Malware Analysis Report

2024-10-10 12:59

Sample ID 240618-y5gvlswbpb
Target incognito.exe
SHA256 b46875a8a1001af973be5f2b9f8ea9eccc3c87fa8cc85d8a2b4e7b93bdb79dd4
Tags
dcrat discovery evasion infostealer rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b46875a8a1001af973be5f2b9f8ea9eccc3c87fa8cc85d8a2b4e7b93bdb79dd4

Threat Level: Known bad

The file incognito.exe was found to be: Known bad.

Malicious Activity Summary

dcrat discovery evasion infostealer rat trojan

DcRat

UAC bypass

Process spawned unexpected child process

Dcrat family

DCRat payload

DCRat payload

Downloads MZ/PE file

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Checks installed software on the system

Checks whether UAC is enabled

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: LoadsDriver

Uses Task Scheduler COM API

Enumerates system info in registry

Scheduled Task/Job: Scheduled Task

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Modifies registry class

Checks processor information in registry

Opens file in notepad (likely ransom note)

Suspicious behavior: GetForegroundWindowSpam

Modifies data under HKEY_USERS

Checks SCSI registry key(s)

System policy modification

Suspicious use of SendNotifyMessage

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-18 20:21

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-18 20:21

Reported

2024-06-18 20:37

Platform

win10v2004-20240611-en

Max time kernel

925s

Max time network

928s

Command Line

"C:\Users\Admin\AppData\Local\Temp\incognito.exe"

