Malware Analysis Report

2024-11-16 15:58

Sample ID 240212-fj8gbsdf73
Target 597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d
SHA256 597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d
Tags
amadey evasion trojan asyncrat djvu redline risepro sectoprat google discovery infostealer persistence phishing ransomware rat spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d

Threat Level: Known bad

The file 597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d was found to be: Known bad.

Malicious Activity Summary

amadey evasion trojan asyncrat djvu redline risepro sectoprat google discovery infostealer persistence phishing ransomware rat spyware stealer

RedLine payload

RisePro

Detected google phishing page

Amadey

SectopRAT

AsyncRat

Djvu Ransomware

SectopRAT payload

RedLine

Async RAT payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Modifies Windows Firewall

Downloads MZ/PE file

Blocklisted process makes network request

Modifies file permissions

Reads user/profile data of web browsers

Checks BIOS information in registry

Checks computer location settings

Reads local data of messenger clients

Identifies Wine through registry keys

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

Adds Run key to start application

AutoIT Executable

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

Launches sc.exe

Unsigned PE

Program crash

Enumerates physical storage devices

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Delays execution with timeout.exe

Modifies Internet Explorer settings

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Modifies data under HKEY_USERS

Modifies registry class

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-12 04:55

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-12 04:55

Reported

2024-02-12 05:00

Platform

win7-20231215-en

Max time kernel

119s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d.exe"

Signatures

Amadey

trojan amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\explorgu.job C:\Users\Admin\AppData\Local\Temp\597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d.exe

"C:\Users\Admin\AppData\Local\Temp\597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d.exe"

Network

N/A

Files

memory/2092-0-0x0000000000F20000-0x00000000013CA000-memory.dmp

memory/2092-1-0x00000000775B0000-0x00000000775B2000-memory.dmp

memory/2092-14-0x00000000027E0000-0x00000000027E1000-memory.dmp

memory/2092-13-0x00000000008D0000-0x00000000008D1000-memory.dmp

memory/2092-12-0x0000000000C20000-0x0000000000C21000-memory.dmp

memory/2092-11-0x0000000000B00000-0x0000000000B01000-memory.dmp

memory/2092-10-0x0000000002C40000-0x0000000002C41000-memory.dmp

memory/2092-9-0x0000000000D50000-0x0000000000D51000-memory.dmp

memory/2092-8-0x0000000000D40000-0x0000000000D41000-memory.dmp

memory/2092-7-0x0000000000B10000-0x0000000000B11000-memory.dmp

memory/2092-6-0x0000000002D50000-0x0000000002D51000-memory.dmp

memory/2092-5-0x00000000027D0000-0x00000000027D1000-memory.dmp

memory/2092-4-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

memory/2092-3-0x0000000002930000-0x0000000002931000-memory.dmp

memory/2092-2-0x0000000000F20000-0x00000000013CA000-memory.dmp

memory/2092-16-0x0000000002D60000-0x0000000002D61000-memory.dmp

memory/2092-15-0x0000000000D30000-0x0000000000D31000-memory.dmp

memory/2092-18-0x00000000008E0000-0x00000000008E1000-memory.dmp

memory/2092-19-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

memory/2092-23-0x0000000000F20000-0x00000000013CA000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-12 04:55

Reported

2024-02-12 05:00

Platform

win10-20231215-en

Max time kernel

98s

Max time network

311s

Command Line

"C:\Users\Admin\AppData\Local\Temp\597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d.exe"

Signatures

Amadey

trojan amadey

AsyncRat

rat asyncrat

Detected google phishing page

phishing google

Djvu Ransomware

ransomware djvu

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

RisePro

stealer risepro

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000032001\ladas.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000032001\ladas.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000032001\ladas.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000\Control Panel\International\Geo\Nation C:\Windows\system32\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000032001\ladas.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Reads local data of messenger clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000\Software\Microsoft\Windows\CurrentVersion\Run\fu.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000031001\\fu.exe" C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000\Software\Microsoft\Windows\CurrentVersion\Run\ladas.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000032001\\ladas.exe" C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000\Software\Microsoft\Windows\CurrentVersion\Run\dota.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000225001\\dota.exe" C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rescache\_merged\3720402701\2219095117.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
File created C:\Windows\rescache\_merged\3720402701\2219095117.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
File created C:\Windows\rescache\_merged\3720402701\2219095117.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
File created C:\Windows\Tasks\explorgu.job C:\Users\Admin\AppData\Local\Temp\597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d.exe N/A
File created C:\Windows\rescache\_merged\3720402701\2219095117.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
File opened for modification C:\Windows\Debug\ESE.TXT C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
File created C:\Windows\rescache\_merged\3720402701\2219095117.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
File created C:\Windows\rescache\_merged\3720402701\2219095117.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
File created C:\Windows\rescache\_merged\3720402701\2219095117.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
File created C:\Windows\rescache\_merged\3720402701\2219095117.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
File created C:\Windows\rescache\_merged\3720402701\2219095117.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\nine.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\36E0.exe

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\system32\browser_broker.exe N/A
Key created \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133521874212143589" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\facebook.com\ = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a03b57ca6f5dda01 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = e05eece46f5dda01 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.linkedin.com\ = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.linkedin.com C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{87446D6C-CE72-46C1-8475-CBEC97674602} = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\google.com\NumberOfSubdomai = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\linkedin.com\NumberOfSubdomain = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\facebook.com C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\accounts.google.com\ = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164C = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.com C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f73f17e56f5dda01 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 984f4bca6f5dda01 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000032001\ladas.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000032001\ladas.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4076 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4076 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4076 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4076 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe
PID 4076 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe
PID 4076 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe
PID 4076 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe C:\Users\Admin\AppData\Local\Temp\1000032001\ladas.exe
PID 4076 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe C:\Users\Admin\AppData\Local\Temp\1000032001\ladas.exe
PID 4076 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe C:\Users\Admin\AppData\Local\Temp\1000032001\ladas.exe
PID 4076 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe C:\Users\Admin\AppData\Local\Temp\1000225001\dota.exe
PID 4076 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe C:\Users\Admin\AppData\Local\Temp\1000225001\dota.exe
PID 4076 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe C:\Users\Admin\AppData\Local\Temp\1000225001\dota.exe
PID 2076 wrote to memory of 2620 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2076 wrote to memory of 2620 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2076 wrote to memory of 2620 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 4076 wrote to memory of 5356 N/A C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe C:\Windows\SysWOW64\rundll32.exe
PID 4076 wrote to memory of 5356 N/A C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe C:\Windows\SysWOW64\rundll32.exe
PID 4076 wrote to memory of 5356 N/A C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe C:\Windows\SysWOW64\rundll32.exe
PID 5356 wrote to memory of 5440 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 5356 wrote to memory of 5440 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 5440 wrote to memory of 5592 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\netsh.exe
PID 5440 wrote to memory of 5592 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\netsh.exe
PID 2076 wrote to memory of 2808 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2076 wrote to memory of 2808 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2076 wrote to memory of 2808 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 5440 wrote to memory of 5680 N/A C:\Windows\system32\rundll32.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5440 wrote to memory of 5680 N/A C:\Windows\system32\rundll32.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2076 wrote to memory of 2808 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2076 wrote to memory of 2808 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2076 wrote to memory of 2808 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2076 wrote to memory of 2808 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2076 wrote to memory of 2808 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2076 wrote to memory of 2808 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 1576 wrote to memory of 5696 N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1576 wrote to memory of 5696 N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2764 wrote to memory of 5968 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2764 wrote to memory of 5968 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5968 wrote to memory of 2252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5968 wrote to memory of 2252 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4076 wrote to memory of 5640 N/A C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe C:\Windows\SysWOW64\rundll32.exe
PID 4076 wrote to memory of 5640 N/A C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe C:\Windows\SysWOW64\rundll32.exe
PID 4076 wrote to memory of 5640 N/A C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe C:\Windows\SysWOW64\rundll32.exe
PID 2076 wrote to memory of 3884 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2076 wrote to memory of 3884 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2076 wrote to memory of 3884 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2076 wrote to memory of 3884 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2076 wrote to memory of 3884 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 2076 wrote to memory of 3884 N/A C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
PID 5696 wrote to memory of 5784 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5696 wrote to memory of 5784 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1576 wrote to memory of 5984 N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1576 wrote to memory of 5984 N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5984 wrote to memory of 3876 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5984 wrote to memory of 3876 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1576 wrote to memory of 5492 N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1576 wrote to memory of 5492 N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5492 wrote to memory of 6140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5492 wrote to memory of 6140 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1576 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 1576 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4808 wrote to memory of 5916 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4808 wrote to memory of 5916 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4808 wrote to memory of 5916 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe
PID 4808 wrote to memory of 5916 N/A C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d.exe

"C:\Users\Admin\AppData\Local\Temp\597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d.exe"

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000030041\do.ps1"

C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe

"C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe"

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca

C:\Windows\system32\browser_broker.exe

C:\Windows\system32\browser_broker.exe -Embedding

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Users\Admin\AppData\Local\Temp\1000032001\ladas.exe

"C:\Users\Admin\AppData\Local\Temp\1000032001\ladas.exe"

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Users\Admin\AppData\Local\Temp\1000225001\dota.exe

"C:\Users\Admin\AppData\Local\Temp\1000225001\dota.exe"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main

C:\Windows\system32\netsh.exe

netsh wlan show profiles

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\353990536982_Desktop.zip' -CompressionLevel Optimal

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe8a229758,0x7ffe8a229768,0x7ffe8a229778

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe8a229758,0x7ffe8a229768,0x7ffe8a229778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/video

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe8a229758,0x7ffe8a229768,0x7ffe8a229778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe8a229758,0x7ffe8a229768,0x7ffe8a229778

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5916.0.1585548357\1656962714" -parentBuildID 20221007134813 -prefsHandle 1640 -prefMapHandle 1628 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {63e30c7f-a609-4a5b-b23d-ef0aebc20fc6} 5916 "\\.\pipe\gecko-crash-server-pipe.5916" 1724 16ce62d3758 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5916.1.1571560252\1038392408" -parentBuildID 20221007134813 -prefsHandle 2096 -prefMapHandle 2092 -prefsLen 21608 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {39815731-dcae-4aad-95d8-d324aa032c04} 5916 "\\.\pipe\gecko-crash-server-pipe.5916" 2132 16cdb76fb58 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5916.2.2086143886\1332010450" -childID 1 -isForBrowser -prefsHandle 3188 -prefMapHandle 3184 -prefsLen 21646 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {62ab9969-5ead-4d7a-9879-0f21943a72d4} 5916 "\\.\pipe\gecko-crash-server-pipe.5916" 3296 16ce9fc8a58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5916.3.349279567\841550677" -childID 2 -isForBrowser -prefsHandle 2676 -prefMapHandle 2648 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {353fcd9e-5f3a-42ca-a5af-e161e8f0cf95} 5916 "\\.\pipe\gecko-crash-server-pipe.5916" 2608 16cdb75f258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5916.4.1800220556\1183174200" -childID 3 -isForBrowser -prefsHandle 3964 -prefMapHandle 3960 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6567a72b-6c4f-4155-b930-fa194b3baf3f} 5916 "\\.\pipe\gecko-crash-server-pipe.5916" 3596 16ceb059258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5916.5.518221775\741192162" -childID 4 -isForBrowser -prefsHandle 4068 -prefMapHandle 4072 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {73fa406f-5fd3-460c-a8e8-2db048607cb2} 5916 "\\.\pipe\gecko-crash-server-pipe.5916" 4056 16ceba99958 tab

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1788 --field-trial-handle=1836,i,17207766418948515388,11053941992561804729,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1836,i,17207766418948515388,11053941992561804729,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 --field-trial-handle=1840,i,15194438964178609084,10667210487684685868,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 --field-trial-handle=1840,i,15194438964178609084,10667210487684685868,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1728 --field-trial-handle=1848,i,14277564687589475876,13660045396595049746,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1848,i,14277564687589475876,13660045396595049746,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1848 --field-trial-handle=1952,i,15182774059411817993,14705455942930660961,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1792 --field-trial-handle=1952,i,15182774059411817993,14705455942930660961,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1952,i,15182774059411817993,14705455942930660961,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.linkedin.com/login

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe8a229758,0x7ffe8a229768,0x7ffe8a229778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2960 --field-trial-handle=1952,i,15182774059411817993,14705455942930660961,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3380 --field-trial-handle=1952,i,15182774059411817993,14705455942930660961,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3716 --field-trial-handle=1952,i,15182774059411817993,14705455942930660961,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3848 --field-trial-handle=1952,i,15182774059411817993,14705455942930660961,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3712 --field-trial-handle=1952,i,15182774059411817993,14705455942930660961,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2952 --field-trial-handle=1952,i,15182774059411817993,14705455942930660961,131072 /prefetch:1

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5916.6.115704787\1569316430" -childID 5 -isForBrowser -prefsHandle 4140 -prefMapHandle 4144 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e88e6c92-249d-46cf-9ab2-7671234986a4} 5916 "\\.\pipe\gecko-crash-server-pipe.5916" 4128 16cec16dc58 tab

