp

"C:\Users\Admin\AppData\Local\Temp\is-VJCE9.tmp\tuc4.tmp" /SL5="$102CC,7884275,54272,C:\Users\Admin\AppData\Local\Temp\tuc4.exe"

C:\Users\Admin\AppData\Local\Temp\etopt.exe

"C:\Users\Admin\AppData\Local\Temp\etopt.exe"

C:\Users\Admin\AppData\Roaming\jgdrcuv

C:\Users\Admin\AppData\Roaming\jgdrcuv

C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe

"C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe"

C:\Users\Admin\AppData\Local\Temp\1CAE.exe

C:\Users\Admin\AppData\Local\Temp\1CAE.exe

C:\Users\Admin\AppData\Local\Temp\1F7E.exe

C:\Users\Admin\AppData\Local\Temp\1F7E.exe

C:\Windows\SysWOW64\net.exe

"C:\Windows\system32\net.exe" helpmsg 23

C:\Program Files (x86)\DataPumpCRT\datapumpcrt.exe

"C:\Program Files (x86)\DataPumpCRT\datapumpcrt.exe" -i

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 6548 -ip 6548

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6548 -s 328

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 helpmsg 23

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1124 -ip 1124

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 680

C:\Users\Admin\AppData\Local\Temp\2AAA.exe

C:\Users\Admin\AppData\Local\Temp\2AAA.exe

C:\Users\Admin\AppData\Local\Temp\2D2C.exe

C:\Users\Admin\AppData\Local\Temp\2D2C.exe

C:\Program Files (x86)\DataPumpCRT\datapumpcrt.exe

"C:\Program Files (x86)\DataPumpCRT\datapumpcrt.exe" -s

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Roaming\jgdrcuv

C:\Users\Admin\AppData\Roaming\jgdrcuv

C:\Users\Admin\AppData\Local\Temp\38D5.exe

C:\Users\Admin\AppData\Local\Temp\38D5.exe

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf79846f8,0x7ffbf7984708,0x7ffbf7984718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,6202202431429015355,826489765549740765,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,6202202431429015355,826489765549740765,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2980 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6202202431429015355,826489765549740765,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6202202431429015355,826489765549740765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5820 -ip 5820

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 1148

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6202202431429015355,826489765549740765,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5820 -ip 5820

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 1148

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1032 -ip 1032

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 788

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1916 -ip 1916

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 328

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\cmd.exe

cmd /k cmd < Pool & exit

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6202202431429015355,826489765549740765,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6202202431429015355,826489765549740765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

cmd

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nsh15F2.tmp.exe" & del "C:\ProgramData\*.dll"" & exit

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5788 -ip 5788

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 2280

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6824 -s 748

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6824 -ip 6824

C:\Windows\SysWOW64\cmd.exe

cmd /c mkdir 27598

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6202202431429015355,826489765549740765,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6202202431429015355,826489765549740765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1

C:\Windows\SysWOW64\timeout.exe

timeout /t 5

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Battlefield + Vanilla + Herein + Hs + Projector + Computer + Radio + Ala + Presented + Bobby + Drag + Leasing + Classifieds 27598\U

C:\Windows\SysWOW64\PING.EXE

ping -n 5 localhost

C:\Users\Admin\AppData\Local\Temp\20459\27598\Originally.pif

27598\Originally.pif 27598\U

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Museum + Provision + Copyright + Ll + Luther + Might 27598\Originally.pif

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6202202431429015355,826489765549740765,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6202202431429015355,826489765549740765,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8

C:\Windows\SYSTEM32\cmd.exe

cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumSim.url" & echo URL="C:\Users\Admin\AppData\Local\Quantum Dynamics Ltd\QuantumSim.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumSim.url" & exit

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6202202431429015355,826489765549740765,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