Signatures

DcRat

rat infostealer dcrat
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\incognito.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\browserreviewSavesruntimecommon\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default\Videos\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\SendTo\spoolsv.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\7-Zip\Lang\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\browserreviewSavesruntimecommon\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\browserreviewSavesruntimecommon\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\browserreviewSavesruntimecommon\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\browserreviewSavesruntimecommon\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\browserreviewSavesruntimecommon\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\CbsTemp\conhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\browserreviewSavesruntimecommon\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\CbsTemp\conhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default\Videos\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\7-Zip\Lang\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\browserreviewSavesruntimecommon\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\browserreviewSavesruntimecommon\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\CbsTemp\conhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default\Videos\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\SendTo\spoolsv.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\7-Zip\Lang\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\browserreviewSavesruntimecommon\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\browserreviewSavesruntimecommon\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\browserreviewSavesruntimecommon\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\7-Zip\Lang\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\SendTo\spoolsv.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\7-Zip\Lang\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\7-Zip\Lang\dllhost.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\incognito.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\CbsTemp\conhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\browserreviewSavesruntimecommon\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\browserreviewSavesruntimecommon\services.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\SendTo\spoolsv.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\browserreviewSavesruntimecommon\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\browserreviewSavesruntimecommon\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\browserreviewSavesruntimecommon\smss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Default\Videos\csrss.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\7-Zip\Lang\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\browserreviewSavesruntimecommon\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\browserreviewSavesruntimecommon\winlogon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\7-Zip\Lang\dllhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\7-Zip\Lang\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\7-Zip\Lang\dllhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\CbsTemp\conhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default\Videos\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\SendTo\spoolsv.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\browserreviewSavesruntimecommon\winlogon.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Process Hacker 2\plugins\is-8U160.tmp C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File opened for modification C:\Program Files\Process Hacker 2\plugins\ExtendedServices.dll C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files\Process Hacker 2\plugins\is-5OV2K.tmp C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File opened for modification C:\Program Files\Process Hacker 2\plugins\HardwareDevices.dll C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files (x86)\Windows Multimedia Platform\ebf1f9fa8afd6d C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
File created C:\Program Files\VideoLAN\110f63d1be8130 C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
File created C:\Program Files\Process Hacker 2\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files (x86)\Windows Multimedia Platform\cmd.exe C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
File created C:\Program Files\Process Hacker 2\is-LLN9L.tmp C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files\Process Hacker 2\x86\plugins\is-6FULB.tmp C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files\Process Hacker 2\is-Q3ME0.tmp C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File opened for modification C:\Program Files\Process Hacker 2\plugins\ToolStatus.dll C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files\Process Hacker 2\plugins\is-AT71I.tmp C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files\Process Hacker 2\is-4US31.tmp C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File opened for modification C:\Program Files\Process Hacker 2\peview.exe C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File opened for modification C:\Program Files\Process Hacker 2\plugins\DotNetTools.dll C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files\Process Hacker 2\is-LR3HL.tmp C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files (x86)\Windows Media Player\Skins\Registry.exe C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
File created C:\Program Files\VideoLAN\HyperBrokercommon.exe C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
File opened for modification C:\Program Files\Process Hacker 2\plugins\OnlineChecks.dll C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File opened for modification C:\Program Files\Process Hacker 2\plugins\UserNotes.dll C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files\Process Hacker 2\is-JOKB9.tmp C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files\Process Hacker 2\plugins\is-ELMMU.tmp C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\9e8d7a4ca61bd9 C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
File opened for modification C:\Program Files\Process Hacker 2\plugins\Updater.dll C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files\Process Hacker 2\is-N8S6O.tmp C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files\Process Hacker 2\is-631AE.tmp C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files\Process Hacker 2\plugins\is-NJ1RN.tmp C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files\Windows Defender\en-US\e1ef82546f0b02 C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
File created C:\Program Files\Process Hacker 2\plugins\is-NGUU3.tmp C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files\Windows Defender\en-US\SppExtComObj.exe C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
File created C:\Program Files (x86)\Windows Multimedia Platform\WmiPrvSE.exe C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
File created C:\Program Files\Process Hacker 2\is-11885.tmp C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files\Process Hacker 2\plugins\is-O94PO.tmp C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files\7-Zip\Lang\5940a34987c991 C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
File opened for modification C:\Program Files\Process Hacker 2\x86\plugins\DotNetTools.dll C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File opened for modification C:\Program Files\Process Hacker 2\plugins\SbieSupport.dll C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files\Process Hacker 2\plugins\is-QUB05.tmp C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File opened for modification C:\Program Files\Process Hacker 2\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File opened for modification C:\Program Files\Process Hacker 2\plugins\NetworkTools.dll C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files\Process Hacker 2\is-8KLKT.tmp C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File opened for modification C:\Program Files\Process Hacker 2\plugins\ExtendedTools.dll C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File opened for modification C:\Program Files\Process Hacker 2\ProcessHacker.exe C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files\Process Hacker 2\is-T6BQ6.tmp C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
File created C:\Program Files (x86)\Windows Media Player\Skins\ee2ad38f3d4382 C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
File opened for modification C:\Program Files\Process Hacker 2\plugins\ExtendedNotifications.dll C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files\Process Hacker 2\plugins\is-4MOA7.tmp C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files\Process Hacker 2\plugins\is-9B35A.tmp C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File opened for modification C:\Program Files (x86)\Windows Multimedia Platform\cmd.exe C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
File created C:\Program Files (x86)\Windows Multimedia Platform\24dbde2999530e C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
File opened for modification C:\Program Files\Process Hacker 2\x86\ProcessHacker.exe C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files\Process Hacker 2\x86\is-JI97I.tmp C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files\7-Zip\Lang\dllhost.exe C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
File created C:\Program Files\Process Hacker 2\plugins\is-TL00E.tmp C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File created C:\Program Files\Process Hacker 2\plugins\is-HV2S0.tmp C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A
File opened for modification C:\Program Files\Process Hacker 2\plugins\WindowExplorer.dll C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\ShellExperiences\csrss.exe C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
File created C:\Windows\ShellExperiences\886983d96e3d3e C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
File created C:\Windows\CbsTemp\conhost.exe C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
File opened for modification C:\Windows\CbsTemp\conhost.exe C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
File created C:\Windows\CbsTemp\088424020bedd6 C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\taskmgr.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Process Hacker 2\ProcessHacker.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Process Hacker 2\ProcessHacker.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133632159907894730" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\incognito.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings C:\Windows\system32\taskmgr.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings C:\Program Files\Process Hacker 2\ProcessHacker.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 C:\Program Files\Process Hacker 2\ProcessHacker.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Program Files\Process Hacker 2\ProcessHacker.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Program Files\Process Hacker 2\ProcessHacker.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\System32\Notepad.exe N/A
N/A N/A C:\Windows\System32\NOTEPAD.EXE N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
N/A N/A C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
N/A N/A C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
N/A N/A C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
N/A N/A C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
N/A N/A C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
N/A N/A C:\browserreviewSavesruntimecommon\winlogon.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\browserreviewSavesruntimecommon\winlogon.exe N/A
N/A N/A C:\browserreviewSavesruntimecommon\winlogon.exe N/A
N/A N/A C:\browserreviewSavesruntimecommon\winlogon.exe N/A
N/A N/A C:\browserreviewSavesruntimecommon\winlogon.exe N/A
N/A N/A C:\browserreviewSavesruntimecommon\winlogon.exe N/A
N/A N/A C:\browserreviewSavesruntimecommon\winlogon.exe N/A
N/A N/A C:\browserreviewSavesruntimecommon\winlogon.exe N/A
N/A N/A C:\browserreviewSavesruntimecommon\winlogon.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Program Files\Process Hacker 2\ProcessHacker.exe N/A
N/A N/A C:\Users\Admin\SendTo\spoolsv.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeDebugPrivilege N/A C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
Token: SeDebugPrivilege N/A C:\browserreviewSavesruntimecommon\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\browserreviewSavesruntimecommon\smss.exe N/A
Token: SeDebugPrivilege N/A C:\browserreviewSavesruntimecommon\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\browserreviewSavesruntimecommon\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\CbsTemp\conhost.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3592 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\incognito.exe C:\Windows\SysWOW64\WScript.exe
PID 3592 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\incognito.exe C:\Windows\SysWOW64\WScript.exe
PID 3592 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\incognito.exe C:\Windows\SysWOW64\WScript.exe
PID 772 wrote to memory of 2156 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 772 wrote to memory of 2156 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 772 wrote to memory of 2156 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2156 wrote to memory of 2416 N/A C:\Windows\SysWOW64\cmd.exe C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe
PID 2156 wrote to memory of 2416 N/A C:\Windows\SysWOW64\cmd.exe C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe
PID 2416 wrote to memory of 4540 N/A C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe C:\browserreviewSavesruntimecommon\winlogon.exe
PID 2416 wrote to memory of 4540 N/A C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe C:\browserreviewSavesruntimecommon\winlogon.exe
PID 4468 wrote to memory of 3296 N/A C:\Windows\system32\cmd.exe C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe
PID 4468 wrote to memory of 3296 N/A C:\Windows\system32\cmd.exe C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe
PID 3296 wrote to memory of 4716 N/A C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe C:\Windows\System32\cmd.exe
PID 3296 wrote to memory of 4716 N/A C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe C:\Windows\System32\cmd.exe
PID 4716 wrote to memory of 4632 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4716 wrote to memory of 4632 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 4716 wrote to memory of 4616 N/A C:\Windows\System32\cmd.exe C:\Windows\CbsTemp\conhost.exe
PID 4716 wrote to memory of 4616 N/A C:\Windows\System32\cmd.exe C:\Windows\CbsTemp\conhost.exe
PID 456 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 3168 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 4024 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 1040 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 1040 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 1040 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 1040 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 1040 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 1040 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 1040 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 1040 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 1040 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 1040 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 456 wrote to memory of 1040 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\browserreviewSavesruntimecommon\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\browserreviewSavesruntimecommon\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\7-Zip\Lang\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\7-Zip\Lang\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\SendTo\spoolsv.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\SendTo\spoolsv.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\7-Zip\Lang\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\CbsTemp\conhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\SendTo\spoolsv.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Default\Videos\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\browserreviewSavesruntimecommon\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\CbsTemp\conhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\browserreviewSavesruntimecommon\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\browserreviewSavesruntimecommon\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Default\Videos\csrss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\browserreviewSavesruntimecommon\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\browserreviewSavesruntimecommon\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\CbsTemp\conhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\7-Zip\Lang\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\browserreviewSavesruntimecommon\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\7-Zip\Lang\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\7-Zip\Lang\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\browserreviewSavesruntimecommon\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\browserreviewSavesruntimecommon\smss.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\browserreviewSavesruntimecommon\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\browserreviewSavesruntimecommon\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Default\Videos\csrss.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\incognito.exe