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5064 --field-trial-handle=1952,i,15182774059411817993,14705455942930660961,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4828 --field-trial-handle=1952,i,15182774059411817993,14705455942930660961,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5300 --field-trial-handle=1952,i,15182774059411817993,14705455942930660961,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3024 --field-trial-handle=1952,i,15182774059411817993,14705455942930660961,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4352 --field-trial-handle=1952,i,15182774059411817993,14705455942930660961,131072 /prefetch:8

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.linkedin.com/login

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.linkedin.com/login

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5916.7.113178188\1018526958" -childID 6 -isForBrowser -prefsHandle 3020 -prefMapHandle 3048 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {382af31d-b64e-489c-8d64-fd4d603f46c9} 5916 "\\.\pipe\gecko-crash-server-pipe.5916" 4712 16cdb761458 tab

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/login

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe8a229758,0x7ffe8a229768,0x7ffe8a229778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2996 --field-trial-handle=1952,i,15182774059411817993,14705455942930660961,131072 /prefetch:1

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/login

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/login

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5916.8.2073618395\873797337" -childID 7 -isForBrowser -prefsHandle 5472 -prefMapHandle 4100 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3256d275-dafb-4813-8d1f-9ac0e3c151e0} 5916 "\\.\pipe\gecko-crash-server-pipe.5916" 5016 16cdb763558 tab

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe8a229758,0x7ffe8a229768,0x7ffe8a229778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4420 --field-trial-handle=1952,i,15182774059411817993,14705455942930660961,131072 /prefetch:1

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5916.9.364705014\1232183218" -childID 8 -isForBrowser -prefsHandle 4432 -prefMapHandle 5728 -prefsLen 26424 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {88510e63-bb3b-4f98-87b1-8a42483db366} 5916 "\\.\pipe\gecko-crash-server-pipe.5916" 2652 16cedf24158 tab

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6340 --field-trial-handle=1952,i,15182774059411817993,14705455942930660961,131072 /prefetch:8

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6684 --field-trial-handle=1952,i,15182774059411817993,14705455942930660961,131072 /prefetch:8

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6392 --field-trial-handle=1952,i,15182774059411817993,14705455942930660961,131072 /prefetch:8

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5916.10.1993836658\688146196" -childID 9 -isForBrowser -prefsHandle 6044 -prefMapHandle 6040 -prefsLen 26798 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {67c758d8-1e63-4d2d-89a1-0ec443fd7cc3} 5916 "\\.\pipe\gecko-crash-server-pipe.5916" 6052 16ced612b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5916.12.163778197\1373057137" -childID 11 -isForBrowser -prefsHandle 6320 -prefMapHandle 6324 -prefsLen 26798 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {020cdac9-6054-429e-a378-28c5a9f352c2} 5916 "\\.\pipe\gecko-crash-server-pipe.5916" 6316 16ced321d58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5916.11.506823154\1169112562" -childID 10 -isForBrowser -prefsHandle 5956 -prefMapHandle 5984 -prefsLen 26798 -prefMapSize 233444 -jsInitHandle 1224 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {54d923d6-ef40-4533-be49-881f800493ce} 5916 "\\.\pipe\gecko-crash-server-pipe.5916" 5180 16ced7add58 tab

C:\Users\Admin\AppData\Local\Temp\1000237001\dayroc.exe

"C:\Users\Admin\AppData\Local\Temp\1000237001\dayroc.exe"

C:\Users\Admin\AppData\Local\Temp\nine.exe

"C:\Users\Admin\AppData\Local\Temp\nine.exe"

C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe

"C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8556 -s 488

C:\Users\Admin\AppData\Local\Temp\toolspub1.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8724 -s 384

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8724 -s 388

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8724 -s 400

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8724 -s 620

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8724 -s 656

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8724 -s 692

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8724 -s 744

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8724 -s 784

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8724 -s 840

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8724 -s 876

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8724 -s 552

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8724 -s 836

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8724 -s 684

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8724 -s 796

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8724 -s 672

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8724 -s 696

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8724 -s 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8724 -s 824

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8724 -s 836

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\1000238001\monetkamoya.exe

"C:\Users\Admin\AppData\Local\Temp\1000238001\monetkamoya.exe"

C:\Users\Admin\AppData\Local\Temp\1000244001\goldpricem12334.exe

"C:\Users\Admin\AppData\Local\Temp\1000244001\goldpricem12334.exe"

C:\Users\Admin\AppData\Local\Temp\1000245001\daissss.exe

"C:\Users\Admin\AppData\Local\Temp\1000245001\daissss.exe"

C:\Users\Admin\AppData\Local\Temp\1000246001\newfilelunacy.exe

"C:\Users\Admin\AppData\Local\Temp\1000246001\newfilelunacy.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000247001\lumma123142124.exe

"C:\Users\Admin\AppData\Local\Temp\1000247001\lumma123142124.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8612 -s 572

C:\Users\Admin\AppData\Local\Temp\1000248001\new.exe

"C:\Users\Admin\AppData\Local\Temp\1000248001\new.exe"

C:\Windows\system32\dialer.exe

"C:\Windows\system32\dialer.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe

"C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 352

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 372

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 424

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 616

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 668

C:\Windows\system32\browser_broker.exe

C:\Windows\system32\browser_broker.exe -Embedding

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 596

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 708

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 568

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 1172

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\browser_broker.exe

C:\Windows\system32\browser_broker.exe -Embedding

C:\Windows\system32\browser_broker.exe

C:\Windows\system32\browser_broker.exe -Embedding

C:\Windows\System32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\36E0.exe

C:\Users\Admin\AppData\Local\Temp\36E0.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 492

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Users\Admin\AppData\Local\Temp\4C0F.exe

C:\Users\Admin\AppData\Local\Temp\4C0F.exe

C:\Users\Admin\AppData\Local\Temp\4C0F.exe

C:\Users\Admin\AppData\Local\Temp\4C0F.exe

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\98f482ba-9a60-4891-878d-258fb1258e3b" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\4C0F.exe

"C:\Users\Admin\AppData\Local\Temp\4C0F.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\4C0F.exe

"C:\Users\Admin\AppData\Local\Temp\4C0F.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\8dd95364-4324-488e-9b4c-315dd93eac05\build2.exe

"C:\Users\Admin\AppData\Local\8dd95364-4324-488e-9b4c-315dd93eac05\build2.exe"

C:\Users\Admin\AppData\Local\8dd95364-4324-488e-9b4c-315dd93eac05\build2.exe

"C:\Users\Admin\AppData\Local\8dd95364-4324-488e-9b4c-315dd93eac05\build2.exe"

C:\Users\Admin\AppData\Local\8dd95364-4324-488e-9b4c-315dd93eac05\build3.exe

"C:\Users\Admin\AppData\Local\8dd95364-4324-488e-9b4c-315dd93eac05\build3.exe"

C:\Users\Admin\AppData\Local\8dd95364-4324-488e-9b4c-315dd93eac05\build3.exe

"C:\Users\Admin\AppData\Local\8dd95364-4324-488e-9b4c-315dd93eac05\build3.exe"

C:\Windows\SysWOW64\schtasks.exe

/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Users\Admin\AppData\Local\Temp\1000250001\for.exe

"C:\Users\Admin\AppData\Local\Temp\1000250001\for.exe"

C:\Users\Admin\AppData\Local\Temp\F1F5.exe

C:\Users\Admin\AppData\Local\Temp\F1F5.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Roaming\configurationValue\bott.exe

"C:\Users\Admin\AppData\Roaming\configurationValue\bott.exe"

C:\Users\Admin\AppData\Roaming\configurationValue\STAR.exe

"C:\Users\Admin\AppData\Roaming\configurationValue\STAR.exe"

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\203.bat" "

C:\Users\Admin\AppData\Local\Temp\B2C.exe

C:\Users\Admin\AppData\Local\Temp\B2C.exe

C:\Windows\system32\reg.exe

reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1

C:\Users\Admin\AppData\Local\Temp\19D3.exe

C:\Users\Admin\AppData\Local\Temp\19D3.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

C:\Windows\system32\browser_broker.exe

C:\Windows\system32\browser_broker.exe -Embedding

C:\Windows\system32\browser_broker.exe

C:\Windows\system32\browser_broker.exe -Embedding

C:\Windows\system32\browser_broker.exe

C:\Windows\system32\browser_broker.exe -Embedding

C:\Windows\system32\browser_broker.exe

C:\Windows\system32\browser_broker.exe -Embedding

C:\Windows\system32\browser_broker.exe

C:\Windows\system32\browser_broker.exe -Embedding

C:\Windows\system32\browser_broker.exe

C:\Windows\system32\browser_broker.exe -Embedding

C:\Windows\system32\browser_broker.exe

C:\Windows\system32\browser_broker.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\adasda.exe

"C:\Users\Admin\AppData\Local\Temp\adasda.exe"

C:\Users\Admin\AppData\Local\Temp\asdjijjjjj.exe

"C:\Users\Admin\AppData\Local\Temp\asdjijjjjj.exe"

C:\Windows\system32\browser_broker.exe

C:\Windows\system32\browser_broker.exe -Embedding

C:\Windows\system32\browser_broker.exe

C:\Windows\system32\browser_broker.exe -Embedding

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"

C:\Windows\system32\browser_broker.exe

C:\Windows\system32\browser_broker.exe -Embedding

C:\Windows\system32\browser_broker.exe

C:\Windows\system32\browser_broker.exe -Embedding

C:\Windows\SysWOW64\choice.exe

choice /C Y /N /D Y /T 3

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "chromeupdate" /tr '"C:\Users\Admin\AppData\Roaming\chromeupdate.exe"' & exit

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9660.tmp.bat""

C:\Windows\system32\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "chromeupdate" /tr '"C:\Users\Admin\AppData\Roaming\chromeupdate.exe"'

C:\Windows\system32\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\chromeupdate.exe

"C:\Users\Admin\AppData\Roaming\chromeupdate.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

C:\Windows\SysWOW64\schtasks.exe

/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

C:\Users\Admin\AppData\Roaming\fdtegcc

C:\Users\Admin\AppData\Roaming\fdtegcc

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

C:\Users\Admin\AppData\Local\Temp\1000252001\Amadey.exe

"C:\Users\Admin\AppData\Local\Temp\1000252001\Amadey.exe"