Network

Country Destination Domain Proto
US 8.8.8.8:53 3.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 100.5.17.2.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 host-host-file8.com udp
RU 158.160.130.138:80 host-host-file8.com tcp
US 8.8.8.8:53 galandskiyher5.com udp
RU 158.160.130.138:80 galandskiyher5.com tcp
US 8.8.8.8:53 138.130.160.158.in-addr.arpa udp
US 8.8.8.8:53 brusuax.com udp
KR 210.182.29.70:80 brusuax.com tcp
US 8.8.8.8:53 70.29.182.210.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 32.134.221.88.in-addr.arpa udp
GB 96.17.178.176:80 tcp
GB 96.17.178.176:80 tcp
GB 96.17.178.176:80 tcp
GB 96.17.178.176:80 tcp
GB 96.17.178.176:80 tcp
GB 96.17.178.176:80 tcp
GB 96.17.178.176:80 tcp
GB 96.17.178.176:80 tcp
GB 96.17.178.176:80 tcp
GB 96.17.178.176:80 tcp
GB 96.17.178.176:80 tcp
GB 96.17.178.176:80 tcp
GB 96.17.178.176:80 tcp
GB 96.17.178.176:80 tcp
GB 96.17.178.176:80 tcp
GB 96.17.178.176:80 tcp
GB 96.17.178.176:80 tcp
GB 96.17.178.176:80 tcp
US 8.8.8.8:53 udp
GB 96.16.110.114:80 tcp
GB 96.17.178.176:80 tcp
US 8.8.8.8:53 udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 udp
GB 96.17.178.173:80 tcp
GB 96.17.178.176:80 tcp
GB 96.17.178.173:80 tcp
US 8.8.8.8:53 udp
RU 158.160.130.138:80 galandskiyher5.com tcp
FR 20.74.47.205:443 tcp
US 104.21.65.24:443 tcp
US 8.8.8.8:53 35.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 24.65.21.104.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
GB 96.17.178.176:80 tcp
US 8.8.8.8:53 elamer-llensha.com udp
US 154.49.138.223:443 elamer-llensha.com tcp
GB 142.250.187.238:443 udp
GB 142.250.187.234:443 tcp
FR 216.58.201.118:443 tcp
US 2.17.5.46:443 tcp
US 151.101.1.21:443 tcp
US 8.8.8.8:53 udp
GB 104.103.202.103:443 tcp
US 34.196.248.146:443 tcp
US 13.107.42.14:443 tcp
US 8.8.8.8:53 static.licdn.com udp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
US 8.8.8.8:53 22.103.224.13.in-addr.arpa udp
US 8.8.8.8:53 234.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 118.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 14.42.107.13.in-addr.arpa udp
N/A 195.20.16.188:20749 tcp
IE 163.70.147.23:443 tcp
US 8.8.8.8:53 udp
IE 163.70.147.35:443 fbsbx.com tcp
GB 104.77.160.221:443 tcp
GB 104.77.160.221:443 tcp
GB 142.250.187.227:443 udp
US 20.231.121.79:80 tcp
GB 96.16.110.114:80 tcp
RU 185.215.113.68:80 tcp
US 8.8.8.8:53 bitbucket.org udp
US 104.192.141.1:443 bitbucket.org tcp
US 52.216.86.131:443 tcp
RU 5.42.65.125:80 tcp

Files

memory/2032-1-0x00000000006E0000-0x00000000007E0000-memory.dmp

memory/2032-2-0x0000000002190000-0x0000000002199000-memory.dmp

memory/3712-3-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3712-4-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3712-5-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3472-6-0x0000000002B70000-0x0000000002B86000-memory.dmp

memory/3712-9-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\A6EE.exe

MD5 3ce7f5fa5d7361a108dfc1856e1257e4
SHA1 cd5813e80a1d638e504edaf194ffb6791d740666
SHA256 fc75dbfdf2addf607446b85bfe7271ff42dc6eda289090ce365e55938f9da844
SHA512 75d2a46c74721af5e05a3edc3ec8c0316ba8a0ea523fffa08baed3f423dd0a59aeda83e18d6f97844b5f9bb12f09bf481905e097259dec2504413f0f29828d5c

C:\Users\Admin\AppData\Local\Temp\A7CA.bat

MD5 55cc761bf3429324e5a0095cab002113
SHA1 2cc1ef4542a4e92d4158ab3978425d517fafd16d
SHA256 d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a
SHA512 33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

memory/3364-25-0x00000000005D0000-0x00000000006D0000-memory.dmp

memory/4872-26-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3472-27-0x0000000002E40000-0x0000000002E56000-memory.dmp

memory/4872-30-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3364-33-0x00000000005D0000-0x00000000006D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4BBC.exe

MD5 339c715438d680df246d1b439ce7c67d
SHA1 2bc7b372983c2c93faefb61c94c1175506546d96
SHA256 1eb74a3d3adf923939d84b1b0836567cb2b730d3e0146f5fa9ec7b3084822dcf
SHA512 a47254a8b86367bb2e93d4d4118581db46a2fa7ecb2568aab9ac353a96fe38049e7b1c611f7eb38bf8838d2581be2aa781fcab6a743d8adae1b726645addf7e4

C:\Users\Admin\AppData\Local\Temp\4BBC.exe

MD5 37618cf4df4bb9a75a0b673a0bd5ffe5
SHA1 862e755964855d6384ecab9121effb3f6940ead3
SHA256 ad22d9b8ecacd52b79877adfb9b69d83c819bec2148779f355608db5090594d6
SHA512 b1d764c629e43ccd0d33a3fead465c65991e49f76b892f64c1447df03540aa82b40a294ce2e4f33a44e8b2e060956fe506a5b7217e25668e6cf4d976de6a4296

memory/4848-39-0x0000000002120000-0x00000000021C1000-memory.dmp

memory/3308-43-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3308-45-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3308-44-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4BBC.exe

MD5 6bb995f4e105b3b0bb32fc0e7e8853d6
SHA1 cbd3e1d574ae17b9b9e70d1180ffc313784d737f
SHA256 16b6ff03ba61770bbef659aff6b7a37ad03106cca5247899871cd4127b0c8e42
SHA512 b5b7876a342676c8a55e84d4850c8bac26fdd34c484d2f5d7c013b8e523abc70e752c01d48122a502dc7736f908fe9a9b646fb7e830a7756bf1d6f74e06c337c

memory/3308-41-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4848-40-0x0000000002270000-0x000000000238B000-memory.dmp