"C:\Users\Admin\AppData\Local\Temp\incognito.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\browserreviewSavesruntimecommon\sALjCX2DJ1FjfO.vbe"

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\browserreviewSavesruntimecommon\jt4LBgBNIUJsIGJZrjCIK93Fg0t.bat" "

C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe

"C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\cmd.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\cmd.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Default User\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\browserreviewSavesruntimecommon\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\browserreviewSavesruntimecommon\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\browserreviewSavesruntimecommon\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\browserreviewSavesruntimecommon\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\browserreviewSavesruntimecommon\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\browserreviewSavesruntimecommon\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\browserreviewSavesruntimecommon\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\browserreviewSavesruntimecommon\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\browserreviewSavesruntimecommon\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\browserreviewSavesruntimecommon\winlogon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\browserreviewSavesruntimecommon\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\browserreviewSavesruntimecommon\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\browserreviewSavesruntimecommon\smss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\browserreviewSavesruntimecommon\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\browserreviewSavesruntimecommon\smss.exe'" /rl HIGHEST /f

C:\browserreviewSavesruntimecommon\winlogon.exe

"C:\browserreviewSavesruntimecommon\winlogon.exe"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\browserreviewSavesruntimecommon\smss.exe

"C:\browserreviewSavesruntimecommon\smss.exe"

C:\Windows\System32\Notepad.exe

"C:\Windows\System32\Notepad.exe" C:\browserreviewSavesruntimecommon\sALjCX2DJ1FjfO.vbe

C:\browserreviewSavesruntimecommon\winlogon.exe

"C:\browserreviewSavesruntimecommon\winlogon.exe"

C:\browserreviewSavesruntimecommon\winlogon.exe

"C:\browserreviewSavesruntimecommon\winlogon.exe"

C:\Windows\System32\NOTEPAD.EXE

"C:\Windows\System32\NOTEPAD.EXE" C:\browserreviewSavesruntimecommon\jt4LBgBNIUJsIGJZrjCIK93Fg0t.bat

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\browserreviewSavesruntimecommon\jt4LBgBNIUJsIGJZrjCIK93Fg0t.bat" "

C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe

"C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Windows\CbsTemp\conhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\CbsTemp\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Windows\CbsTemp\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Package Cache\{9F51D16B-42E8-4A4A-8228-75045541A2AE}v56.64.8781\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\All Users\Package Cache\{9F51D16B-42E8-4A4A-8228-75045541A2AE}v56.64.8781\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Package Cache\{9F51D16B-42E8-4A4A-8228-75045541A2AE}v56.64.8781\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TaskmgrT" /sc MINUTE /mo 6 /tr "'C:\browserreviewSavesruntimecommon\Taskmgr.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Taskmgr" /sc ONLOGON /tr "'C:\browserreviewSavesruntimecommon\Taskmgr.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TaskmgrT" /sc MINUTE /mo 14 /tr "'C:\browserreviewSavesruntimecommon\Taskmgr.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\SoftwareDistribution\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\All Users\SoftwareDistribution\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\SoftwareDistribution\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\ShellExperiences\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\ShellExperiences\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\ShellExperiences\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\browserreviewSavesruntimecommon\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\browserreviewSavesruntimecommon\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\browserreviewSavesruntimecommon\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Videos\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Videos\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Videos\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Media Player\Skins\Registry.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Skins\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\Skins\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files\7-Zip\Lang\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files\7-Zip\Lang\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Defender\en-US\SppExtComObj.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\en-US\SppExtComObj.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Defender\en-US\SppExtComObj.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\browserreviewSavesruntimecommon\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\browserreviewSavesruntimecommon\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\browserreviewSavesruntimecommon\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\WmiPrvSE.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\WmiPrvSE.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\WmiPrvSE.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\SendTo\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\SendTo\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\SendTo\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "HyperBrokercommonH" /sc MINUTE /mo 5 /tr "'C:\Program Files\VideoLAN\HyperBrokercommon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "HyperBrokercommon" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\HyperBrokercommon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "HyperBrokercommonH" /sc MINUTE /mo 9 /tr "'C:\Program Files\VideoLAN\HyperBrokercommon.exe'" /rl HIGHEST /f

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\stYrELc6wW.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Windows\CbsTemp\conhost.exe

"C:\Windows\CbsTemp\conhost.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc4bf4ab58,0x7ffc4bf4ab68,0x7ffc4bf4ab78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1984 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2284 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3068 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3104 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4372 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4528 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4032 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4888 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x25c,0x260,0x264,0x238,0x268,0x7ff62100ae48,0x7ff62100ae58,0x7ff62100ae68

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4960 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3152 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:1

C:\browserreviewSavesruntimecommon\services.exe

C:\browserreviewSavesruntimecommon\services.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3312 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2772 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3524 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5164 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5404 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=3160 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5740 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=876 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5420 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5764 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6148 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5420 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5156 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:8

C:\Users\Admin\Downloads\processhacker-2.39-setup.exe

"C:\Users\Admin\Downloads\processhacker-2.39-setup.exe"

C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp

"C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp" /SL5="$1004D6,1874675,150016,C:\Users\Admin\Downloads\processhacker-2.39-setup.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=3296 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=5156 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:1

C:\Program Files\Process Hacker 2\ProcessHacker.exe

"C:\Program Files\Process Hacker 2\ProcessHacker.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=244 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:2

C:\Users\Default\Videos\csrss.exe

C:\Users\Default\Videos\csrss.exe

C:\Program Files (x86)\Windows Multimedia Platform\WmiPrvSE.exe

"C:\Program Files (x86)\Windows Multimedia Platform\WmiPrvSE.exe"

C:\Program Files\7-Zip\Lang\dllhost.exe

"C:\Program Files\7-Zip\Lang\dllhost.exe"