Network

Country Destination Domain Proto
RU 185.215.113.32:80 185.215.113.32 tcp
US 8.8.8.8:53 32.113.215.185.in-addr.arpa udp
RU 193.233.132.167:80 193.233.132.167 tcp
US 8.8.8.8:53 167.132.233.193.in-addr.arpa udp
US 8.8.8.8:53 www.youtube.com udp
GB 142.250.200.14:443 www.youtube.com tcp
GB 142.250.200.14:443 www.youtube.com tcp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 www.facebook.com udp
FI 109.107.182.3:80 tcp
US 8.8.8.8:53 www.linkedin.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 i.ytimg.com udp
GB 216.58.212.246:443 i.ytimg.com tcp
GB 216.58.212.246:443 i.ytimg.com tcp
GB 163.70.151.35:443 www.facebook.com tcp
GB 163.70.151.35:443 www.facebook.com tcp
US 13.107.42.14:443 www.linkedin.com tcp
US 13.107.42.14:443 www.linkedin.com tcp
US 8.8.8.8:53 246.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 234.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.151.70.163.in-addr.arpa udp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
US 8.8.8.8:53 14.42.107.13.in-addr.arpa udp
US 8.8.8.8:53 84.27.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 m.facebook.com udp
GB 163.70.147.35:443 m.facebook.com tcp
GB 163.70.147.35:443 m.facebook.com tcp
US 8.8.8.8:53 static.licdn.com udp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
US 8.8.8.8:53 35.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 88.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
RU 185.215.113.32:80 185.215.113.32 tcp
US 8.8.8.8:53 facebook.com udp
GB 163.70.147.23:443 static.xx.fbcdn.net tcp
GB 163.70.147.23:443 static.xx.fbcdn.net tcp
GB 163.70.147.23:443 static.xx.fbcdn.net tcp
GB 163.70.147.23:443 static.xx.fbcdn.net tcp
GB 163.70.147.23:443 static.xx.fbcdn.net tcp
GB 163.70.147.23:443 static.xx.fbcdn.net tcp
GB 163.70.147.35:443 facebook.com tcp
GB 163.70.147.35:443 facebook.com tcp
US 8.8.8.8:53 3.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 23.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 129.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 fbcdn.net udp
GB 163.70.147.35:443 fbcdn.net tcp
GB 163.70.147.35:443 fbcdn.net tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
US 8.8.8.8:53 fbsbx.com udp
GB 163.70.147.35:443 fbsbx.com tcp
GB 163.70.147.35:443 fbsbx.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.178.4:443 www.google.com tcp
GB 142.250.178.4:443 www.google.com tcp
US 8.8.8.8:53 accounts.youtube.com udp
GB 172.217.16.238:443 accounts.youtube.com tcp
GB 172.217.16.238:443 accounts.youtube.com tcp
RU 185.215.113.32:80 185.215.113.32 tcp
US 8.8.8.8:53 4.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 scontent.xx.fbcdn.net udp
GB 163.70.147.23:443 scontent.xx.fbcdn.net tcp
GB 163.70.147.23:443 scontent.xx.fbcdn.net tcp
GB 163.70.147.23:443 scontent.xx.fbcdn.net tcp
GB 163.70.147.23:443 scontent.xx.fbcdn.net tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
GB 142.250.200.14:443 www.youtube.com tcp
FI 109.107.182.3:80 tcp
US 8.8.8.8:53 youtube-ui.l.google.com udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 youtube-ui.l.google.com udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 8.8.8.8:53 star-mini.c10r.facebook.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 star-mini.c10r.facebook.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 34.160.144.191:443 prod.content-signature-chains.prod.webservices.mozgcp.net tcp
GB 163.70.151.35:443 www.facebook.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
US 34.117.237.239:443 contile.services.mozilla.com tcp
US 52.24.144.241:443 shavar.prod.mozaws.net tcp
US 34.107.243.93:443 autopush.prod.mozaws.net tcp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
GB 142.250.200.14:443 youtube-ui.l.google.com udp
NL 142.250.27.84:443 accounts.google.com udp
US 8.8.8.8:53 241.144.24.52.in-addr.arpa udp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 www.linkedin.com udp
GB 163.70.151.35:443 www.facebook.com udp
US 8.8.8.8:53 example.org udp
US 8.8.8.8:53 ipv4only.arpa udp
GB 157.240.221.35:443 www.facebook.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
GB 142.250.200.14:443 www.youtube.com tcp
US 13.107.42.14:443 www.linkedin.com tcp
US 8.8.8.8:53 watson.telemetry.microsoft.com udp
US 20.42.65.92:443 watson.telemetry.microsoft.com tcp
US 8.8.8.8:53 detectportal.firefox.com udp
US 8.8.8.8:53 prod.detectportal.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.detectportal.prod.cloudops.mozgcp.net udp
US 34.107.221.82:80 prod.detectportal.prod.cloudops.mozgcp.net tcp
GB 142.250.200.14:443 www.youtube.com udp
US 8.8.8.8:53 35.221.240.157.in-addr.arpa udp
US 8.8.8.8:53 67.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 92.65.42.20.in-addr.arpa udp
US 8.8.8.8:53 82.221.107.34.in-addr.arpa udp
NL 142.250.27.84:443 accounts.google.com udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 8.8.8.8:53 static.licdn.com udp
US 8.8.8.8:53 i.ytimg.com udp
GB 216.58.212.246:443 i.ytimg.com tcp
GB 163.70.147.23:443 static.xx.fbcdn.net tcp
GB 163.70.147.23:443 static.xx.fbcdn.net tcp
GB 163.70.147.23:443 static.xx.fbcdn.net tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
GB 88.221.134.88:443 static.licdn.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
US 8.8.8.8:53 platform.linkedin.com udp
GB 88.221.134.88:443 platform.linkedin.com tcp
GB 88.221.134.88:443 platform.linkedin.com tcp
US 8.8.8.8:53 content-autofill.googleapis.com udp
US 8.8.8.8:53 ponf.linkedin.com udp
US 144.2.9.1:443 ponf.linkedin.com tcp
US 8.8.8.8:53 platform.linkedin.com udp
GB 88.221.134.88:443 platform.linkedin.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 stun.l.google.com udp
GB 142.250.144.127:19302 stun.l.google.com udp
GB 142.250.144.127:19302 stun.l.google.com udp
US 13.107.42.14:443 www.linkedin.com tcp
US 8.8.8.8:53 l-0005.l-msedge.net udp
US 8.8.8.8:53 l-0005.l-msedge.net udp
GB 142.250.200.14:443 www.youtube.com tcp
GB 142.250.200.14:443 www.youtube.com tcp
US 8.8.8.8:53 1.9.2.144.in-addr.arpa udp
US 8.8.8.8:53 127.144.250.142.in-addr.arpa udp
GB 157.240.221.35:443 www.facebook.com udp
GB 163.70.147.23:443 static.xx.fbcdn.net udp
US 8.8.8.8:53 static.licdn.com udp
US 8.8.8.8:53 161.19.199.152.in-addr.arpa udp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
GB 216.58.212.246:443 i.ytimg.com tcp
GB 216.58.212.246:443 i.ytimg.com tcp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
US 8.8.8.8:53 a1916.dscg2.akamai.net udp
US 8.8.8.8:53 a1916.dscg2.akamai.net udp
GB 163.70.147.23:443 static.xx.fbcdn.net udp
US 8.8.8.8:53 facebook.com udp
GB 163.70.147.35:443 facebook.com tcp
US 8.8.8.8:53 104.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 ponf.linkedin.com udp
US 144.2.9.1:443 ponf.linkedin.com tcp
US 8.8.8.8:53 ponf.linkedin.com udp
GB 88.221.134.88:443 a1916.dscg2.akamai.net tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com udp
US 8.8.8.8:53 www.facebook.com udp
GB 163.70.147.23:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 scontent.xx.fbcdn.net udp
GB 163.70.147.23:443 scontent.xx.fbcdn.net tcp
GB 163.70.147.23:443 scontent.xx.fbcdn.net tcp
GB 163.70.147.23:443 scontent.xx.fbcdn.net tcp
GB 163.70.147.23:443 scontent.xx.fbcdn.net tcp
US 8.8.8.8:53 scontent.xx.fbcdn.net udp
GB 163.70.147.23:443 scontent.xx.fbcdn.net tcp
GB 163.70.147.35:443 facebook.com tcp
US 8.8.8.8:53 facebook.com udp
GB 163.70.147.23:443 scontent.xx.fbcdn.net udp
GB 163.70.147.35:443 facebook.com udp
US 8.8.8.8:53 accounts.youtube.com udp
GB 172.217.16.238:443 accounts.youtube.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.178.4:443 www.google.com tcp
GB 216.58.212.246:443 i.ytimg.com udp
US 8.8.8.8:53 watson.telemetry.microsoft.com udp
US 20.42.65.92:443 watson.telemetry.microsoft.com tcp
GB 172.217.16.238:443 accounts.youtube.com tcp
US 8.8.8.8:53 www3.l.google.com udp
US 8.8.8.8:53 www3.l.google.com udp
GB 172.217.16.238:443 www3.l.google.com udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.178.4:443 www.google.com tcp
GB 142.250.178.4:443 www.google.com udp
US 8.8.8.8:53 rr5---sn-5hneknee.googlevideo.com udp
NL 74.125.8.74:443 rr5---sn-5hneknee.googlevideo.com tcp
NL 74.125.8.74:443 rr5---sn-5hneknee.googlevideo.com tcp
NL 74.125.8.74:443 rr5---sn-5hneknee.googlevideo.com tcp
NL 74.125.8.74:443 rr5---sn-5hneknee.googlevideo.com tcp
US 8.8.8.8:53 74.8.125.74.in-addr.arpa udp
GB 142.250.200.14:443 www.youtube.com tcp
GB 142.250.200.14:443 www.youtube.com tcp
NL 74.125.8.74:443 rr5---sn-5hneknee.googlevideo.com tcp
NL 74.125.8.74:443 rr5---sn-5hneknee.googlevideo.com tcp
GB 216.58.212.246:443 i.ytimg.com tcp
GB 216.58.212.246:443 i.ytimg.com tcp
FI 109.107.182.3:80 tcp
US 8.8.8.8:53 play.google.com udp
US 8.8.8.8:53 watson.telemetry.microsoft.com udp
US 20.42.65.92:443 watson.telemetry.microsoft.com tcp
GB 142.250.200.14:443 play.google.com udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.200.14:443 play.google.com tcp
US 8.8.8.8:53 play.google.com udp
GB 142.250.200.14:443 play.google.com tcp
GB 142.250.200.14:443 play.google.com udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
GB 172.217.16.238:443 www3.l.google.com udp
GB 216.58.212.246:443 i.ytimg.com tcp
US 8.8.8.8:53 i.ytimg.com udp
GB 142.250.200.14:443 play.google.com udp
GB 216.58.212.246:443 i.ytimg.com tcp
GB 216.58.212.246:443 i.ytimg.com udp
US 8.8.8.8:53 scontent-lhr6-1.xx.fbcdn.net udp
GB 163.70.147.23:443 scontent-lhr6-1.xx.fbcdn.net tcp
GB 163.70.147.23:443 scontent-lhr6-1.xx.fbcdn.net tcp
GB 163.70.147.23:443 scontent-lhr6-1.xx.fbcdn.net tcp
US 8.8.8.8:53 aus5.mozilla.org udp
US 35.244.181.201:443 aus5.mozilla.org tcp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 8.8.8.8:53 scontent.xx.fbcdn.net udp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
US 34.160.144.191:443 prod.content-signature-chains.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 201.181.244.35.in-addr.arpa udp
US 8.8.8.8:53 ciscobinary.openh264.org udp
GB 88.221.134.209:80 ciscobinary.openh264.org tcp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 209.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 redirector.gvt1.com udp
GB 216.58.212.238:443 redirector.gvt1.com tcp
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 redirector.gvt1.com udp
GB 216.58.212.238:443 redirector.gvt1.com udp
US 8.8.8.8:53 r1---sn-4g5e6nzl.gvt1.com udp
DE 74.125.11.102:443 r1---sn-4g5e6nzl.gvt1.com tcp
US 8.8.8.8:53 r1.sn-4g5e6nzl.gvt1.com udp
US 8.8.8.8:53 r1.sn-4g5e6nzl.gvt1.com udp
DE 74.125.11.102:443 r1.sn-4g5e6nzl.gvt1.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 238.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 102.11.125.74.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com udp
GB 142.250.178.4:443 www.google.com tcp
GB 142.250.178.4:443 www.google.com udp
US 8.8.8.8:53 scontent-lhr6-1.xx.fbcdn.net udp
GB 163.70.147.23:443 scontent-lhr6-1.xx.fbcdn.net tcp
US 8.8.8.8:53 scontent-lhr6-1.xx.fbcdn.net udp
GB 163.70.147.23:443 scontent-lhr6-1.xx.fbcdn.net tcp
GB 163.70.147.23:443 scontent-lhr6-1.xx.fbcdn.net tcp
GB 163.70.147.23:443 scontent-lhr6-1.xx.fbcdn.net tcp
GB 163.70.147.23:443 scontent-lhr6-1.xx.fbcdn.net tcp
GB 163.70.147.23:443 scontent-lhr6-1.xx.fbcdn.net tcp
GB 163.70.147.23:443 scontent-lhr6-1.xx.fbcdn.net udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 scontent-lhr8-2.xx.fbcdn.net udp
GB 157.240.214.11:443 scontent-lhr8-2.xx.fbcdn.net tcp
GB 142.250.200.14:443 play.google.com tcp
GB 142.250.200.14:443 play.google.com tcp
GB 142.250.200.14:443 play.google.com udp
US 8.8.8.8:53 scontent-lhr8-1.xx.fbcdn.net udp
US 8.8.8.8:53 scontent-lhr8-2.xx.fbcdn.net udp
US 8.8.8.8:53 11.214.240.157.in-addr.arpa udp
GB 157.240.221.16:443 scontent-lhr8-1.xx.fbcdn.net tcp
US 8.8.8.8:53 scontent-lhr8-1.xx.fbcdn.net udp
GB 157.240.214.11:443 scontent-lhr8-2.xx.fbcdn.net tcp
US 8.8.8.8:53 scontent-lhr8-2.xx.fbcdn.net udp
US 8.8.8.8:53 scontent-lhr8-1.xx.fbcdn.net udp
GB 157.240.221.16:443 scontent-lhr8-1.xx.fbcdn.net tcp
GB 157.240.221.16:443 scontent-lhr8-1.xx.fbcdn.net tcp
GB 157.240.214.11:443 scontent-lhr8-2.xx.fbcdn.net udp
GB 157.240.221.16:443 scontent-lhr8-1.xx.fbcdn.net udp
GB 157.240.214.11:443 scontent-lhr8-2.xx.fbcdn.net udp
US 8.8.8.8:53 16.221.240.157.in-addr.arpa udp
RU 185.215.113.32:80 185.215.113.32 tcp
DE 185.172.128.19:80 185.172.128.19 tcp
US 8.8.8.8:53 19.128.172.185.in-addr.arpa udp
RU 193.233.132.167:80 193.233.132.167 tcp
US 8.8.8.8:53 67.112.168.52.in-addr.arpa udp
US 8.8.8.8:53 scontent.xx.fbcdn.net udp
GB 163.70.147.23:443 scontent.xx.fbcdn.net tcp
GB 163.70.147.23:443 scontent.xx.fbcdn.net udp
US 8.8.8.8:53 star-mini.c10r.facebook.com udp
US 8.8.8.8:53 star-mini.c10r.facebook.com udp
DE 144.76.1.85:18574 tcp
US 8.8.8.8:53 85.1.76.144.in-addr.arpa udp
FI 109.107.182.3:80 tcp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
NL 142.250.27.84:443 accounts.google.com udp
DE 172.217.16.131:443 beacons.gcp.gvt2.com tcp
RU 185.215.113.67:26260 tcp
US 8.8.8.8:53 131.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 triangleseasonbenchwj.shop udp
US 172.67.204.169:443 triangleseasonbenchwj.shop tcp
US 8.8.8.8:53 67.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 169.204.67.172.in-addr.arpa udp
US 8.8.8.8:53 gemcreedarticulateod.shop udp
US 104.21.80.171:443 gemcreedarticulateod.shop tcp
US 8.8.8.8:53 secretionsuitcasenioise.shop udp
US 172.67.213.168:443 secretionsuitcasenioise.shop tcp
US 8.8.8.8:53 171.80.21.104.in-addr.arpa udp
US 8.8.8.8:53 claimconcessionrebe.shop udp
US 172.67.199.120:443 claimconcessionrebe.shop tcp
US 8.8.8.8:53 168.213.67.172.in-addr.arpa udp
US 8.8.8.8:53 120.199.67.172.in-addr.arpa udp
US 8.8.8.8:53 liabilityarrangemenyit.shop udp
US 104.21.83.220:443 liabilityarrangemenyit.shop tcp
US 8.8.8.8:53 220.83.21.104.in-addr.arpa udp
US 8.8.8.8:53 pool.hashvault.pro udp
DE 95.179.241.203:80 pool.hashvault.pro tcp
US 8.8.8.8:53 203.241.179.95.in-addr.arpa udp
FI 109.107.182.3:80 tcp
US 8.8.8.8:53 trad-einmyus.com udp
RU 185.12.126.182:80 trad-einmyus.com tcp
RU 185.12.126.182:80 trad-einmyus.com tcp
US 8.8.8.8:53 182.126.12.185.in-addr.arpa udp
RU 185.12.126.182:80 trad-einmyus.com tcp
RU 185.12.126.182:80 trad-einmyus.com tcp
US 8.8.8.8:53 galandskiyher5.com udp
RU 185.12.126.182:80 galandskiyher5.com tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
US 8.8.8.8:53 brusuax.com udp
US 8.8.8.8:53 96.134.221.88.in-addr.arpa udp
BA 185.12.79.25:80 brusuax.com tcp
US 8.8.8.8:53 25.79.12.185.in-addr.arpa udp
RU 185.12.126.182:80 galandskiyher5.com tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
US 8.8.8.8:53 api.2ip.ua udp
RU 185.12.126.182:80 galandskiyher5.com tcp
US 172.67.139.220:443 api.2ip.ua tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
US 8.8.8.8:53 220.139.67.172.in-addr.arpa udp
RU 185.12.126.182:80 galandskiyher5.com tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
US 172.67.139.220:443 api.2ip.ua tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
BA 185.12.79.25:80 brusuax.com tcp
US 8.8.8.8:53 habrafa.com udp
RU 185.12.126.182:80 galandskiyher5.com tcp
KR 123.140.161.243:80 habrafa.com tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
US 8.8.8.8:53 243.161.140.123.in-addr.arpa udp
RU 185.12.126.182:80 galandskiyher5.com tcp
US 8.8.8.8:53 starozitnictvi-znojmo.cz udp
CZ 62.109.150.108:80 starozitnictvi-znojmo.cz tcp
KR 123.140.161.243:80 habrafa.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 92.123.128.167:443 www.bing.com tcp
GB 92.123.128.167:443 www.bing.com tcp
FI 109.107.182.3:80 tcp
US 8.8.8.8:53 137.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 167.128.123.92.in-addr.arpa udp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 99.167.154.149.in-addr.arpa udp
DE 49.12.101.249:9000 tcp
US 8.8.8.8:53 249.101.12.49.in-addr.arpa udp
DE 49.12.101.249:9000 tcp
DE 49.12.101.249:9000 tcp
DE 49.12.101.249:9000 tcp
US 8.8.8.8:53 1a87dec2-5da8-44bd-a260-8c43b06be53e.uuid.myfastupdate.org udp
RU 185.12.126.182:80 galandskiyher5.com tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
US 8.8.8.8:53 m2reg.ulm.ac.id udp
ID 103.23.232.80:80 m2reg.ulm.ac.id tcp
US 8.8.8.8:53 80.232.23.103.in-addr.arpa udp
RU 185.215.113.32:80 185.215.113.32 tcp
RU 193.233.132.167:80 193.233.132.167 tcp
FI 109.107.182.3:80 tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
US 8.8.8.8:53 stun2.l.google.com udp
RU 185.12.126.182:80 galandskiyher5.com tcp
US 8.8.8.8:53 mahta-netwotk.click udp
NL 46.175.144.56:443 mahta-netwotk.click tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
RU 185.12.126.182:80 galandskiyher5.com tcp
US 8.8.8.8:53 56.144.175.46.in-addr.arpa udp
US 8.8.8.8:53 file-file-file1.com udp
RU 5.42.65.31:48396 tcp
RU 185.12.126.182:80 file-file-file1.com tcp
DE 185.172.128.33:8924 tcp
RU 185.12.126.182:80 file-file-file1.com tcp
US 8.8.8.8:53 31.65.42.5.in-addr.arpa udp
RU 185.12.126.182:80 file-file-file1.com tcp
IT 142.251.27.127:19302 stun2.l.google.com udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 server5.myfastupdate.org udp
US 162.159.135.233:443 cdn.discordapp.com tcp
BG 185.82.216.111:443 server5.myfastupdate.org tcp
RU 185.12.126.182:80 file-file-file1.com tcp
US 8.8.8.8:53 33.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 127.27.251.142.in-addr.arpa udp
NL 45.15.156.174:443 tcp
US 8.8.8.8:53 resergvearyinitiani.shop udp
US 172.67.217.100:443 resergvearyinitiani.shop tcp
US 8.8.8.8:53 walkinglate.com udp
US 8.8.8.8:53 233.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 111.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 174.156.15.45.in-addr.arpa udp
US 8.8.8.8:53 100.217.67.172.in-addr.arpa udp
US 104.21.23.184:443 walkinglate.com tcp
US 8.8.8.8:53 antiuncontemporary.fun udp
US 8.8.8.8:53 reechoingkaolizationp.fun udp
US 8.8.8.8:53 mazumaponyanthus.fun udp
RU 185.12.126.182:80 file-file-file1.com tcp
US 8.8.8.8:53 unexaminablespectrall.fun udp
US 8.8.8.8:53 184.23.21.104.in-addr.arpa udp
US 8.8.8.8:53 muggierdragstemmio.fun udp
RU 185.12.126.182:80 file-file-file1.com tcp
US 8.8.8.8:53 bicyclesunhygenico.fun udp
US 8.8.8.8:53 pielumchalotpostwo.fun udp
RU 185.12.126.182:80 file-file-file1.com tcp
US 8.8.8.8:53 fishboatnurrybeauti.fun udp
RU 185.12.126.182:80 file-file-file1.com tcp
BG 93.123.39.68:80 93.123.39.68 tcp
RU 185.12.126.182:80 file-file-file1.com tcp
US 8.8.8.8:53 68.39.123.93.in-addr.arpa udp
BG 185.82.216.111:443 server5.myfastupdate.org tcp
US 209.23.11.171:4151 tcp
BG 93.123.39.68:1334 93.123.39.68 tcp
US 8.8.8.8:53 171.11.23.209.in-addr.arpa udp
US 8.8.8.8:53 api.ip.sb udp
US 172.67.75.172:443 api.ip.sb tcp
NL 142.250.27.84:443 accounts.google.com tcp
NL 142.250.27.84:443 accounts.google.com tcp
US 8.8.8.8:53 172.75.67.172.in-addr.arpa udp
FI 109.107.182.3:80 tcp
BG 93.123.39.68:80 93.123.39.68 tcp
BG 93.123.39.68:1334 93.123.39.68 tcp
US 172.67.75.172:443 api.ip.sb tcp
BG 93.123.39.68:4449 tcp
FI 109.107.182.3:80 tcp
BG 93.123.39.68:4449 tcp
BG 93.123.39.68:4449 tcp
BG 185.82.216.111:443 server5.myfastupdate.org tcp
BG 93.123.39.68:4449 tcp
BG 93.123.39.68:4449 tcp
N/A 127.0.0.1:50949 tcp
BG 93.123.39.68:4449 tcp
N/A 127.0.0.1:51031 tcp
BG 93.123.39.68:4449 tcp
RU 185.215.113.32:80 185.215.113.32 tcp
RU 193.233.132.167:80 193.233.132.167 tcp
BG 93.123.39.68:4449 tcp