C:\Users\Admin\AppData\Local\a907a0aa-c27b-4ea7-941b-1e58b9526f34\4BBC.exe

MD5 e6dd273c9937dbb656b720f5f2920cf8
SHA1 615ad0f90b76f98928f1b646d029cee64b646447
SHA256 b003a94840d0142d54d28a16f37047275d3120fbae4cc3f6eaa4263a48350cde
SHA512 e264cf84166fecc2ce3f7fa742146f9a28c2980ca99c38620382e333d116bd7bb26d682245b71e164939199a7b1a2e0f0992e27f95d61cb6975313acfb43799f

memory/3308-55-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4BBC.exe

MD5 43efd3e847e9e6e0bf7efd40808b5d17
SHA1 85c22663e3861c02d3ec66e3bf4bff30db2587e8
SHA256 81bf2af1fd910219a39ec61b99757098f6a7f6fed534d86dda485a60b5ba6ef3
SHA512 c1a85e5bebaefc427ba21d85ac620bc0ca4a6b4d5ba705b840e0c64164d560f8ec7ca4f676e319466d0d935996d394b6055c74fad055318fd9739c20910687c1

memory/2752-58-0x0000000002080000-0x000000000211A000-memory.dmp

memory/4308-62-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4308-64-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4308-61-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4BBC.exe

MD5 f26da7e36b368e5423e9397c02df0c71
SHA1 fe5ef8e387f60e388e49a4d7b45a820163e0c869
SHA256 5a0d8bf14978b303160d2c5e619b6d0bdb279cac0a031b0003c6f34b0a5049a6
SHA512 58141d80df0443fc82eaf6a32e1072d556f4e5be4efc962819f311ed8e4a21819ce11b0c13cef5bcd10b63e8428bcf23ba2e362b1790b1ab364fc912a1ddb6d8

C:\Users\Admin\AppData\Local\Temp\5BDA.exe

MD5 3c8a7fd42d0d407c5a0c0703153e2a41
SHA1 5896ad9971cf16a3f7a629c51e65fd976ceb3af6
SHA256 e973baf99a8ee0413746c859599fb16ee8ec02de660cf3644303ce8abd7d8161
SHA512 90f051330ec96676ffcc6a1ed2a189cc7a1e2e9e02452fda06bd37858bc623e9f57ee6907b46bf6a8546077ff7b9122d237062818b5bc4e033117e050596c0aa

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OF1DB27.exe

MD5 d51d2479d1ae46db6e010c006bf51947
SHA1 a4f04af18daf08420738347a15f1f9490e334bf6
SHA256 3ce6e15d5f0d27839a113ab4b0c618492c640845aee1d03f322b23d1cd7545fc
SHA512 ae5315d16ca9f460451cb7738d64f334b99d8aeec37a6039c06d31357b00ec2947ab1e604561a044938b37129ba5b279a5d58ff455b02064f6d558ce8ce71aa3

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vw4kr04.exe

MD5 3fce04e2b3e8000f3687a1f9ab863f50
SHA1 ad552a3e1f3db48ae9b398ac95d2d409ca119cf1
SHA256 9c1a361045cb00d0070245b188db6c8838469e29102c9efb67e14dff348422af
SHA512 2c472dcf443484a1cd37c4bd6b36fc7bd285039addf892a12c2d193cb292c547313b19f206088d611ef4b63573ff94dd3dd8f8a46fc575cfe976a70a91cd061e

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1TF80Ie5.exe

MD5 68337ea4c3a97662bd0b0a87ef199a5b
SHA1 0d68d729b0d0e19cf892ada8767fc585e1660384
SHA256 2448319641854823ee5fdf3c63c94dff7de30ac362e7fcf0be1b6f491d34b221
SHA512 4ed1460f95ff6aede52a0b72b9626f295687432750af18377e56a80611026cd8e7498ed71b41d3013815dbe3d8aad2e18c702b386f4c570d389ffdd4a65bac8e

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1TF80Ie5.exe

MD5 f646d65ab6f0fe67052901b92fa5767a
SHA1 4ec975c920adab8191205cc826f3ceffc56d54a5
SHA256 1d0787920573d5f78a567e5f2a32c067f9c5b178d30b20961ca861e28154c085
SHA512 12d2b619065c6431f2dade2df8848b82125357aa08a098b8ebfcf927f93fd5b9c3f70936637960881c1267ac9287c4480b5232dacc2d5d7bbcbdfa4516a9cd8c

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vw4kr04.exe

MD5 d7d101f53e2de6c86bbac9906d450e1d
SHA1 dc8767777ef0ab289cd4fbfd187403a77061d8ad
SHA256 5092445d743f7ccffe8570145f9b3f2d625d08cf6b66cf3759281781de225dfc
SHA512 2c9269e90dd71085e96e17bc9cb45e54fba72d48b32a778ff60a81b1a3fc80154d65f4f8cf13edbab0e78af3488b8ac776dfcaf8f9d770364656768dee8e09fb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ba867085de8c7cd19b321ab0a8349507
SHA1 e5a0ddcab782c559c39d58f41bf5ad3db3f01118
SHA256 2adaff5e81f0a4a7420d345b06a304aafa84d1afd6bda7aeb6adb95ee07f4e8c
SHA512 b1c02b6e57341143d22336988a15787b7f7590423913fcbc3085c8ae8eb2f673390b0b8e1163878367c8d8d2ee0e7ca8ed1d5a6573f887986f591fcababc2cfe