C:\Users\Admin\SendTo\spoolsv.exe

C:\Users\Admin\SendTo\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=4972 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:1

C:\Program Files (x86)\Windows Media Player\Skins\Registry.exe

"C:\Program Files (x86)\Windows Media Player\Skins\Registry.exe"

C:\Program Files\VideoLAN\HyperBrokercommon.exe

"C:\Program Files\VideoLAN\HyperBrokercommon.exe"

C:\Program Files (x86)\Windows Multimedia Platform\WmiPrvSE.exe

"C:\Program Files (x86)\Windows Multimedia Platform\WmiPrvSE.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=1608 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=6300 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4920 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6264 --field-trial-handle=1748,i,10596430520414839296,10893917176923868252,131072 /prefetch:8

C:\Users\Default User\cmd.exe

"C:\Users\Default User\cmd.exe"

C:\Program Files\7-Zip\Lang\dllhost.exe

"C:\Program Files\7-Zip\Lang\dllhost.exe"

C:\Program Files\Windows Defender\en-US\SppExtComObj.exe

"C:\Program Files\Windows Defender\en-US\SppExtComObj.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
NL 23.62.61.75:443 www.bing.com tcp
US 8.8.8.8:53 75.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 a0995775.xsph.ru udp
RU 141.8.192.169:80 a0995775.xsph.ru tcp
RU 141.8.192.169:80 a0995775.xsph.ru tcp
US 8.8.8.8:53 169.192.8.141.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
RU 141.8.192.169:80 a0995775.xsph.ru tcp
RU 141.8.192.169:80 a0995775.xsph.ru tcp
RU 141.8.192.169:80 a0995775.xsph.ru tcp
RU 141.8.192.169:80 a0995775.xsph.ru tcp
RU 141.8.192.169:80 a0995775.xsph.ru tcp
RU 141.8.192.169:80 a0995775.xsph.ru tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 195.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 106.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.200.14:443 apis.google.com udp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 195.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 172.217.169.46:443 play.google.com udp
GB 172.217.169.46:443 play.google.com tcp
US 8.8.8.8:53 46.169.217.172.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.187.206:443 clients2.google.com udp
GB 142.250.187.206:443 clients2.google.com tcp
US 8.8.8.8:53 206.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 consent.google.com udp
GB 142.250.187.238:443 consent.google.com tcp
US 8.8.8.8:53 encrypted-tbn0.gstatic.com udp
GB 142.250.178.14:443 encrypted-tbn0.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn0.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn0.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn0.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn0.gstatic.com tcp
GB 142.250.178.14:443 encrypted-tbn0.gstatic.com tcp
US 8.8.8.8:53 14.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 processhacker.sourceforge.io udp
US 104.18.37.173:443 processhacker.sourceforge.io tcp
US 104.18.37.173:443 processhacker.sourceforge.io tcp
US 8.8.8.8:53 cdnjs.cloudflare.com udp
US 104.18.37.173:443 processhacker.sourceforge.io udp
US 8.8.8.8:53 sourceforge.net udp
US 8.8.8.8:53 d2zvcf2q9m0etg.cloudfront.net udp
US 104.17.25.14:443 cdnjs.cloudflare.com tcp
US 104.17.25.14:443 cdnjs.cloudflare.com tcp
US 104.17.25.14:443 cdnjs.cloudflare.com tcp
US 104.17.25.14:443 cdnjs.cloudflare.com tcp
GB 3.162.19.163:443 d2zvcf2q9m0etg.cloudfront.net tcp
GB 3.162.19.163:443 d2zvcf2q9m0etg.cloudfront.net tcp
GB 3.162.19.163:443 d2zvcf2q9m0etg.cloudfront.net tcp
GB 3.162.19.163:443 d2zvcf2q9m0etg.cloudfront.net tcp
GB 3.162.19.163:443 d2zvcf2q9m0etg.cloudfront.net tcp
GB 3.162.19.163:443 d2zvcf2q9m0etg.cloudfront.net tcp
US 172.64.150.145:443 sourceforge.net tcp
US 8.8.8.8:53 104.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 14.25.17.104.in-addr.arpa udp
US 8.8.8.8:53 173.37.18.104.in-addr.arpa udp
US 8.8.8.8:53 145.150.64.172.in-addr.arpa udp
US 8.8.8.8:53 163.19.162.3.in-addr.arpa udp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
US 104.17.25.14:443 cdnjs.cloudflare.com udp
US 8.8.8.8:53 region1.google-analytics.com udp
US 216.239.32.36:443 region1.google-analytics.com tcp
US 8.8.8.8:53 js-agent.newrelic.com udp
US 162.247.243.39:443 js-agent.newrelic.com tcp
US 8.8.8.8:53 stats.g.doubleclick.net udp
BE 64.233.166.154:443 stats.g.doubleclick.net tcp
US 8.8.8.8:53 bam.eu01.nr-data.net udp
US 185.221.87.23:443 bam.eu01.nr-data.net tcp
US 185.221.87.23:443 bam.eu01.nr-data.net tcp