Files

memory/3580-0-0x00000000011E0000-0x000000000168A000-memory.dmp

memory/3580-1-0x0000000077314000-0x0000000077315000-memory.dmp

memory/3580-8-0x0000000004C10000-0x0000000004C11000-memory.dmp

memory/3580-9-0x0000000004C50000-0x0000000004C51000-memory.dmp

memory/3580-7-0x00000000011C0000-0x00000000011C1000-memory.dmp

memory/3580-6-0x0000000004C60000-0x0000000004C61000-memory.dmp

memory/3580-5-0x0000000004C20000-0x0000000004C21000-memory.dmp

memory/3580-3-0x0000000004C30000-0x0000000004C31000-memory.dmp

memory/3580-4-0x0000000004C40000-0x0000000004C41000-memory.dmp

memory/3580-2-0x00000000011E0000-0x000000000168A000-memory.dmp

memory/3580-11-0x0000000004C70000-0x0000000004C71000-memory.dmp

memory/3580-10-0x0000000004C80000-0x0000000004C81000-memory.dmp

memory/3580-16-0x00000000011E0000-0x000000000168A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe

MD5 51ef253573361f6c98326b0462f5ce83
SHA1 7c96435052fc733bcc2cc50e6c502984d12e06ac
SHA256 597bd4137eba96a91b80265692e854c26d0417fd3c2691eedae443752ee3264d
SHA512 9b6c79df1221873742a6ce8c9b3546b9e469dbe04e9bd14a8912f59c479062d7273ea954134d9996eafa3a1dd8f279864ae0ce8ba8285e0e3f21da36e240fa08

memory/4076-19-0x0000000000230000-0x00000000006DA000-memory.dmp

memory/4076-20-0x0000000000230000-0x00000000006DA000-memory.dmp

memory/4076-22-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

memory/4076-21-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

memory/4076-24-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

memory/4076-27-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

memory/4076-26-0x0000000004F90000-0x0000000004F91000-memory.dmp

memory/4076-25-0x0000000004F80000-0x0000000004F81000-memory.dmp

memory/4076-23-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

memory/4076-29-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

memory/4076-28-0x0000000005000000-0x0000000005001000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000030041\do.ps1

MD5 d769ca0816a72bacb8b3205b4c652b4b
SHA1 4072df351635eb621feb19cc0f47f2953d761c59
SHA256 f4cc3a4606856fd811ecbcdf3fc89fa6418a1b3c8f56ca7ff5717713e8f806a2
SHA512 cf13fd667e71707d63d394391b508f5a1ee5ffa7ac27fe35906e15059e9fccc8ad61e91ce3ffd537e8daa0f6306d130997e9b448a4466407fa0c894917850b64

memory/2764-40-0x0000000000CE0000-0x0000000000D16000-memory.dmp

memory/2764-41-0x00000000722C0000-0x00000000729AE000-memory.dmp

memory/2764-42-0x0000000004340000-0x0000000004350000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe

MD5 24881ab63dd814ad80bc4f69691d5069
SHA1 75b3105ff3084d5e237c8ebb525b1f988c203c4d
SHA256 5ef91601d3c25061f33864fb81a0ca6a14767b7d5be7c442e323ecaccd2b77fe
SHA512 596d97ee07eb1613e34a69db0e807314906cbaf6d5fb45e2833bb98f66a9a148eab1f7809686f2fccde3ddb9c96a891ef84a7d5da870f1bd34cea835f42365c0

memory/2764-52-0x0000000006D50000-0x0000000007378000-memory.dmp

memory/2764-57-0x0000000006BB0000-0x0000000006BD2000-memory.dmp

memory/2764-58-0x0000000007480000-0x00000000074E6000-memory.dmp

memory/2764-59-0x00000000074F0000-0x0000000007556000-memory.dmp

memory/2764-60-0x0000000007580000-0x00000000078D0000-memory.dmp

memory/4560-77-0x000001458CB00000-0x000001458CB10000-memory.dmp

memory/4560-96-0x00000145897C0000-0x00000145897C2000-memory.dmp

memory/2764-97-0x0000000006D20000-0x0000000006D3C000-memory.dmp

memory/2764-98-0x0000000007990000-0x00000000079DB000-memory.dmp

memory/2764-99-0x0000000007CC0000-0x0000000007D36000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000032001\ladas.exe