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 bcaf436ee5fed204f08c14d7517436eb
SHA1 637817252f1e2ab00275cd5b5a285a22980295ff
SHA256 de776d807ae7f2e809af69746f85ea99e0771bbdaaed78a764a6035dabe7f120
SHA512 7e6cf2fdffdcf444f6ef4a50a6f9ef1dfb853301467e3f4784c9ee905c3bf159dc3ee9145d77dbf72637d5b99242525eb951b91c020e5f4e5cfcfd965443258c

C:\Users\Admin\AppData\Local\Temp\5FD2.exe

MD5 76eb889331237ae00e999f6ecda97632
SHA1 ed1e25b8a38b6a6f15354283b1b66b07f15b939f
SHA256 e3b1d0ec9f734cfc86cec5a9a25ea83ac92d3531db7b6d999d8d7e8fa2874700
SHA512 d229211bbf2ca6096b4ea1830c697f49d732fb16acab3d4e5e4911fe5078138c091d47e9d8350dddfe298b60c8c3c652ec3a384ceb6112c023bb9fcfa77fbc36

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 d6155a74ef4fafb3399d23f00b63b910
SHA1 970ccbc22355312e22cad79d4eb00f89ad5564d4
SHA256 87d6bf2492f555f8aead92f76da146f5190da7a2e7d0de03f684b8476208a1e9
SHA512 538da74ca98bfe76dd2accc658111aaba82e176f89025948c93b010d33873d7fadf8092a0a84a75b4cb6dacb1795ed215cd76cac297d2bea274f4a51fdb93991

C:\Users\Admin\AppData\Local\Temp\5FD2.exe

MD5 9680d0432509fbc4a482b7502ef3bd56
SHA1 f1178a27e321b5a54e58b43be27c5743d2b20df9
SHA256 c466451997b8dbf468d8c92f0a5df870bf3a7bdfcc0ea3bab5bdd7e2f5707d5d
SHA512 2fb482a0797570b626de3257fa76d7317f9830c1284a69f0babdaeeb37bea40c4a59d39dee048e7a2be0ad30b2f5c0e955ea0fc56fa6d5f765dc9a3236dc0cc0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c98b1563982dbc5cd61533a75f0f259c
SHA1 8334f8ce33fc3e30a694ddd94176d193197b337a
SHA256 e51a63f2f1dbbf3d467ad6f56b28859c4d44f8adb19e10222f672f86fb90ac6e
SHA512 765d3ba33aff0b0cd7fee622f8581f90cd47a36d7966b21478717a5fffc144b2214c7587a405a44f7b846d866939ad2c9a0e73211a05f8f44ae460e4bf0a0b85

memory/5320-180-0x0000000072550000-0x0000000072D00000-memory.dmp

memory/5320-181-0x0000000005290000-0x00000000052A0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 0b7f7646d8ee19a0e8a78a10448b3131
SHA1 c615d528d93388d68c01d4006f3e386617f61e7a
SHA256 e0775d780fa4e6eb4b804e697c51d681b3821a8b9c0a1845a80e5c0b5fe8a6de
SHA512 cf95ab955509607f24e5d36210aeaceea7d39c2b682d996b29770cfb9c7c55cf445153e634ce129a94ee9a0c21ee7285be8881ef7886cc1372240cefc6117245

memory/6788-203-0x0000000000400000-0x0000000000452000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 0393540e9370fc2d737dcf6137760203
SHA1 673e9f609a69395b5847d885f8e4fa607c234251
SHA256 f3500fbeabb279ac13a4a8f4fd5f04d7818ad5c7de20b9fa2b10e3cf9f3a9306
SHA512 910ba122b12ecf81efe2b934d21ef35f760ebba50ef65f9032a3962a2aae345e47f92073c121f89f5e149c909a29c23e60444dba6bbd26c4692e65d4d0ba986a

memory/6788-209-0x0000000005850000-0x0000000005DF4000-memory.dmp

memory/6788-211-0x0000000005340000-0x00000000053D2000-memory.dmp

memory/6200-227-0x0000000000500000-0x00000000005CE000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 0c39d2ac04137e57eb514a399a12cc9d
SHA1 b5adcf0398cf5868cacae374e2d76ef7c15df6c5
SHA256 d7e969b6d1374ee05a394622b0f074a4c0e5c6bd350a83fc14f8357416b563fe
SHA512 ccb04ab113153e726bf8edc51e9a0292cf3fdf03057ec7c916390a4376774e89890a58ea627b2fe2298fead647821972dbd225634b674cf5a38d27b9e50507c4

memory/6200-243-0x00000000072E0000-0x0000000007356000-memory.dmp

memory/6788-236-0x0000000006420000-0x0000000006A38000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exe