US 8.8.8.8:53 178.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 36.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 39.243.247.162.in-addr.arpa udp
US 8.8.8.8:53 154.166.233.64.in-addr.arpa udp
US 8.8.8.8:53 23.87.221.185.in-addr.arpa udp
US 185.221.87.23:443 bam.eu01.nr-data.net tcp
US 216.239.32.36:443 region1.google-analytics.com udp
US 104.17.25.14:443 cdnjs.cloudflare.com udp
US 185.221.87.23:443 bam.eu01.nr-data.net tcp
US 185.221.87.23:443 bam.eu01.nr-data.net tcp
US 185.221.87.23:443 bam.eu01.nr-data.net tcp
US 185.221.87.23:443 bam.eu01.nr-data.net tcp
US 172.64.150.145:443 sourceforge.net udp
US 185.221.87.23:443 bam.eu01.nr-data.net tcp
US 8.8.8.8:53 systeminformer.sourceforge.io udp
GB 3.162.19.163:443 d2zvcf2q9m0etg.cloudfront.net udp
US 8.8.8.8:53 a.fsdn.com udp
US 172.64.147.47:443 a.fsdn.com tcp
US 172.64.147.47:443 a.fsdn.com tcp
US 172.64.147.47:443 a.fsdn.com tcp
US 172.64.147.47:443 a.fsdn.com tcp
US 172.64.147.47:443 a.fsdn.com tcp
US 172.64.147.47:443 a.fsdn.com tcp
US 172.64.147.47:443 a.fsdn.com udp
US 8.8.8.8:53 d.delivery.consentmanager.net udp
US 8.8.8.8:53 cdn.consentmanager.net udp
DE 87.230.98.76:443 d.delivery.consentmanager.net tcp
GB 89.187.167.3:443 cdn.consentmanager.net tcp
US 8.8.8.8:53 c.sf-syn.com udp
US 172.64.154.159:443 c.sf-syn.com tcp
US 8.8.8.8:53 content-autofill.googleapis.com udp
GB 142.250.180.10:443 content-autofill.googleapis.com tcp
US 8.8.8.8:53 47.147.64.172.in-addr.arpa udp
US 8.8.8.8:53 76.98.230.87.in-addr.arpa udp
US 8.8.8.8:53 159.154.64.172.in-addr.arpa udp
US 8.8.8.8:53 3.167.187.89.in-addr.arpa udp
DE 87.230.98.76:443 d.delivery.consentmanager.net tcp
GB 142.250.180.10:443 content-autofill.googleapis.com udp
US 8.8.8.8:53 10.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 btloader.com udp
US 8.8.8.8:53 securepubads.g.doubleclick.net udp
US 8.8.8.8:53 analytics.slashdotmedia.com udp
US 8.8.8.8:53 j.6sc.co udp
US 8.8.8.8:53 ml314.com udp
US 216.105.38.9:443 analytics.slashdotmedia.com tcp
US 34.117.77.79:443 ml314.com tcp
NL 23.62.61.152:443 j.6sc.co tcp
US 104.22.74.216:443 btloader.com tcp
US 34.117.77.79:443 ml314.com udp
US 8.8.8.8:53 api.btloader.com udp
US 8.8.8.8:53 ad-delivery.net udp
US 8.8.8.8:53 dpm.demdex.net udp
US 8.8.8.8:53 idsync.rlcdn.com udp
US 8.8.8.8:53 match.adsrvr.org udp
US 8.8.8.8:53 sync.crwdcntrl.net udp
US 8.8.8.8:53 ps.eyeota.net udp
US 104.26.2.70:443 ad-delivery.net tcp
US 104.26.2.70:443 ad-delivery.net tcp
US 130.211.23.194:443 api.btloader.com tcp
US 8.8.8.8:53 c.6sc.co udp
US 8.8.8.8:53 ipv6.6sc.co udp
IE 52.211.142.73:443 sync.crwdcntrl.net tcp
US 8.8.8.8:53 b.6sc.co udp
IE 54.76.80.14:443 dpm.demdex.net tcp
US 35.71.131.137:443 match.adsrvr.org tcp
US 35.244.174.68:443 idsync.rlcdn.com tcp
DE 18.184.216.10:443 ps.eyeota.net tcp
NL 23.62.61.152:443 b.6sc.co tcp
US 8.8.8.8:53 a55b2cba908bab6d52c89f68a97a9658.safeframe.googlesyndication.com udp
US 130.211.23.194:443 api.btloader.com udp
GB 172.217.169.65:443 a55b2cba908bab6d52c89f68a97a9658.safeframe.googlesyndication.com tcp
US 8.8.8.8:53 tpc.googlesyndication.com udp
GB 172.217.16.225:443 tpc.googlesyndication.com tcp
GB 172.217.16.225:443 tpc.googlesyndication.com udp
US 8.8.8.8:53 79.77.117.34.in-addr.arpa udp
US 8.8.8.8:53 34.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 152.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 216.74.22.104.in-addr.arpa udp
US 8.8.8.8:53 9.38.105.216.in-addr.arpa udp
US 8.8.8.8:53 70.2.26.104.in-addr.arpa udp
US 8.8.8.8:53 6.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 194.23.211.130.in-addr.arpa udp
US 8.8.8.8:53 68.174.244.35.in-addr.arpa udp
US 8.8.8.8:53 137.131.71.35.in-addr.arpa udp
US 8.8.8.8:53 14.80.76.54.in-addr.arpa udp
US 8.8.8.8:53 10.216.184.18.in-addr.arpa udp
US 8.8.8.8:53 73.142.211.52.in-addr.arpa udp
US 8.8.8.8:53 65.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 225.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 cdn.ampproject.org udp
GB 142.250.187.193:443 cdn.ampproject.org tcp
GB 142.250.187.193:443 cdn.ampproject.org tcp
GB 142.250.187.193:443 cdn.ampproject.org tcp
GB 142.250.187.193:443 cdn.ampproject.org tcp
GB 142.250.187.193:443 cdn.ampproject.org tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
GB 142.250.187.226:443 googleads.g.doubleclick.net tcp
RU 141.8.192.169:80 a0995775.xsph.ru tcp
US 8.8.8.8:53 193.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 226.187.250.142.in-addr.arpa udp
RU 141.8.192.169:80 a0995775.xsph.ru tcp
US 162.247.243.39:443 js-agent.newrelic.com tcp
US 185.221.87.23:443 bam.eu01.nr-data.net tcp