MD5 739edbbab87a6cad0eb66d08be2696af
SHA1 957fe870a6ab1afe50a92b290936935847519016
SHA256 3aec2bcb76da203ec5e6c59b712a69a048b0b1da14d4234bf0ba700cf6c2ba0a
SHA512 52cc23a46896cf502e3b9444eb10128ac276d72c741eade705a3a196cb4228ce709df3d40fd74e6f422ab9876296b570c11b21b908569e6e6d8e9c18bb586719

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nu1rubaw.ko3.ps1

MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

memory/2776-124-0x0000000000960000-0x0000000000F1B000-memory.dmp

memory/2776-131-0x00000000053F0000-0x00000000053F1000-memory.dmp

memory/2776-134-0x0000000005430000-0x0000000005431000-memory.dmp

memory/2776-133-0x00000000053D0000-0x00000000053D1000-memory.dmp

memory/2776-135-0x0000000000960000-0x0000000000F1B000-memory.dmp

memory/2776-137-0x0000000005400000-0x0000000005401000-memory.dmp

memory/2776-138-0x0000000005450000-0x0000000005451000-memory.dmp

memory/2776-136-0x00000000053C0000-0x00000000053C1000-memory.dmp

memory/2776-140-0x0000000005410000-0x0000000005411000-memory.dmp

memory/2776-139-0x00000000053E0000-0x00000000053E1000-memory.dmp

memory/2776-141-0x0000000005440000-0x0000000005441000-memory.dmp

memory/2776-142-0x0000000005470000-0x0000000005472000-memory.dmp

memory/2764-151-0x0000000008EA0000-0x0000000008F34000-memory.dmp

memory/2764-152-0x0000000008B70000-0x0000000008B8A000-memory.dmp

memory/2764-153-0x0000000008BC0000-0x0000000008BE2000-memory.dmp

memory/2764-154-0x0000000009470000-0x000000000996E000-memory.dmp

memory/2764-162-0x0000000008FF0000-0x0000000009023000-memory.dmp

memory/4076-161-0x0000000000230000-0x00000000006DA000-memory.dmp

memory/2764-164-0x000000006D460000-0x000000006D4AB000-memory.dmp

memory/2764-163-0x000000007E880000-0x000000007E890000-memory.dmp

memory/2764-165-0x0000000008FB0000-0x0000000008FCE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000225001\dota.exe

MD5 70df632d2bf711bd8f8dd5f10638ee84
SHA1 6c6874bfeb94d645ff8ae15d6434f004353f8b9a
SHA256 be52449b37d9f43dc7c98c174a1b68d1d97c9fd5a3f653d82d892df896fbfc94
SHA512 02312865a0d7470f8740fb66dced22c769c8f294de24dbb02f81a0d58e35b9863c0e5e96489b9071343bab1a110a7c274a0dc70c549030e973bfad3eeede0be3

memory/2764-190-0x0000000009030000-0x00000000090D5000-memory.dmp

memory/656-196-0x00000000010C0000-0x0000000001BDE000-memory.dmp

memory/4076-198-0x0000000000230000-0x00000000006DA000-memory.dmp

memory/4076-210-0x0000000000230000-0x00000000006DA000-memory.dmp

memory/2764-211-0x0000000004340000-0x0000000004350000-memory.dmp

memory/656-207-0x000000007F1E0000-0x000000007F5B1000-memory.dmp

memory/2764-215-0x00000000722C0000-0x00000000729AE000-memory.dmp

memory/656-218-0x0000000077312000-0x0000000077313000-memory.dmp

memory/2620-226-0x0000023DA2E70000-0x0000023DA2E72000-memory.dmp

memory/2620-230-0x0000023DA2E90000-0x0000023DA2E92000-memory.dmp

memory/2620-233-0x0000023DA2EB0000-0x0000023DA2EB2000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\WIDYI818.cookie

MD5 deccaea8ff306aceda71db677560c9ff
SHA1 456dd468479ddef29354cda014abd0f496242da9
SHA256 38e2c5baabc9ed8aab68f0a622b949c5e696e2bbc907c08254dc7535817bb713
SHA512 c9762ff5639dbf640cc4ed9bae65e9842f33f51d3d462e77eb63c4aec6d2d29e1092d39eebd108e18543eb1e40773eda6cc0ce1fcf90832df970f21bbbc87c5b

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 92fbdfccf6a63acef2743631d16652a7
SHA1 971968b1378dd89d59d7f84bf92f16fc68664506
SHA256 b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72
SHA512 b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117

memory/2620-320-0x0000023DB3C60000-0x0000023DB3C80000-memory.dmp

memory/2620-330-0x0000023DB3620000-0x0000023DB3640000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 5a4ca99f56cfd85aef289731f6310d6d
SHA1 b6af386a1d996b89d3cce703d5061b512fdeb852
SHA256 b8028b61bd91c45c68da06e0b13114288a26ca3e46348a2731105df3f4090e03
SHA512 1ffdc244be97cc92c7a42ecf8bad13ae5c9ccbbf3c6e2a7ff64b218a16b916a66d554c2e7162154658fafe34f47fbcd2ac6ef1813816069f0086acfab02e52cc

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 f6d38556e96bdb48719f20d3648283c0
SHA1 669b2a387561e11322bfb9a3824671860512ab40
SHA256 45a081b2a78d7804f147e4e9e7f362737d40bda2f17f8119dc4fc5645cd0e609
SHA512 6103203deb0ddf8307bf1ba06a81f200babcc73b228168b1a3c3309d4b01680c51c627921db0b43b8025ec4b91489a7a8574cccf786299850c387dba0e7f8190

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 f1996e640e8362ba64d062fa405960da
SHA1 df5b77b23c9f9f09e63f3e58ec1395b3d9857090
SHA256 71bce39fc0ee88082947ea9c919d6c0050b0a422b89c821d49cb28b73f0b03d6
SHA512 eadedb37ae32c5478452de8166607123094700b4bef6094cefb5e9a544f2e75944ddb84a64e4ad76cbb81cc0b87eaa84d17f4fcbbc91fd84586a052165ae2993

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\JEEF66A7.cookie

MD5 c9ba7a4b0de9321183d62ee757635cfc
SHA1 de7f29c68b9381dd43de2a18829c1e9e3ca98023
SHA256 b4b3db5acd0293da1d0509b5a795bddc0309bb7cda8a5e3b1c7bdc8188c769e8
SHA512 55e04b15c5f6709afe2efdf1f6700081c4c9fb2d4314c7a3c69db7b5d39ce7797a29f1b244544a5355c0809e5b262f533bfda2e618058728b0af83ef22bc657e

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\3S03N8KE.cookie

MD5 56ff60c22933dab66ffdbc20ba6dc1ea
SHA1 100b8c79fc75c631c031a9ce47c37c24b6c88b49
SHA256 395145674efd90d0b0ab1ddbb6332550d54aa78fba8ee6f29d112fd4c2418861
SHA512 270e50ac4f490f22887ccc2cdd3b22f697ef8df8696353adace9a70bf3188655ab34e24ab46b7784626a86463f479bca179fe63975cbab9216b77a9a8d6e062e

memory/2808-451-0x000001F8F2400000-0x000001F8F2420000-memory.dmp

memory/2808-536-0x000001F8F2060000-0x000001F8F2062000-memory.dmp

memory/2776-541-0x0000000000960000-0x0000000000F1B000-memory.dmp

memory/2808-539-0x000001F8F25F0000-0x000001F8F25F2000-memory.dmp

memory/2808-542-0x000001F8F27E0000-0x000001F8F27E2000-memory.dmp

memory/2808-561-0x000001F8F2EC0000-0x000001F8F2EC2000-memory.dmp

memory/3884-569-0x0000020421CC0000-0x0000020421CE0000-memory.dmp

memory/2808-566-0x000001F8F2EE0000-0x000001F8F2EE2000-memory.dmp

memory/3884-581-0x0000020422220000-0x0000020422320000-memory.dmp

memory/2808-572-0x000001F8F2430000-0x000001F8F2432000-memory.dmp

memory/2808-599-0x000001F8F5060000-0x000001F8F5160000-memory.dmp

memory/2808-603-0x000001F8F5060000-0x000001F8F5160000-memory.dmp

memory/656-626-0x00000000010C0000-0x0000000001BDE000-memory.dmp

memory/4076-635-0x0000000000230000-0x00000000006DA000-memory.dmp

memory/2764-646-0x0000000009110000-0x000000000912A000-memory.dmp

memory/5680-657-0x00007FFE91320000-0x00007FFE91D0C000-memory.dmp

memory/2312-775-0x0000023E72300000-0x0000023E72400000-memory.dmp

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 2afdbe3b99a4736083066a13e4b5d11a
SHA1 4d4856cf02b3123ac16e63d4a448cdbcb1633546
SHA256 8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee
SHA512 d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f

memory/4560-827-0x0000014592BE0000-0x0000014592BE1000-memory.dmp

memory/4560-832-0x0000014592BF0000-0x0000014592BF1000-memory.dmp

memory/2808-835-0x000001F8F6F40000-0x000001F8F6F60000-memory.dmp

memory/2808-843-0x000001F8F72E0000-0x000001F8F7300000-memory.dmp

memory/2808-840-0x000001F8F72C0000-0x000001F8F72E0000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\IJ5UIOH5\9lb1g1kp916tat669q9r5g2kz[1].ico

MD5 3d0e5c05903cec0bc8e3fe0cda552745
SHA1 1b513503c65572f0787a14cc71018bd34f11b661
SHA256 42a498dc5f62d81801f8e753fc9a50af5bc1aabda8ab8b2960dce48211d7c023
SHA512 3d95663ac130116961f53cdca380ffc34e4814c52f801df59629ec999db79661b1d1f8b2e35d90f1a5f68ce22cc07e03f8069bd6e593c7614f7a8b0b0c09fa9e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5 93e4fbe63a4869fbbee38926269d504d
SHA1 ea8fcaf353b2a31a608dcbf0dcc43f5ac19a383b
SHA256 e314bf24b0e2efe84515fbef64f19a59b9a8f08bb1d1b28c5d7c02f9702c38cd
SHA512 2e8f8b376baf538b2c5f808fa6719f0a6d1e803664ba040fc86d4dbe21e5cba2d71983ea9e65f75bcb33ac0f68f32ef8ae171b64d4457b7a0e9f4ec70263523e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\WC01N5C3\accounts.google[1].xml

MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

MD5 16b7586b9eba5296ea04b791fc3d675e
SHA1 8890767dd7eb4d1beab829324ba8b9599051f0b0
SHA256 474d668707f1cb929fef1e3798b71b632e50675bd1a9dceaab90c9587f72f680
SHA512 58668d0c28b63548a1f13d2c2dfa19bcc14c0b7406833ad8e72dfc07f46d8df6ded46265d74a042d07fbc88f78a59cb32389ef384ec78a55976dfc2737868771

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

MD5 e9e365607374115b92e4abe4b9628101
SHA1 d5054ea9b22317dca83801eb3586017bfcc0e2a8
SHA256 5cd2c4d9f13524923046198c92213691539407e04fa520cdae9eade1bad3d91d
SHA512 a84d65ed53e43883e5ecb7848fbd48f5305a63e6975e6af480cf85532879720061106be54f2a5888ebc3569f7123081a0e6eb48ccb8d7dba3e1da1c8a3c50401

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_D50E9269859FFB5A738F673D82E63752

MD5 bed26a7cccdb93460883bab3128b12bd
SHA1 2cf245777d2195cbc043b2b97e6133599abe3d57
SHA256 ba0f4e704d9c0c62282308afde7a4f2fdefbac676b2383a781c9a75e7909398e
SHA512 deb8d9aa4f21430d69f88d6d04ffc7c95b0eb657ba9c263926cb7c14803445253e90ccc56b0b299f3f930f7b1db3535a38ea840378e3e2caddb04d0269b95cfc

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_D50E9269859FFB5A738F673D82E63752

MD5 1fbbf85c1bd3bda037bd8632c00d30af
SHA1 febb2d656dc139271ffe27d80fb41a6e290b2413
SHA256 ab22211fd4883a3a33d30eb572044111af46d78891912642bec9f75d229aedfb
SHA512 27b9242f22c24049f726c75f4a759bbe224d42b7456c3a2647c82feb11a1931d6db96816dd4c21c5dcc5bdaa2e2f49ccd6dd84a409795bdaa7d2e8f2bea9b1f1

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\BW1SP4CJ\favicon[1].ico

MD5 f3418a443e7d841097c714d69ec4bcb8
SHA1 49263695f6b0cdd72f45cf1b775e660fdc36c606
SHA256 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA512 82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\4q870u6\imagestore.dat

MD5 d36db4d19c9d0a12deac89d6d794f3be
SHA1 d7b4afbd0f74e89a7c483831c8846cfa9c3df833
SHA256 3b6e951255f7ebaa5dbda65548d5e7da9798a16c8cbfc1df6c67acfadb35b8af
SHA512 a945abff36e197eaff88baf07199484d103b0e7dbccd0c57bb8da00f496a6586c5f8bd1958f9d34a1d8ed28f7fa7f482c27f2c72fe7adb30d7b9062dbd7e857e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gjijjd1j.default-release\datareporting\glean\db\data.safe.bin