MD5 b3422104a978e4c9495c33b75a990c11
SHA1 05f71d01a5ec1183beac0d03eb4856e28978cb58
SHA256 669c18924e813fbfe2468974ea1a731516920dc0b53a2bddbeae70a1ea7a0ee2
SHA512 04debe1444e1806e207469625602c3d91d72000da9b084b3443f9cb57c13d57ffc887ed8f0c6418a82bef8521c522239f8ec35ea4758a53f06c8cc439631a2b7

memory/6788-255-0x0000000005430000-0x0000000005442000-memory.dmp

memory/6788-254-0x00000000056B0000-0x00000000057BA000-memory.dmp

memory/6788-262-0x00000000055F0000-0x000000000563C000-memory.dmp

memory/6788-258-0x00000000055A0000-0x00000000055DC000-memory.dmp

memory/6200-256-0x00000000073B0000-0x00000000073C0000-memory.dmp

memory/6200-229-0x0000000072550000-0x0000000072D00000-memory.dmp

memory/5320-263-0x0000000072550000-0x0000000072D00000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4bs024Vz.exe

MD5 1bc50ee7034cd54683c0c8f439abb300
SHA1 e71a10813a9ae8d4cfb375af203a926c3d0f4709
SHA256 89c1a0ed32ccb50c8645d92237af499d59797e9dff8265b438f314d76eee523c
SHA512 d5edb62bd21203cab2edf6b85a104e09c4697bb4953e4a1e4a75cea86a2cd09c75d4e2d7c812c49346a4bc5d5a8b2ce42f8724c2558095e35cf6e56971f80521

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4bs024Vz.exe

MD5 89ea19d0349d66a249632bfd68e07aed
SHA1 443116646cd31403fff35784a62ab556dda36a06
SHA256 2ab3cc594ba45be42f9d3e359e2302f7b9c9b76053cf9833d70a97a482a7b53b
SHA512 2f07770554e5c4c8d8bd0d5bc96e0a57fd46cc4c46208f7e3005572630d15e46f90a7553093ba78101b7f6abfbe4f83fa5f1431ba24290a1e394a12c236421d8

memory/6788-219-0x00000000052C0000-0x00000000052CA000-memory.dmp

memory/6788-218-0x0000000005590000-0x00000000055A0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 23328e9b2f6d49661725a6f3dd61ff15
SHA1 727cb230b7ba64fa16fcbd8ccb9c2d9df85be0e0
SHA256 e8517ed28ae4810c7c25c2010cf22bcbee71c6ad0a1f5abad55c2dc69dcfd8dd
SHA512 27bb9f0b84ac0294f000021fec6be8bd5cc1ffed8157fbb699c27ecbcdb44c1f94e2eaa2d25362b709b353bad5e2de13e02b639f754dacbb52e8f40c9dba5f23

C:\Users\Admin\AppData\Local\Temp\tempAVSILJ7rBDAIW8M\sqlite3.dll

MD5 2dba09fc0422c6d2080de71015154144
SHA1 db4b373373b164ef2983d5c5e2f13378c826e185
SHA256 4c12096920399a93f97f208a4e222bffe83be9fb5c972a8c7cdd98a3e41c0a34
SHA512 04a9db68ad215334a3c9004848bedbcccb61bf3854ea8ac6f7b1448d43937621743581ac813ce8ee1809d9917f0fedf073d5392ce73b19d25402b03a54c73464

memory/6788-210-0x0000000072550000-0x0000000072D00000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 bc6498c9050fdefdfb86541fb175b18d
SHA1 a0f1bdfc330496cc05a4913afcf29d1afaf48bb5
SHA256 927bc2174fee4bb94d3b2255edb01f5ad526fc782687ce2876221ea49b5b0f79
SHA512 05698776527bbc8c0dab3ca6c6aec5c9b8c1483d77dd72b0f23eb7869527b6171b77132288f1a285953d00c871b0c46a8f3423fed502c1c94b38ec998cbb8e48

memory/5320-204-0x0000000005220000-0x0000000005221000-memory.dmp

memory/5320-202-0x0000000005220000-0x0000000005221000-memory.dmp

memory/5320-198-0x0000000005220000-0x0000000005221000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 0c9313b41619dee96eaaf1c762fee0f0
SHA1 8e3e8e81a317288a25cb18d7d2d606dd01b665b6
SHA256 b7f3832e197a8c0d139f22cb9099aa8a13ecfd125889c294408b98dedc4d6b84
SHA512 c5f660bbe533b5246ff674b25b39eac5656a2dbaa2e69574bfffc50e07ed6390f040911332f999bce30c42c50555bd86c79542d1ef98d4740e92f7271ca32363

memory/5320-161-0x00000000009B0000-0x0000000000A36000-memory.dmp

\??\pipe\LOCAL\crashpad_4744_MRSBXDDBSHCIIKKI

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OF1DB27.exe

MD5 955e21fecf933d4e73987cd4b7b0f68c
SHA1 b8ecb13f3839a9dbd0ad8f2d4af35c33a6627e31
SHA256 e2f8929b85a9e1d6462ee3825e41d0d556c52426961abe62a286709798942ebd
SHA512 aef79ff75b89311a5569dfbcde840f2d6bcaf99eaa2157f7d73a99500cd7e42725d4c837ea7055a6ea602300ee5070e6da5e9cbea8bbe18a3b702e6fdacd231e