DE 87.230.98.76:443 d.delivery.consentmanager.net tcp
US 185.221.87.23:443 bam.eu01.nr-data.net tcp
US 216.105.38.9:443 analytics.slashdotmedia.com tcp
US 8.8.8.8:53 e0815b9b7822a942126dd55bd16829e8.safeframe.googlesyndication.com udp
US 8.8.8.8:53 trc.taboola.com udp
DE 18.184.216.10:443 ps.eyeota.net tcp
US 8.8.8.8:53 ib.adnxs.com udp
US 8.8.8.8:53 tags.bluekai.com udp
US 151.101.129.44:443 trc.taboola.com tcp
NL 185.89.210.141:443 ib.adnxs.com tcp
BE 23.55.96.210:443 tags.bluekai.com tcp
US 8.8.8.8:53 44.129.101.151.in-addr.arpa udp
US 8.8.8.8:53 141.210.89.185.in-addr.arpa udp
US 8.8.8.8:53 210.96.55.23.in-addr.arpa udp
US 8.8.8.8:53 s0.2mdn.net udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 pixel.rubiconproject.com udp
US 8.8.8.8:53 ap.lijit.com udp
US 8.8.8.8:53 google.partners.tremorhub.com udp
US 8.8.8.8:53 match.sharethrough.com udp
US 8.8.8.8:53 cm.g.doubleclick.net udp
US 8.8.8.8:53 secure.adnxs.com udp
GB 216.58.204.70:443 s0.2mdn.net tcp
GB 216.58.204.70:443 s0.2mdn.net tcp
GB 216.58.204.70:443 s0.2mdn.net tcp
GB 216.58.213.10:443 ajax.googleapis.com tcp
IE 54.170.150.237:443 ap.lijit.com tcp
DE 37.252.171.21:443 secure.adnxs.com tcp
US 35.175.17.205:443 google.partners.tremorhub.com tcp
GB 142.250.200.2:443 cm.g.doubleclick.net tcp
DE 3.77.214.116:443 match.sharethrough.com tcp
NL 69.173.156.149:443 pixel.rubiconproject.com tcp
GB 142.250.200.2:443 cm.g.doubleclick.net udp
US 8.8.8.8:53 10.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 70.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 2.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 149.156.173.69.in-addr.arpa udp
US 8.8.8.8:53 21.171.252.37.in-addr.arpa udp
US 8.8.8.8:53 116.214.77.3.in-addr.arpa udp
US 8.8.8.8:53 237.150.170.54.in-addr.arpa udp
US 8.8.8.8:53 205.17.175.35.in-addr.arpa udp
US 8.8.8.8:53 downloads.sourceforge.net udp
US 204.68.111.105:443 downloads.sourceforge.net tcp
US 204.68.111.105:443 downloads.sourceforge.net tcp
US 8.8.8.8:53 deac-riga.dl.sourceforge.net udp
LV 89.111.52.100:443 deac-riga.dl.sourceforge.net tcp
US 8.8.8.8:53 105.111.68.204.in-addr.arpa udp
US 8.8.8.8:53 100.52.111.89.in-addr.arpa udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
GB 172.217.169.67:443 beacons.gcp.gvt2.com tcp
US 8.8.8.8:53 beacons2.gvt2.com udp
US 216.239.36.117:443 beacons2.gvt2.com tcp
US 216.239.36.117:443 beacons2.gvt2.com udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 117.36.239.216.in-addr.arpa udp
US 8.8.8.8:53 213.80.50.20.in-addr.arpa udp
US 8.8.8.8:53 google.com udp
GB 142.250.178.14:443 google.com tcp
GB 172.217.169.67:443 beacons.gcp.gvt2.com udp
DE 87.230.98.76:443 d.delivery.consentmanager.net tcp
US 216.105.38.9:443 analytics.slashdotmedia.com tcp
US 8.8.8.8:53 1c7a0d866d2f4442b9677998df2db3d0.safeframe.googlesyndication.com udp
US 8.8.8.8:53 loadus.exelator.com udp
DE 18.184.216.10:443 ps.eyeota.net tcp
IE 34.254.143.3:443 loadus.exelator.com tcp
GB 142.250.187.226:443 googleads.g.doubleclick.net udp
GB 216.58.204.70:443 s0.2mdn.net udp
NL 185.89.210.141:443 ib.adnxs.com tcp
US 8.8.8.8:53 3.143.254.34.in-addr.arpa udp
GB 216.58.204.70:443 s0.2mdn.net udp
US 8.8.8.8:53 googleads4.g.doubleclick.net udp
GB 142.250.178.2:443 googleads4.g.doubleclick.net tcp
GB 142.250.178.2:443 googleads4.g.doubleclick.net tcp
GB 142.250.178.2:443 googleads4.g.doubleclick.net udp
US 8.8.8.8:53 2.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 sync.search.spotxchange.com udp
US 8.8.8.8:53 ade.googlesyndication.com udp
US 8.8.8.8:53 wj32.org udp
US 162.243.25.33:443 wj32.org tcp
US 8.8.8.8:53 d.delivery.consentmanager.net udp
DE 87.230.98.76:443 d.delivery.consentmanager.net tcp
US 216.105.38.9:443 analytics.slashdotmedia.com tcp
DE 18.184.216.10:443 ps.eyeota.net tcp
US 8.8.8.8:53 processhacker.sourceforge.net udp
US 104.18.37.111:80 processhacker.sourceforge.net tcp
US 104.18.37.111:443 processhacker.sourceforge.net tcp
US 8.8.8.8:53 processhacker.sourceforge.io udp
US 172.64.150.83:443 processhacker.sourceforge.io tcp
US 8.8.8.8:53 111.37.18.104.in-addr.arpa udp
US 8.8.8.8:53 83.150.64.172.in-addr.arpa udp
US 8.8.8.8:53 e2c72.gcp.gvt2.com udp
US 34.37.6.135:443 e2c72.gcp.gvt2.com tcp
US 8.8.8.8:53 135.6.37.34.in-addr.arpa udp
US 8.8.8.8:53 beacons.gvt2.com udp
GB 172.217.169.3:443 beacons.gvt2.com tcp
US 8.8.8.8:53 3.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 beacons4.gvt2.com udp
GB 142.250.187.206:443 clients2.google.com udp
US 216.239.32.116:443 beacons4.gvt2.com tcp
GB 142.250.187.206:443 clients2.google.com tcp