MD5 5c00eeb14ba6ff3b69df1c714606ba72
SHA1 989af9226a8c61b7013d635575111b93ec20b126
SHA256 350fba22ba54973a46a8b64b7922929eea09afe33325d4ec7d2e83bbd3e99657
SHA512 4c8bb101e27adbd5a2baf072dce29d489bbe750e7ff5820dbe48aaf074834b3be0d13383151e81ccab9cef1fd044bedfd5cac6771ad2cf29ba8a12939026e185

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gjijjd1j.default-release\datareporting\glean\pending_pings\85c07072-f902-4036-9fd1-2f95e0cd73f2

MD5 06cca5d26844e203dab6140abc738f4d
SHA1 79d67abbdfa09a895c1548d5451389cb81f8afdc
SHA256 61eaed1912edd9b4df1e99f751f5c2f4a6c7b44c6b6c7a8d8f4a224e12945080
SHA512 7acab01cd2e7ef0c61131b5d6e80af34a0c43ad58d051335d17fc4e99f26937bc75b4280bdf47493c8e061b8e44f4d0b958eca12c8a3eb6ccd8009c3036c821b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gjijjd1j.default-release\datareporting\glean\pending_pings\7196a0dd-38dd-4b1a-a50a-d9e6be300adf

MD5 f58c91108f7b79cd99378430fc52b250
SHA1 c4e0df2c4194324a83646abc1c6b6db26bca4320
SHA256 a0897e8b3145bd252aa54e0e8a04fad055a7acacffb6c3bf6141857541301b85
SHA512 b09442bf33001e4138f88f01e5e7b0a03a254c92a5a3bad0aab0b53c380b806981dd405b2baecffc6e27fe4e1ca7c0e9dff569bb4fd4cb9239824dc95e57bc10

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\IL52KY0U\4Kv5U5b1o3f[1].png

MD5 a81a5e7f71ae4153e6f888f1c92e5e11
SHA1 39c3945c30abff65b372a7d8c691178ae9d9eee0
SHA256 2bc7a47889c56ad49f1b8b97385d5a4d212e79bb8a9b30df0665a165f58b273e
SHA512 1df32349b33f6a6fcb1f8b6093abd737fa0638cdd6e3fd90a7e1852bd0e40bc2633cb4e13c4824fb948d1e012e5cb9eed0b038b121404865495d4e57e123db69

\??\pipe\crashpad_5968_UCVMPWNNUJKEYQJZ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

MD5 0e16444393cd322124146935ab837ecc
SHA1 aa1a3e9571e3e067421d940601965220711f24ad
SHA256 1b5de2bf736e2bb182cf64bd8a72bbbd6538a9f33dc8020223b2257bad6f7d82
SHA512 26c461b0493c5e0f26aa196ce94c0c9ea5d892220ebe882af4bf2892469515e9b13056ef7ae0f9c429f45c14f334299ccffa5bab1547b3da0e2fce45131630a0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 f86c715447ed8dd03b8a02c3a825d182
SHA1 7b9e6ea96ebb81b23666ec6216965b8de6d4f994
SHA256 84f59e26a613c6fce647019343400965f202beb09397d561b4c438720bcf4827
SHA512 7ee1b4c8978ff7dc3a539eb2e2348876b73ef62d2f64b4805324717aea459c5910fd897e940844231a585c3ac04d8a5e1083c889f8b408ccaa095574d9ca5663

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 d480a5e4e93e0e32103eb5601e9e4895
SHA1 382647934282673148dcf063bf8f71e0b2a12c0e
SHA256 ad8c54c4758ac33f2bef006cbc69289bf6c2631796998a1e76ce5c7652efbf45
SHA512 7090a5e29c94cf68159451275f22c95ae9da0cc3eaccad986e81192f43beb9c485a4e8bf6569851dfebb6e53788189a3d46d563075dab07a3d775c4d5ac0f310

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 8928c897d54eab53f9ac864b7a104f57
SHA1 9f6a271feb7931ba14ba8674fda82414ca984aee
SHA256 4a39826b055ff96995fab6bdbeb98337b3ef950b46e1f6c76d63872baae8a432
SHA512 f6cad4575c005be92e97a2d1a1aba462c75185a955a558ab6cb8236cf017376f6063fed1137bc70f23f54deac80e39da0b97b0305d309d1f1654d40828aac7b3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 bbc682c6ff4a3403ed4990e0ee89a806
SHA1 fd7f7b5b479048227f5c1991122c363d95626a44
SHA256 e1217b84adc589f7a5d1d0dccdf5a6c3db2190f8fc67f86491a6775aa047c3bc
SHA512 d51f8883c64c4eed42e02ad89d1ad4d4e27e6fa992ebacedfefa2ee292f22ffa8efc7fcd2534a730eb42f8e1e5e33cfa704495a41a915a580b43233ca103a4c9

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gjijjd1j.default-release\sessionstore-backups\recovery.jsonlz4

MD5 a6207f0f1752491ccca5b3a47509f68f
SHA1 f5929a70d6a34ea9aea8d838a093c24077e5a3c5
SHA256 898f3e98399ecb031ab67fbc28ad27aead727e7b6035727420a7123079de4692
SHA512 7c42028daa15c5c9f63335bc69ebfc60aaf64c76b67ba09dd2877be7db545e25b8bcdbca0faa463ce829fb04778c80fd1c2ef0864aa0d11eff63a8ff4c4941bc

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\1RCNB4T1.cookie

MD5 69802c95cb6dfa872ba17c98db9dc044
SHA1 3dd9701a7ce9582e460a852da531361fc0116106
SHA256 04500570d2d0dc1d7ddddc8395328e1913787dfed32e9120b0f97a3db46c368e
SHA512 cebd87c2784f7b0588db0d45282550f39057d7e1a1081b56a24dceee97a550fb6002ef35ba76a9dea6f1e75ee51ee1b5ea8affc0aa19b53404f1d71e922d3666

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_4FF70BED6E50B22FE9799AB821C4C486

MD5 e082e5a87c160d5ebdf801e31dbdd7ba
SHA1 9ef3a34ac2480e907cbcd1db02bce11817fc1f24
SHA256 b432d58bf3cc22aede82954c453003ccba729d9787d026aa6a71778f5eb0af3b
SHA512 d8ed3ee1331aecea0f489f929b901c66f7cc3e20670c1e3eefaf5aa768c041d4b083676005ddb58085c2144c558453cb6fffe63e1456fbdf6f8faf7c32e7077e

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_4FF70BED6E50B22FE9799AB821C4C486

MD5 21f0aefe4e2c573c5ecf35fec76967f5
SHA1 a6416270773e64a3ac3a31878832a5a2068ee49e
SHA256 1ffbaf0645e7821d02306329efc32a5cfbe9705971deb241071c1bdf4f832795
SHA512 48d5a48a42229f65e27de7f8b354bd2bc1829555bf7fe9624f3c8b69d239291668817f154ab37f14a345aee8a9bb5e16d175be25f009af59b19246a34f71bc56

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 055cf0669dfb2e7980204d732ea4895c
SHA1 3fa2a54b71b334644947cd1395aef5efa5f261b4
SHA256 d351f1fb79938e2fa92dbcf428e6c47a4f01f63e7b832f542f29ad4986b4300a
SHA512 143e8ffed84d2b522187b64c1e8c06dec0ca7beb7cfd9a9fae614f2a2d269f0f3b5aebc5094fb8a9336a58f9b854cf4b25e4ed81035102db30fc158fc60ac6de

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6OMHFB77\edgecompatviewlist[1].xml

MD5 d4fc49dc14f63895d997fa4940f24378
SHA1 3efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256 853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512 cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 f1a387787f9f2a94d511b3028aa71e26
SHA1 3419808b0a2ef6d45825a821b2797a6dee3f95fe
SHA256 b3f56662908500cf03e373f3ae1edcd7f66fd324bb5abea93dbeca69af33d493
SHA512 b81f5d7c5fd53dc32a70c3a04ade0be1effe8928eabea1cd1f48c05d99ab0a98ef392e6d3ace39fdde10cc372ff3638e2018468d25847fb33681d1955649ddd2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 c1728059be828419bfb9c518b36476a7
SHA1 adb9624285f8a5e2b3f5067133c27df9375f41b1
SHA256 686fbc2de881d049e1fb0b543d8b5cbe976e144e87b9534578f181ead94979ef
SHA512 46d15a04dd69cd7426569074e2f4ff6ce79554db1adcf3c128d1712e708215468e0a9f5a02bc521f05e5d82e75fa77b5672af0cf5e40f55cf1e5ef7c0dca6700

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gjijjd1j.default-release\prefs-1.js

MD5 e241d85c2d036fa1db69e4b2e872c451
SHA1 c64f8decc5cd2819c7598a0415175bd65c49a11d
SHA256 03a96ebcc9221a343a42194473cfa04eaccc18e555dbfb31f4a55bded5df5ae7
SHA512 cdeb86a78ccd25c09c940085ca1cd997e18722fdf37c5974d4046b223a16f474f9bed995e5b1f7a27049b23f560b8fa6663a368796d585c2faf14da20132d48d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gjijjd1j.default-release\sessionstore-backups\recovery.jsonlz4

MD5 cf89716361192fe12cf72aa6e8086a77
SHA1 c32ad9200ab45afd74ba8531fc5a13e725c1af85
SHA256 6162cd268a5f58ff6d2b2ad64b0d4bc02bc324805e40d2a1357d7da4f2195b31
SHA512 b22727b10a0d0d079797467923d140853d913b34fd6ca38cc00e46cbfed11c91e790b19973d658cd8e5d1e4c2ce6beb1817d246af2f9e008165e1bfea71068b1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gjijjd1j.default-release\storage\default\https+++www.linkedin.com\idb\301792106ttes.sqlite

MD5 07bcfa29c40bee46a929a634ff7537b6
SHA1 2f4aaafe19822a232aa3b80c020f40561af4f996
SHA256 9beee5d780e6f6cbd8e883478085f76d9e0dfe4cf3ab659ab499ab379eebb0ce
SHA512 b6536b306ade23fd5def527575db1f54901c26705965bb71be96ac3370d1e394b30e0cb7f7a5a559ffdaceb6abf9ba414f1e08c61b24201423f875d44d22f84c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 1194dac9c5d48b1d2b5e62b18cdfebbc
SHA1 bc88f0a3de9f38af0648c18724de6b41d47170c0
SHA256 431ebd74cc968f58d0accadd140d5dcc76e6662ad1728f3cc1aec2091c4e698a
SHA512 e6850a96d1e0607b916575f35a7a07ade299e661a476e1fc3f92fb1a861d72dbb77c228642a7288876437dd67373ce6e9a0e77e275fdd39d94195a7534ad65c3

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gjijjd1j.default-release\cache2\doomed\31340

MD5 a284d577ac9394675ea87f7e13f60961
SHA1 800a6598a140ca8ef0cdaf6852c5c1dc60191e2b
SHA256 e94e0788de539391472d2eae83de7e40bbac8fae741ca9a18b5ad31c8675739b
SHA512 1119639f9764f5669eccf97f5d34de8b05ca841761e8e89dd82da2b42c225339bfa7eb631c886a79f46f1bd1f751cbb0de39b5768fc767b7690710efaef87edb

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001

MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir5968_1882804182\Shortcuts Menu Icons\Monochrome\0\512.png

MD5 12a429f9782bcff446dc1089b68d44ee
SHA1 e41e5a1a4f2950a7f2da8be77ca26a66da7093b9
SHA256 e1d7407b07c40b5436d78db1077a16fbf75d49e32f3cbd01187b5eaaa10f1e37
SHA512 1da99c5278a589972a1d711d694890f4fd4ec4e56f83781ab9dee91ba99530a7f90d969588fa24dce24b094a28bdecbea80328cee862031a8b289f3e4f38ce7a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Shortcuts Menu Icons\Monochrome\1\512.png

MD5 7f57c509f12aaae2c269646db7fde6e8
SHA1 969d8c0e3d9140f843f36ccf2974b112ad7afc07
SHA256 1d5c9f67fe93f9fcc1a1b61ebc35bda8f98f1261e5005ae37af71f42aab1d90f
SHA512 3503a0f4939bed9e1fd5e086b17d6de1063220dffdab2d2373aa9582a2454a9d8f18c1be74442f4e597bdba796d2d69220bd9e6be632a15367225b804187ea18

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gjijjd1j.default-release\cache2\entries\2BB62A5F508187291BB477E79601AC81B652604E