C:\Users\Admin\AppData\Local\Temp\5BDA.exe

MD5 9f88bf588a42d1bf13455a9bbbed0fde
SHA1 de1ad1ec22233d8a94df91b52e97436b6a47a2f9
SHA256 b8e98164ba6a727d42d9fc8e63f4bc32cd1f5bbfad2649ed4a4bf0bd2d4df9cc
SHA512 ab421be82659b04fbe1b298f383198e8190eba396c2de6ede39d7ced1dcd6dfa1ffaace635bd313a956bffcc3fc4fe1351f4c70bc0cb218863c7fa944901e8cc

memory/6200-378-0x0000000008390000-0x00000000083AE000-memory.dmp

memory/6200-439-0x00000000088D0000-0x0000000008C24000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Temp\tempAVSILJ7rBDAIW8M\fKZTqZZNfnnbWeb Data

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

C:\Users\Admin\AppData\Local\Temp\tempAVSILJ7rBDAIW8M\xmD4Y1EKhzOcWeb Data

MD5 e89f1951377a1200257f55c5a50ac5ce
SHA1 40702ebc14e4a216e726b0eee06f705ffca8f42d
SHA256 d5f5c44f6e0aad797f11d0421b3d2c3c7cf5a54e5d51e9e8cd3b2c10b8a6709f
SHA512 a2a3c5ed4fcc2bc163fc93db66ff5205e6012626d6f55e434ca27884caafb81775fa3d5b64e8835fbccf6e4daec9639b9d05a1afe05587ae36bdbf51d4e324ef

memory/6200-518-0x0000000004F70000-0x0000000004FD6000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_twitter.com_0.indexeddb.leveldb\MANIFEST-000001

MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_twitter.com_0.indexeddb.leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

MD5 c1ec61ec10a61481a28bdca6bf612845
SHA1 2f6151ba4a46311d2e2f7b69c37b7e7aa7fadc6a
SHA256 ad072ec37f5c118c6b19eb4a48560885c9f2e1c102e2e621aa60b0ea5015dc6e
SHA512 2d776fb78b4c14878416cd01b95e2f3ef1f13c26684cf3bf7543dafe30ffe35ccd224a5771f798a2c619a8a34af2e36a27662c8fe5ff442ee7ad1a21ed105e9a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 46251349c8fc74fbf248f9a807b5cbf4
SHA1 5b0d6c1365835c09cff8a1f5d66e97e9bbbcfbcf
SHA256 54ccb7a1e1c7091ae2fdeaacdbe1d4ccb76bc42160fc37a917976296bec1c7e6
SHA512 fb7696f6d77fd8980633cebf87aa6ffcdd01c6ec0310fcb1af1b3e93d0f2050c9e77e5517f746cdc81a3dc523d130582a528bdf33f7026b3471ac5d1c4613d63

memory/6788-668-0x0000000007C50000-0x0000000007E12000-memory.dmp

memory/6788-673-0x0000000008350000-0x000000000887C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4c3b09ff6012e230501543044587f9ac
SHA1 c7f16d864de8c6dfe3b35beca8bdfceccaeb5ed9
SHA256 d1e3827ccb81d2232bd2dc4eda21806d34d6978d31cb1ac02a9232e37e758650
SHA512 af7b4fc16735fd22dd17b30346bd0e9a48a96d30892027de265bff8f9efaa57b09bddce85209a138eae7464fbb7275f8da387553e3d48acf8340d5133834d325

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 b0ba6f0eee8f998b4d78bc4934f5fd17
SHA1 589653d624de363d3e8869c169441b143c1f39ad
SHA256 4b5ee509e727accbd11493dda2c1d512e7dbfaff66c4f5f7ea9c2d2ccd06151f
SHA512 e9a165da246c6b80fc38431538203cf03f95794184ff63f00c9500f8919a2028b803f64b670e685185eed72df0509e3185c9b434fdbf2bc7af36021d46bd08d9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 0532fa9393225e2a3e3a346e8d420b20
SHA1 adc9057bc8fe9cc5d343bab26432a0520dda84f6
SHA256 60f5bf69f771fb3a0d575f387b587d92943cc9ffbc7c8fceacc260dfb334fdc9
SHA512 3708b677329fae9915351c1f4d14482ba6659c7e60e087c377c2f31d8388f803073ada5e5c34bf1321958ba94f16e1fd2c6019ed94e3a40cd961ba990c88ab27

memory/6788-719-0x00000000071F0000-0x0000000007240000-memory.dmp

memory/6200-720-0x0000000072550000-0x0000000072D00000-memory.dmp

memory/7932-723-0x0000000000B70000-0x0000000000C70000-memory.dmp

memory/7932-729-0x0000000000400000-0x0000000000892000-memory.dmp

memory/7932-726-0x0000000002510000-0x000000000258C000-memory.dmp

memory/5244-736-0x0000000000400000-0x000000000040A000-memory.dmp

memory/7932-734-0x0000000000400000-0x0000000000892000-memory.dmp

memory/6788-738-0x0000000072550000-0x0000000072D00000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

memory/5244-752-0x0000000000400000-0x000000000040A000-memory.dmp

memory/3472-751-0x0000000002BA0000-0x0000000002BB6000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 4173572ca7535161257a5499858efeec
SHA1 d37eae7d504643bbc1d2fddcc59db8bfdc5672d8
SHA256 49b94ff421babd972ae25671feb77c40bdb0f1ebefcd4cd361943be698f1d638
SHA512 919ee6b99f3cecf17f94e14f5ff65104005631e64744c9f45ce8097d8b5473ee1cb09f46df282bdbd6e43c3b4fded03f78021a35f0237e0d2bf663a2d0dbef5a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