US 8.8.8.8:53 116.32.239.216.in-addr.arpa udp
US 216.239.32.116:443 beacons4.gvt2.com udp
GB 142.250.178.14:443 google.com udp
US 8.8.8.8:53 e2c49.gcp.gvt2.com udp
US 35.211.148.231:443 e2c49.gcp.gvt2.com tcp
US 8.8.8.8:53 231.148.211.35.in-addr.arpa udp
GB 172.217.169.3:443 beacons.gvt2.com udp
US 216.239.36.117:443 beacons2.gvt2.com udp
GB 172.217.169.67:443 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 3d93733532f32f9e393e96965d6783e1.safeframe.googlesyndication.com udp
GB 172.217.16.225:443 tpc.googlesyndication.com udp
GB 142.250.187.193:443 cdn.ampproject.org udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com udp
US 8.8.8.8:53 token.rubiconproject.com udp
US 8.8.8.8:53 ce.lijit.com udp
US 8.8.8.8:53 google.partners.tremorhub.com udp
US 8.8.8.8:53 cm.g.doubleclick.net udp
IE 52.213.218.173:443 ce.lijit.com tcp
NL 69.173.156.148:443 token.rubiconproject.com tcp
US 52.201.26.67:443 google.partners.tremorhub.com tcp
GB 216.58.204.66:443 cm.g.doubleclick.net udp
US 8.8.8.8:53 x.bidswitch.net udp
NL 35.214.149.91:443 x.bidswitch.net tcp
US 8.8.8.8:53 66.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 148.156.173.69.in-addr.arpa udp
US 8.8.8.8:53 173.218.213.52.in-addr.arpa udp
US 8.8.8.8:53 67.26.201.52.in-addr.arpa udp
US 8.8.8.8:53 91.149.214.35.in-addr.arpa udp
RU 141.8.192.169:80 a0995775.xsph.ru tcp
RU 141.8.192.169:80 a0995775.xsph.ru tcp
GB 172.217.169.3:443 beacons.gvt2.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
GB 172.217.169.67:443 beacons.gcp.gvt2.com udp
RU 141.8.192.169:80 a0995775.xsph.ru tcp
RU 141.8.192.169:80 a0995775.xsph.ru tcp
RU 141.8.192.169:80 a0995775.xsph.ru tcp
RU 141.8.192.169:80 a0995775.xsph.ru tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.180.2:443 googleads.g.doubleclick.net udp
GB 142.250.187.196:443 www.google.com udp
GB 216.58.204.70:443 s0.2mdn.net udp
NL 69.173.156.148:443 token.rubiconproject.com tcp
US 8.8.8.8:53 ce.lijit.com udp
US 8.8.8.8:53 google.partners.tremorhub.com udp
US 8.8.8.8:53 match.sharethrough.com udp
GB 216.58.204.66:443 cm.g.doubleclick.net udp
US 8.8.8.8:53 2.180.250.142.in-addr.arpa udp
IE 52.19.164.206:443 ce.lijit.com tcp
US 107.20.179.85:443 google.partners.tremorhub.com tcp
DE 3.77.214.116:443 match.sharethrough.com tcp
US 8.8.8.8:53 securepubads.g.doubleclick.net udp
US 8.8.8.8:53 ums.acuityplatform.com udp
NL 154.59.122.79:443 ums.acuityplatform.com tcp
US 8.8.8.8:53 226.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 206.164.19.52.in-addr.arpa udp
US 8.8.8.8:53 85.179.20.107.in-addr.arpa udp
US 8.8.8.8:53 79.122.59.154.in-addr.arpa udp
US 8.8.8.8:53 cxcs.microsoft.net udp
BE 104.68.66.114:443 cxcs.microsoft.net tcp
NL 23.62.61.99:443 www.bing.com tcp
US 8.8.8.8:53 99.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 114.66.68.104.in-addr.arpa udp
US 8.8.8.8:53 ml314.com udp
US 34.117.77.79:443 ml314.com udp
GB 142.250.178.2:443 googleads4.g.doubleclick.net udp
US 8.8.8.8:53 tpc.googlesyndication.com udp
GB 172.217.16.225:443 tpc.googlesyndication.com udp
NL 69.173.156.148:443 token.rubiconproject.com tcp
US 8.8.8.8:53 sync.serverbid.com udp
GB 3.162.20.4:443 sync.serverbid.com tcp
US 8.8.8.8:53 4.20.162.3.in-addr.arpa udp
GB 142.250.187.196:443 www.google.com udp
US 8.8.8.8:53 www.google.com udp
GB 172.217.16.225:443 tpc.googlesyndication.com udp
GB 142.250.187.196:443 www.google.com udp
RU 141.8.192.169:80 a0995775.xsph.ru tcp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
GB 172.217.169.67:443 beacons.gcp.gvt2.com udp
GB 172.217.16.225:443 tpc.googlesyndication.com udp
GB 142.250.187.196:443 www.google.com udp
GB 172.217.16.225:443 tpc.googlesyndication.com udp
GB 172.217.169.67:443 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 3d93733532f32f9e393e96965d6783e1.safeframe.googlesyndication.com udp
GB 172.217.169.65:443 3d93733532f32f9e393e96965d6783e1.safeframe.googlesyndication.com udp
GB 142.250.187.196:443 www.google.com udp
GB 172.217.16.225:443 tpc.googlesyndication.com udp
GB 172.217.169.67:443 beacons.gcp.gvt2.com udp
GB 142.250.187.196:443 www.google.com udp
GB 172.217.16.225:443 tpc.googlesyndication.com udp
US 8.8.8.8:53 play.google.com udp
GB 172.217.169.46:443 play.google.com udp
US 8.8.8.8:53 ml314.com udp
US 34.117.77.79:443 ml314.com udp
RU 141.8.192.169:80 a0995775.xsph.ru tcp
RU 141.8.192.169:80 a0995775.xsph.ru tcp
GB 172.217.169.67:443 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons2.gvt2.com udp
US 108.177.122.94:443 beacons2.gvt2.com udp
US 8.8.8.8:53 94.122.177.108.in-addr.arpa udp