MD5 5c1fd2d1f17b005cde91d605f3ff9caa
SHA1 b95a751f2cb3acdae5ef6853bfb6f8ca5b2205a5
SHA256 962cdaef2b164aae19bf04f720847e6b72bf597104d99df2e89a1d7c0a775886
SHA512 412a227a3f265aae079b0856717defd2bd38a80ae79cf11b6fba6b772dd82640cba0de21a9127d1b298694872f761fec3e508a35df351737db221535fb9fa3c7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 7f9abf07783be040431dadef54d7677f
SHA1 89c7a20cfccd96a4b26a10751cedebb0664db6c5
SHA256 e4166e054ea48ba86d1544f3b2f853caae57cebe9290865f8ab51de1f50c8497
SHA512 7ac4d18f45b9f12856bd10c15fb7c4064c0f61f65d936710b25feec5c18c8e5247716ed801ded7bebf7156203af4bac3e90f2b41375c3bbee8bd3631dc54573c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 6c2048baf1fe1db3a55e5b5fa5c19e87
SHA1 52a0b512f502cf953ac5226ee423b47027919af3
SHA256 5224dacabbd299b33ac04ad67960ec42a0c802c502a30076a82eb35e0a481355
SHA512 f55eb9db2eff07271a9238abdd1582bfbc19b0f86703a5bf188cad62af93cd054933f047bd22c6237fd5405e7230a1414affb94c09004fe64d83407f3992f88d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5904f8.TMP

MD5 ab365b64b037f278e7b898b71a7c0a8e
SHA1 2addd3b7e77326426548d7064c987bfecfe0c54e
SHA256 50f2f0726607b7a0559ec33d3acdd0a938b9036ebc8a6493a94ce5c2b16967e3
SHA512 c421aeae2d9af774684f94af500e5022cf483ff1fd24a8f7b1508eb2dde20f3dd9c506fa910e3be9680c53a09cd74827dc435c1bf96ea0075964c96959a3a3cb

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028

MD5 d1a0d8504b6a46215e2a4cf521ddb7b5
SHA1 3d6e16808a1e17ccdaca99f37ed30468391c62e0
SHA256 cb357178d5e09917800b0669d958b5517c4f8b322c01f2adeca3ea7fa4e707c1
SHA512 2ee68d71b04a78e1bc353f66daaeac1ab9f2e1119d7b6974571f8ef1a7a20fc1ea3903f3d90f3feffe7d820339abed4a26cabb230ddba3baa415309daad2d570

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 8b3fd3a8f3025156080f0e39cf455f44
SHA1 bec087c5506df4787bfca588a5d67aa9db35bec6
SHA256 71cb3772b42d810a2c67c31b19e2ba6f7dd4d5aaade4752b67e2bd6d0976e798
SHA512 1eadf3e878ee338d6973c550c2990bc463b45acdbec1e6fd52f6cc15849e74f6c8fac6f1c54d271586b22d3ea369b24fb6fc77269b19244c317ae0ca61750923

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 be1f0c6c114e108d2bd669cb154f6bfc
SHA1 9102a23e98860ac3c3c23ed922a3053e4e29b133
SHA256 7a715e3296f412642ce7a9b90cc3c8066115379e367f00428a52d25ad7169a82
SHA512 ad7a9a7060328667c88cc540ec0ae51db8ba78f3cb87340c621deeb84d09573b96c630e73bdd0c0061af7c78a33e59c9da5f57e8f4183a94f379966568551ecd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gjijjd1j.default-release\prefs.js

MD5 dc8dba6b436ebae579ba1c4ba612297c
SHA1 be94d44a889372e60af4f937649a70f172df55b8
SHA256 d738298fcce8af40c908ac78d12f7e186b1f8af3299d67f6a7ead68926b08552
SHA512 eebf6dc13bf393184951b4cadd80b08667debc4044151f723073983978fc4daf488d29694fabcd0385d4bc1fe2b299a70e2617fa5767bb19d19da0b655676a13

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old~RFe5927a3.TMP

MD5 4183a2fb69813562633bd7e5abacf2bd
SHA1 112a97c7634bcd8e57505aedafa879cee96847ab
SHA256 4928cba52995c282cea3b5000a960c77137970315a88322cfe5e1797aa6c48bf
SHA512 af65833f64a114822694dbe07310a72b55c9e046851be20e21b8c2798e5d64108d8962fdf3e99b51177e1a665767907d3749e94e6b2486479d474fad13102be8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 600e13d4f4a5479239c5e0be5dbaa296
SHA1 e1b687c338958ad18e1793f04ba277b5810da507
SHA256 f1259b3931ad1186b915d12f38f8a39c8cc8d6a0748c77cd203fa127eb8028c4
SHA512 bb504134406528d83c2cbe909099a3619546d20383d4def2958474450176e4f9060ede34eb5bce5f4dcb867aaebd8c6ecd66efc958997987c7b617bf5019dfb3

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gjijjd1j.default-release\sessionstore-backups\recovery.jsonlz4

MD5 a71695db078835844d451f4ce6811137
SHA1 f2d623ad54cf5d3cc3bee6f963392ee997943f81
SHA256 91f804a327a0d3269bdd4269b02e6c38e835444ec24faa41381ea1342074a5a0
SHA512 b8e6acdfa28a1e698ad24f2a922c7aefbf73f102e09a2bd08a760b2a58746dcacfd50f7bdd69011b7720fbce291b6273c10c8499a8bb0d149fb33d41568d6acc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 e0627ae87b95218f4d06ec341ca3654c
SHA1 e47711debb341b6bc88035def03db511a8fb76a1
SHA256 b2ff0123cfc1de9c0ab221966ecefa423650215e4d740bd051ebde6d493ae53c
SHA512 c32ddb0a5ad5bdc63349c1ccd04b42a00dec4ebc2c83ac0396335175f3b7e2e117476b199d0998cc84e2debbc0dc668e3b2ffb1086ad6d65ad7e785b0801ce73

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 0279220bf023dfb73576b738b45d05c1
SHA1 36e052df076698110d86bde148e1c7c6634f8a6f
SHA256 a8cffc5211a293c9bd452c1866d58579fb70852d9c086ce818617e690b2c50d5
SHA512 41be8fb10b8f6934d3b53ea108888cb77fa4faf2eda35ce82660e19bc8ab3cafed797bcb2eece050997638088fff01177a28c076a6a13f1b3900458a0d9b8157

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gjijjd1j.default-release\cache2\entries\2BA519C9921C81C15066FBCD676C21DBFCEFDEB2

MD5 90285dad40827abd5c31dd00eb65779f
SHA1 30b89b0318cbd25c04c9f8794f4b84096eeed49f
SHA256 0dbdfdf9ec57656ffc1850dbf908cfb31d3e6746fd0e12d48831b11fb1ffabed
SHA512 9c1b8d795a91121740b2d5e102154b736dfd58a380b39bdbead2838cb055328bc506bb490f82739d467856ed67153e65cd51b2d316a83c8820cfec8d03b6e375

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gjijjd1j.default-release\cache2\doomed\5785

MD5 7091c08b12e5b77350828ff3a8412f90
SHA1 1e7e5d1aa951a0112c961143f07a9c5c70a50ceb
SHA256 97008f250389d7e10e9039b45e94e970051917480cb02da0bd43c64d37b9571e
SHA512 64da51a7ec30255341dac96eb433204f344e29c7f5300ac2a739ad4fecd43a8e83772839d95d42a38b9a2444d38856bd39bdf65fdf3b7cc83933785dfd4370b2

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\gjijjd1j.default-release\cache2\entries\2D6787CA12528D4B0F368491AE23B783E05B365A

MD5 fd2e3465ba5435ea4f817ece8240a11e
SHA1 3c002a7b73f8f8d189f09b4a576a00f2064f49b8
SHA256 57e990ee455f6f1c79c3cf77f98857b4b0936e4334f14a174bd62296c7f62170
SHA512 16d9fd4e0d2c173723ef621def73d02e9687b08e18fd88cdd9d8b3a641d3d5ed290ee015b000febf63a6cfdc25c17455dfb89d126a85ac5154bd0a38cae52ea5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 f50c76ee7e63278a6cfaaf14231f25c1
SHA1 3c637459b40b71f9dfa1c1f9c0a74f3506b52496
SHA256 b4a9781a66dbae746e835f284852b1e04815790f13efa0419c94c19e9bbfe064
SHA512 87599b4a7bcbf12a0bbe7fa1998bf9856d61c115674711be681ca428b3e7bcd87da68522242aa0f48150c0d6220d4d19523bef33f058dc2ab4c748562636cd96

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gjijjd1j.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gjijjd1j.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gjijjd1j.default-release\prefs.js

MD5 220e815e54dea6a76ad42fa94c77dd2c
SHA1 02085a0189a9ff1b1d829b73cffc5cba11c9089c
SHA256 aaeffd5271a851b57abdf5c715f5286d21d390fabf871657a6e18909e62aa28f
SHA512 680aa4896e6235e92bb85ef914e3e0f1033c5e052418dfe02763a3f4a93dcd9a8d2596ec917d6323f8743db01318f65c341d8133f2debefb0a968a7faa0666e2

C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

MD5 dcb398f1aa5e0f6c710a5ebf413b6a8a
SHA1 5e2a3080bb00f4fc962cd38239282c871195c578
SHA256 39f50d11731b2c3a64a55cc0cb3b7ca0b4cf67f46b99eacc91242a69027c5a8e
SHA512 d3890f41b2d6a6ec2c600493475d4b60006e1ba0fe665b55d5dbc4b5e5ab0e2486e4c4ccfb83b108ef6cf60e4328a31afce26102a8726376d796b35a1f866635

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gjijjd1j.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gjijjd1j.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gjijjd1j.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

MD5 fb7ce4e677af4a28b263bafc0a38c412
SHA1 8e248f3aef8552d9b0de38dea717ffb031052307
SHA256 02d5cf9ed246d3f6529ad269f8f32c78d97e9488cfee11052b44ac38b244fb71
SHA512 c488f3f9fda08125ffa4929b0e7b1feed89e9267167ac6660b1b287d2f12b2b1e21418fb7f708bcede4f33be9f0c10dc4e3b96c6f2433ec6d299a5091a504758

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gjijjd1j.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gjijjd1j.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 b33273a70790c8d5b6f85a22882ad503
SHA1 f1f9dcf8549239f8d61fd04a73d44fe622b99017
SHA256 05a365c7fe6bdc62615da157e75919f6c41ccd5f9e0fcdfccb2865d094679835
SHA512 8694f01f4bb57d0b5806052cd27e2ea660acee90a06575f9e56b0eda8c869e07dffd342964c664191661468e0bcfcf5234a5889f92c79004664f4966f2390a1a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 4fff25f381d8529ce1a0bfebbbd850d1
SHA1 459450e75fa355e0cf2ad97c734433baaa071be4
SHA256 93c1f249fdfc083c93937d6a7ea1818f0d835549e889b707ae7d5339ca68a0f9
SHA512 0f27bfdb9845c072d092bbe0ca30e33d678c89e6e64501385bd84dc5d6ac5dc95c47dbeb5d1b42f8fc52736c111d6bf03840d1c486d1954c64b5337314914dec

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 063a08790c9773c80837a901e67754e9
SHA1 364df57923e685d628e40e3126c5081cc0837fe5
SHA256 a8be5f2de654e336ee31f00becaed29ce5a48a74ff9ef31a207edcbaffa09fd3
SHA512 4c12e64ac2dec5076c5d2c82222162a37c0e9ba55690cc9e168e701791a749caf318901203a91151156c7e743daf280875680519be79767994bf2c06960b30f0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595fca.TMP

MD5 deead20c5e0a975b0974bcf6807bcd18
SHA1 e4645489b73c81028bd3e47ace34a1e8c40a2b04
SHA256 95414966d0a89fd9f9d27811ee9f433b3694a1a3363b2e06b6477357e0150683
SHA512 48fe50aecd4765ff965aa393882ce7e77d5bf10d191f665107a29ed98f634249c9612d2d4a4eac392ce95a82ac047433acd436656c9ffe2718e0d1f289f0f7bc

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gjijjd1j.default-release\sessionstore-backups\recovery.jsonlz4

MD5 a5ba5bcf0442f8aba7f7d580e63c546a
SHA1 348a33eac46e3b83dbb86c9481e2f8539c6134a7
SHA256 1822de80417cad5535969f7dfac87f4e0d156a79d5451b5189891845f7c0b9f7
SHA512 82d529ac7265860c0d67d04f29c3493ea2fd3ef3d8d4950b3efca47cda1cec6ea8358b232ca4a681e68bb2e6cdadaab37c5fd5ce9d808045991b3b389538018f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000034

MD5 f6184bafee4be4e0179664a6696289bd
SHA1 5132c2d40587621f20faedd954aba04db32dacec
SHA256 c2c037e92cce291e16693a597a77733b8e2121a02b4394ea9326654d1d76a83f
SHA512 d1fdf95816dae49ff7178f68f92c3e94aec5b6d0e96f300f1763262674e888b4b83950f051471cd41c7974d4c7100e9439be13ddc057a0605da86f88c3f68d72

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000032

MD5 8dba1030059c0a051491a85bccad695e
SHA1 1c19373c7dc5c388b26884b9146095e44070bea9
SHA256 5de42bda76cb9cc03487866621cb78532ca595b367489a8f9b392ed0812f0ddf
SHA512 26ed74980321134cfe68c3eec3232d3f01b162d5f1b074ce669a966b453c5885775015cd41a6a89fed9179c67ac9dd644c6b263da0231bdcb61a5708632f60f7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000033