memory/3900-786-0x0000000074AB0000-0x0000000075260000-memory.dmp

memory/3900-785-0x0000000000120000-0x00000000005BE000-memory.dmp

memory/3900-788-0x0000000005170000-0x0000000005180000-memory.dmp

memory/3900-787-0x00000000050D0000-0x000000000516C000-memory.dmp

memory/2052-792-0x0000000000D20000-0x0000000001FFE000-memory.dmp

memory/2052-791-0x0000000074AB0000-0x0000000075260000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 78ce8fdb342bf547ff7389b84de8d5f6
SHA1 95a8e896175ef59389d9fe4e9915ac9215737db7
SHA256 f9d2cde89e69fd55e9a32734d406417d1906f25dcab8bb876d4fbf9d318992ca
SHA512 74c0d0e0b2804d5e08f5379ba4ed6f7dd7d5a581867f3430510be336bb96b62d3b409f116f2376632cb27694fc47944dc66dc2c81b0426341f096aace99d7c18

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 305f276f8bf74c2db19225dd162db49d
SHA1 35bdd2237294c0e2f9de625787e9baf642abae1c
SHA256 3fa7dcb1a96a1824d01350ecc3bfb6b22f48a605b6237db8bc7b3dc8c6629cde
SHA512 60442d640d343da01e2653d9101702b50a914988b85ec5ce33088d0a215bedb6864da66769cc73f72746b42be0f532aba73116b3cb8ff656739a71c6baeedf6e

memory/8040-830-0x0000000000B20000-0x0000000000B21000-memory.dmp

memory/3700-836-0x0000000000400000-0x0000000000414000-memory.dmp

memory/6340-838-0x0000000001F10000-0x0000000001F19000-memory.dmp

memory/6340-843-0x0000000000660000-0x0000000000760000-memory.dmp

memory/6424-855-0x0000000000F30000-0x0000000000FB6000-memory.dmp

memory/2052-862-0x0000000074AB0000-0x0000000075260000-memory.dmp

memory/1464-873-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/6424-875-0x0000000074AB0000-0x0000000075260000-memory.dmp

memory/6424-889-0x0000000005880000-0x0000000005890000-memory.dmp

memory/4664-933-0x00000000022B0000-0x00000000022B1000-memory.dmp

memory/548-954-0x0000000000550000-0x0000000000551000-memory.dmp

memory/4664-978-0x0000000004220000-0x0000000004E48000-memory.dmp

memory/6424-1012-0x00000000031B0000-0x00000000031B1000-memory.dmp

memory/6896-981-0x0000000000400000-0x0000000000452000-memory.dmp

memory/4664-1020-0x0000000004F50000-0x0000000004F8A000-memory.dmp

memory/3900-911-0x0000000074AB0000-0x0000000075260000-memory.dmp

memory/4664-872-0x0000000010000000-0x000000001001B000-memory.dmp

memory/1464-861-0x0000000002EF0000-0x00000000037DB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nszDE3.tmp\INetC.dll

MD5 40d7eca32b2f4d29db98715dd45bfac5
SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

memory/1464-854-0x0000000002AF0000-0x0000000002EEE000-memory.dmp

memory/6548-848-0x0000000000400000-0x0000000000409000-memory.dmp

memory/6548-846-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\etopt.exe

MD5 a0f6a5b9b98e95db048f5a316e4d1ced
SHA1 bdafbe9e2657c8d8539c536ddfc95a578da46fe0
SHA256 7548722969b93bf097d8be9ffc6a072001823905d4f467b617ccaceea5ebb6d2
SHA512 ad581acdc51760d24bf76f9c4ae68d9245eb4483fd1b49223389cdffe10ac93893c143f60200cd42fa4101edba90414eaf88151a9962c31d4e48bbab30a570aa

C:\Users\Admin\AppData\Local\Temp\tuc4.exe

MD5 52f88f2bcf526c6e58bf1d019addf535
SHA1 25cd57772394f30802ccde606b2f24f723d77ac4
SHA256 fccbfa59e761ad2929520bb3149a7f82ce19be508cf87d0513555eebd89e5165
SHA512 1885287a36df954975df974eba8f062a301aec3829760c27ff9e9bbd65d9c4f202673fd8dd8e62f81a474a639464de730125ea1b1a9153bc824d58131f3a6b69

C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe

MD5 45256e54e051379c101091f07fa701b4
SHA1 399c87e5b9984f336827c5425e187d0a2303efe2
SHA256 1ef0cce07e2d3ac879cf1c19112ae789d455d66f097eb912be48aa348271705a
SHA512 7224dabf6f56c4dc39834e4f175651d2f336eec1d40c2e5c726af647b5734d393b0a87310bf0a8cdede91c2bd64f465d474564f51b4fbdba5254cd7d952b45f3

C:\Users\Admin\AppData\Local\Temp\1F7E.exe

MD5 42820cef3ae5e4d957b11127304525a1
SHA1 67c0d4038e4d3ffd0e9f7bba5a37b0fab2abca11
SHA256 bce40e37bee9b70293b7361b839e8e737c4b55015c18079cf2c8825182f051ec
SHA512 888fe54b57052626746c13be9ed25a49dbaebbefc1be8b1f6aaa69c2c92abb9126e6f29e720a28136ec2dc3909b3dbcaee5b7ed5a168417407cff795b490e2cb

C:\Users\Admin\AppData\Local\Temp\nsg11F9.tmp\Zip.dll

MD5 fbf821d5ce78e34ac81fd4d6981d7a41
SHA1 c6d2ee9a5d93750a21f5d2ebac737a58f025bd97
SHA256 80751e2c11cbf5b450ffa8f8b878a31a2614241deb1e4ebdd4b7ecaabf55f291
SHA512 17757baf0c123315cf37d36408abacd9bdacc6a3e99dde2e5b74dc9594f750d28b6316b04aa774103bb94593cab707c9f2d12dd23ce2f8b9c7e6f86429e1bfc7

C:\Users\Admin\AppData\Local\Temp\nsg11F9.tmp\Checker.dll

MD5 577a3cbf7a2a6c8190fc1dca9f34371c
SHA1 d05f45f3efd391e927e7c6f59a3a10189e1eb003
SHA256 67b2397abf2775087777fcaa3a8e81c8b4f90a623a4081ccd141ee000bd5882b
SHA512 3692ea59cc1a34fefc10c45f446c47321ae3bf39d5680d6b60a857631dda630887c0c61c0fcd0a240f8e69f80d88833569463d29293ad11f3ad8fd0ef8277202

memory/3472-1296-0x0000000008960000-0x0000000008976000-memory.dmp

memory/5276-1293-0x0000000000400000-0x000000000043C000-memory.dmp

memory/6548-1305-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1124-1307-0x0000000000400000-0x0000000000892000-memory.dmp

memory/5788-1312-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\ProgramData\KJKKJKEHDBGIDGDHCFHI

MD5 3991f2525efbd751ec3ba4bbc663bd9c
SHA1 85c8a86b8b348ac397635129b284e6d61a5c621e
SHA256 3eadf62cd38f53c8a6afac831c460d2d1304defee367d551d28c0e3cac085170
SHA512 8321cea0af0ed5a505c6f3b71a654d92c624857c1a501a3162bdb146cedf95d62ef84da3dcd11a84d1c3d366450aff294ee439722649d33d5afceb4d97024a04

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_03cy20pm.ugp.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\ProgramData\CBAFCAKEHDHDHIDHDGDHJEGHID

MD5 09ffdef30931df2e6af7a0d7278e6549
SHA1 e9dca901bafef510c1615fc90aba1ee5282dc0ef
SHA256 787731580f8b7ce70ca8b1a3341c14c7d73c58c6acc3dc7d7955fc987f865700
SHA512 1b1598fce8140c304323c74dbd78ea819b438d95cdd106df0d1a7767792e701a503a3afcd6fb1101706716abd0977d566b451440d932acce376f2e5f08b0c4c9

C:\ProgramData\mozglue.dll

MD5 e94570813b85cb9bb4d3e8b445c798c6
SHA1 b9fa33a0fd13d0e30605235aab4d0c915930528e
SHA256 3910a962de38ada96c8016da62e95b266ebc9f31f5bf01a2320aa10139a00914
SHA512 a258affabfde797cc35ec822dffe9f56be8e17513eb50c55961c9ebab2d982804c2fca6a26588a241dab8d2ec1dff1f21aa483ea13f7a583262ba9959e3cd5aa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7a3e7568-d10a-4a99-8e82-ecd490b9f383.tmp

MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f23b2038023f5da133b453fd97b4a079
SHA1 12fcf9041ecc74eb5c376baeffc1b09d357aad3a
SHA256 f90431211aaa9aae84f903ebd39b79fee6247ad63647884f73bd5406bf69e9ed
SHA512 07f4560cf0bde576c3000af705035518c25ac124f9c2dabab1cf13b3974b3d5f5c5137a1d8904b8e012b767c6daf98e548507269952b1d5c2b37daad2501e12c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 66be1b4a5feb0bf7c279997ebaa66808
SHA1 18583e9c93a6df3d376d31aa973e828380b89df0
SHA256 77818002ea2f6902f3f0193e09e29630ed251430183dd3a16f9ea68bf9925b3e
SHA512 fcd7d2139df763f82f8e3a145050a6f0d29199ac5a8c95cdafb76dbfc64be0c7c8a7b179d9dbf44c50d0e0ac15575d419ecc6910c1730ef4dc270a6e7722247c

C:\ProgramData\Are.docx

MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 589c49f8a8e18ec6998a7a30b4958ebc
SHA1 cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e
SHA256 26d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8
SHA512 e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b08cb81574ccfff7f23282ab51580d8f
SHA1 8491ace237f39e6b819549b5d0ac022de4ed2c72
SHA256 f9e83754b17be1b0c56c0f38912865ee57aa54055af15a72c2da7157297ce1e4
SHA512 202794ce66bc97891af5f4bfd1c454183c8742e2b2b78b9ebee0361bee36163f8cfbbe793c16cbd9f5bf2ae29e9c397042f8cc4e9387a28749be3802554f3cbb