MD5 e2175cc2ba741482e8db4223ac827364
SHA1 2a400f429045f34db9f6136c4403592105ff0531
SHA256 0844dc81e0e09409c6d04c2b2c5c5198398d977630593a0150ad2a1fa442f8ab
SHA512 ffa838cca12287e132584832ab96af96bf086a4b35c31ba1e70bc4696cf4528b9819adc3b949c3dad77ac09a211e8d0cb867870019496b34b30f5139390d1fe0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016

MD5 3669e98b2ae9734d101d572190d0c90d
SHA1 5e36898bebc6b11d8e985173fd8b401dc1820852
SHA256 7061caa61b21e5e5c1419ae0dc8299142ba89c8169a2bd968b6de34a564f888a
SHA512 0c5f0190b0df4939c2555ec7053a24f5dae388a0936140d68ed720a70542b40aaf65c882f43eb1878704bea3bd18934de4b1aac57a92f89bbb4c67a51b983ae3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015

MD5 c1164ab65ff7e42adb16975e59216b06
SHA1 ac7204effb50d0b350b1e362778460515f113ecc
SHA256 d7928d8f5536d503eb37c541b5ce813941694b71b0eb550250c7e4cbcb1babbb
SHA512 1f84a9d9d51ac92e8fb66b54d103986e5c8a1ca03f52a7d8cdf21b77eb9f466568b33821530e80366ce95900b20816e14a767b73043a0019de4a2f1a4ffd1509

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017

MD5 b63bcace3731e74f6c45002db72b2683
SHA1 99898168473775a18170adad4d313082da090976
SHA256 ea3a8425dcf06dbc9c9be0ccd2eb6381507dd5ac45e2a685b3a9b1b5d289d085
SHA512 d62d4dddb7ec61ef82d84f93f6303001ba78d16fd727090c9d8326a86ab270f926b338c8164c2721569485663da88b850c3a6452ccb8b3650c6fa5ce1ce0f140

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018

MD5 9978db669e49523b7adb3af80d561b1b
SHA1 7eb15d01e2afd057188741fad9ea1719bccc01ea
SHA256 4e57f4cf302186300f95c74144cbca9eb756c0a8313ebf32f8aba5c279dd059c
SHA512 04b216bd907c70ee2b96e513f7de56481388b577e6ccd67145a48178a605581fab715096cfb75d1bb336e6ad0060701d2a3680e9f38fe31e1573d5965f1e380a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 e084d5a7142d541ff80e56ef227a8be0
SHA1 0757bb08220e880e9145a8b1f2f4f407bed60ee6
SHA256 872ce43f5a9bc026085e6688c66c92f0a9627e762493e1aebe55ffbf65d4eccf
SHA512 222936daefe0b58e8b9a1d4387a9823c191078ea47e55d443dc5035ef2ca473ea5f279901cba61d5a37e4c00ebff1b4e296ecea724c3e20b4231441862db7b02

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\BQB4VRDE\suggestions[1].en-US

MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

C:\Users\Admin\AppData\Local\Temp\1000237001\dayroc.exe

MD5 9e4d1c2ddddb0bb9ab403a7540fcb44c
SHA1 9d3d818c60aca0d501133497055fe43dd1d8f2c6
SHA256 cb6fd0e4779453133de64e1af45a7489ce2e858f7024b792f03c9be549afb84b
SHA512 15932b3b10c53ee596101085a0df42218f8c94553cb36d2b5bc384a679288b82eacc5bb52c18ae565426bbccc7c8d4a7a9cbd3df6ee3e60e968de28c0ef8812e

C:\Users\Admin\AppData\Local\Temp\1000238001\monetkamoya.exe

MD5 e9adf3fcd6efd04ad2d9fcbb0c652a5d
SHA1 bfe3f7167266c6e17572e801394517513d4b7501
SHA256 1e97aba3bea70cedc575c7a181f1782ba7d8a3bd5859960bd46ea3a0663a95a2
SHA512 6e0be0d272eea1ca92ea164549b0a4c26f7a89ecdbc85c6998a278eb961c406e43964eb13cd3d573fe063aeb64e8d38a984cee8706747f82610a56a716c0b255

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 3a2f489aa85ebc226e8df8511be67274
SHA1 aa458b8b7385209dd0ef0d1170bc9a38f4ae9a79
SHA256 8f21e1aa1b6a03eb2ed664c3d2e4513193a195091248158ed229caa75bedbdc7
SHA512 40b62cbb1d9f91d97d8a07e11602eb3defb8d9a047ec52f0dbbe8bb2529fc452741351a9ca436ff1d9dd6153adb66e64c7b68ff64439e5341cb4136d0c93f720

C:\Users\Admin\AppData\Local\Temp\1000244001\goldpricem12334.exe

MD5 68777645a0968e2fca74a2fd06eaa2ff
SHA1 f181c91a08e1b85d866a3c3e497ef1a1e298903d
SHA256 df952743ff04bc19bb4e1a3d7e9bb1a172fb60653aa73f9ae619fd5367b8e63b
SHA512 d06acb0ac1465d5b16f3853c940502085946d192547c1912561255e476b9452281abab2ff1e2f29c0937c1367f0581839dccc6816dce2d8cd73a091b4c4beced

C:\Users\Admin\AppData\Local\Temp\1000245001\daissss.exe

MD5 10a331a12ca40f3293dfadfcecb8d071
SHA1 ada41586d1366cf76c9a652a219a0e0562cc41af
SHA256 b58eec6e5aabc701404d5b5556c86fff5cc103c69eeda00061e838c4f122288f
SHA512 1a5b8e77ddbab97bb4c848adbcd7dbfb9ca84307d1844dba9572fcea48a2cbb091a3fc52663b87568416adf18a1338adc07aab0bd5f1ab36a03c8ff8a035d399

C:\Users\Admin\AppData\Local\Temp\1000246001\newfilelunacy.exe

MD5 c1982b0fb28f525d86557b71a6f81591
SHA1 e47df5873305fbcdb21097936711442921cd2c3b
SHA256 3bab5e1befbdc895d9e36e76cb9a40e59de61a34109c36ed26d7dedcd5db3080
SHA512 46dcabbfb57b3665faa76bc6f58b6f252934788acabbf2ba75263d42cac8c013f6feb5992a7043123842a609bdd1b3084f2f0c8b192c2b219b87274d29f8c432

C:\Users\Admin\AppData\Local\Temp\1000247001\lumma123142124.exe

MD5 cad41f50c144c92747eee506f5c69a05
SHA1 f08fd5ec92fd22ba613776199182b3b1edb4f7b2
SHA256 1ac5eed2f7fc98b3d247240faa30f221f5692b15ea5b5c1eba3390709cb025c6
SHA512 64b89f3a3b667cd81f33985db9c76ffd0bb716ce8ed93f97c24d3c20e7236d91d02af9371a26d41f55b564702bd1f6fd7489055868fcd1610c04beb79ae8c045

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gjijjd1j.default-release\sessionstore-backups\recovery.jsonlz4

MD5 b8f46ebbb122487f32ef148243e7db69
SHA1 f32840635dc9d1041c7c071bf51c2c59c8e82e04
SHA256 802587c33b8d45fdbaff96a516313e6312dc8ca6131a0f076c1e09028ac89d67
SHA512 e3030d9a97615d4c6f428122aacf8ebc79cfcb79fe0a78aa1f5558880fa666d3ab9f728620a9779dfba7d941919577ef1d5e0f13b870f17c04c66df5c0fabc25

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 e2355821632dbb567306ffee8a9ef0a7
SHA1 32d836d29d5db938cdda10e7c03a277715bd1b61
SHA256 b4fa4b49911474dcbfd9aee1cfd9da2b6809d7ac7666e051d20795fd5dd337a0
SHA512 442e3100e8b40f54b396ee6a70cca6b2ed01138dd81a4f1476256d16e2cac61d66bb209eb95bd3e40477c55a79cc3e675050571bf88774a9f39945aff0ebfd84

C:\Users\Admin\AppData\Local\Temp\1000248001\new.exe

MD5 f7df4f6867414bb68132b8815f010e4a
SHA1 ff3b43447568de645671afb2214b26901ad7a4fc
SHA256 2c9490406c7ea631dddcd60f862445faef37c036651636e4bf5e6fe0837c4b42
SHA512 0ad9b1544c25ae7814fe1ecdb1cfd466fd14603a6d55749e63ce6b90926ad239f134aef1bcaa0910b79235b8a3873ad11698e17dbd0cfee92fb909f4daf0412e

C:\Users\Admin\AppData\Roaming\fdtegcc

MD5 55f8359ef2f889e04fe418c80bc952ed
SHA1 b2ac224b69c20b721ef9810b79003b513823e55f
SHA256 732cb080fb5e27e98728c42f77b5dd865faa1f5e840d8113c9f30fa2c3f550c8
SHA512 42bfba12e19f399beb54d65dfdb8767584c75264a1f321aee68cb85880d7ac606b3022bb0ab7df72075d3f2271e7d4918c9c7bae7acf6675856bcd21f6fe46b8

C:\Windows\rss\csrss.exe

MD5 294c5614c7183a453d7eef1b36ab1266
SHA1 ddef7ff18a09042fdadc0a1c78f88fc2050c703c
SHA256 d4194f95a8ede895fd6344ec12b5038058d9a5130016207f490f16572c3d9a01
SHA512 2f6c8bc173a3cc49ac0acb4cde6dc22ce4ebe078763d9543b0511b185efb1878bb0ae01519c805fec83c7face791bfc73c505d8f9245695b64f179f035c8739e

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

MD5 41b883a061c95e9b9cb17d4ca50de770
SHA1 1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad
SHA256 fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408
SHA512 cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

C:\Users\Admin\AppData\Local\Temp\1000250001\for.exe

MD5 8c281571c5fdaf40aa847d90e5a81075
SHA1 041fa6e79e9027350c1f241375687de7f8cba367
SHA256 0182e73c39240c0e660bbdd4262209f08d767562d4794b7ed5e36a4d4f36b409
SHA512 b0e481681b02e4cc4f95deff2fa21354f94ad34e6611d97de3a127ae285038164df724f3db27bbf03caa217c3d8dabf77bfdadeaf9af8a1915edacbd35c1c862

C:\Users\Admin\AppData\Local\Temp\tmp71C2.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmp71E8.tmp

MD5 800d031f12bbf1db52a7a9fbb263e0eb
SHA1 4635f8c2afdc36ae2e7d7ba249ef553971711176
SHA256 a1a649b0aaa918d3344993c66eab863d469cb81378854c55de4350f65ba4cf18
SHA512 31b2c1ffab322bf0f5ef856c4fb34a773ffbaee3bd2be6c74f91e06dc77e8055caeedf3a7635b780e17bd2f758db4e53adc52bcf9274d45e905fee35462eae12

C:\Users\Admin\AppData\Local\Temp\tmp72CE.tmp

MD5 c51c45366b732a9bf3f4bb3d0e989448
SHA1 e6414f3a9d742e37bdbd5020ef077a3f1e6ae214
SHA256 429fa5777ee21f406d7de90f17eeeafe071fcc6a75e5748531ca3fdeb0e8c72e
SHA512 27b72424376180361d368c8541ebc98096230d32dd8aafb33cb1942391a95bd0f05964d0300f02f67a1cc04d853aa92e14fb938c669041036751d436e199db97

C:\Users\Admin\AppData\Local\Temp\asdjijjjjj.exe

MD5 57935225dcb95b6ed9894d5d5e8b46a8
SHA1 1daf36a8db0b79be94a41d27183e4904a1340990
SHA256 79d7b0f170471f44ed6c07ddb4c4c9bb20c97235aef23ac052e692cb558a156d
SHA512 1b6362bdb7f6b177773357f5fe8e7d7ee44716fd8e63e663e446f4e204af581491d05345c12cd9cca91fd249383817da21ef2241011cdc251b7e299560ea48c0

C:\Users\Admin\AppData\Roaming\chromeupdate.exe

MD5 25b6389bbaa746df85d53714d4a6d477
SHA1 86e6443e902f180f32fb434e06ecf45d484582e3
SHA256 4b02692bf468a164e333bbfc961c5974d0a95009a72ea8bff2e9cb677eae4f56
SHA512 6ad22c119b548f0e8ed5adb6c9f48c33b356340a7309c8185bec817f2562ae99760ff79e131c89bce2be122b6385bee610704f37edb7f1656a1b9d4782a1fcf4

C:\Users\Admin\AppData\Local\Temp\1000252001\Amadey.exe

MD5 d467222c3bd563cb72fa49302f80b079
SHA1 9335e2a36abb8309d8a2075faf78d66b968b2a91
SHA256 fedb08b3ec7034a15e9dee7ed4dec1a854fb78e74285e1ee05c90f9e9e4f8b3e
SHA512 484b6c427e28193ddb73dd7062e2bfbd132ddc72ce4811bfe08784669de30e4b92bc27140373f62a4ce651401000a3c505188620c43da410bf6b0799a0791fa7