Files

C:\browserreviewSavesruntimecommon\sALjCX2DJ1FjfO.vbe

MD5 5b4c9d21a4263bd3310afbeb618f42e8
SHA1 eae0a7615464b86cb86ba6110dd96d78583d5f3c
SHA256 87ced7720839bd67e4843c2bb8eaac2de03c608f1a2ee66068f551a3c74ef40f
SHA512 c2d275195169c7ed9746d2ad0741da073b84903c1c0831adf954f1221faa465a5d31a3885b33303858f66fa82fdb69e4efb058f8e7c36b06eefef900900fefb0

memory/1600-8-0x000001B5D7A00000-0x000001B5D7A01000-memory.dmp

memory/1600-9-0x000001B5D7A00000-0x000001B5D7A01000-memory.dmp

memory/1600-10-0x000001B5D7A00000-0x000001B5D7A01000-memory.dmp

memory/1600-16-0x000001B5D7A00000-0x000001B5D7A01000-memory.dmp

memory/1600-20-0x000001B5D7A00000-0x000001B5D7A01000-memory.dmp

memory/1600-19-0x000001B5D7A00000-0x000001B5D7A01000-memory.dmp

memory/1600-18-0x000001B5D7A00000-0x000001B5D7A01000-memory.dmp

memory/1600-17-0x000001B5D7A00000-0x000001B5D7A01000-memory.dmp

memory/1600-14-0x000001B5D7A00000-0x000001B5D7A01000-memory.dmp

memory/1600-15-0x000001B5D7A00000-0x000001B5D7A01000-memory.dmp

C:\browserreviewSavesruntimecommon\jt4LBgBNIUJsIGJZrjCIK93Fg0t.bat

MD5 4c037bd86379e42fb1367ad486900857
SHA1 1c12566e86fc161508cdc1fe77e1fa57682d8782
SHA256 4e815d481c421f6285580f0d77190113a5f21292ac2c69e3a0d62a0797e4fb65
SHA512 04188af986d5bb7ecbc53f1ef83d7673c8f31b3b187d2e3f0281aa3affec3cda56dfe50b19959dd8ef57aad3af6ddf00f9cf1fd5c48d057f0808769f841ceaf1

C:\browserreviewSavesruntimecommon\HyperBrokercommon.exe

MD5 02006b9d56f2799d5fd9ad8a3e9c698d
SHA1 89ba4cba2ede6543a8c3a943e51d05af666ba3b4
SHA256 1e502065aa16df514c741ddc34e5857d16baaf7d352c088dbfb239a955430517
SHA512 47efbd1b4b4bc5f6cf2ac17650d1a5bb4af256989ce05ea3e38bdb5eb3f7009784cf34a1a539fbc1ec9c39cf5f0cd10cba746dc117a3c71cab102f2e20dfc2c9

memory/2416-25-0x0000000000760000-0x0000000000884000-memory.dmp

memory/2416-26-0x0000000001150000-0x000000000116C000-memory.dmp

memory/2416-27-0x0000000002A20000-0x0000000002A70000-memory.dmp

memory/2416-28-0x00000000029C0000-0x00000000029CA000-memory.dmp

memory/2416-29-0x00000000029D0000-0x00000000029DC000-memory.dmp

memory/2416-30-0x00000000029E0000-0x00000000029EC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\HyperBrokercommon.exe.log

MD5 7800fca2323a4130444c572374a030f4
SHA1 40c9b8e0e5e7d72a5293f4010f2ccf21e637b4aa
SHA256 29f5645ac14353ac460858f52c856548f3aeb144b09eef672a6b4849bafe742e
SHA512 c8a7ad930b8c07007c7a67d8c32a2a4a401dcc34ab966e0e80901655fcbe1f5c95b72a195e6381b1de56c2c987eeab093d8e89891bec9e9684785c5d824b3554

C:\browserreviewSavesruntimecommon\9e8d7a4ca61bd9

MD5 1c56bd045a689baee928ff51912023b2
SHA1 8791982b4468ae7a5b612d458af49ac916119614
SHA256 6b24ce463577c835a5cd624ce24ae890cea5638d6e5e77c6e2d009ca23540c42
SHA512 39405407ceb7e7c5450b40bd6b41ea0c2a1aadebac3c5353ef4872836ee225bf8893c865fc501c3f4c6ac8d78003d713cf663c6312c7222a72d4c8fe21911bac

C:\Users\Admin\AppData\Local\Temp\stYrELc6wW.bat

MD5 e8e2d843452d1ecc2dcea16d76a72403
SHA1 3cb5991e5a92483b2d59bbc8e58dd302ef6e18ea
SHA256 0de37f3749b46931e50f31fe475bce9f07f40888f49b75eddbbf4f528f80593b
SHA512 ca5168a7fac1b8cd39004bd1eae902ee6a7e690e5016e6f91137af944f4746c816f0996c59a88e644a094efd12a09b136ef6678f5b6ee0b1633e4e9a83a3cef9

\??\pipe\crashpad_456_VFAPPFNCCTOTDAEO

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 207d2c95c59ba3adfeb13f85edb54e5a
SHA1 3ad60fe568b13ade40bff07569e351056464e194
SHA256 b563c598db26af0e67d73545d4f1e1185e52ee37c0d61d1b450d9788d7515740
SHA512 223c8a830eb5f79a429ef86a4927fc06d1e4ea9f94a4a7c431b4d161b258f505d000eeeab0be9929509b55a64ff73a3a1c9af6da2e28534b299c2b743a6d0c68

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 8af221a3f7433563a83ba265344bcdb0
SHA1 30073e1992f93b682c24021d26e28cfde3e43945
SHA256 97eaf651b63d73946acba2c728e1fb5f5053034690d7b14fedcc895d7d13412e
SHA512 a20db129d389fa170585d460d82f316a98700de5d7549e9f3a37b246527535888918056731f42812d03d1b71e8ff0f4ff1113cec45c5d1d4b51ce8b5bb28e6a3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 3755ce87717b0ba675937d752f61b9c3
SHA1 8676173d3f4583e296b21eef266bfef4b86d2ce3
SHA256 985170200dc257af5c7cd9d9cff39387dfd14e7fc59322e82f7ebc6c7519120f
SHA512 d28026cb23db2e00fa2474d9e5c12912e7eb1deed97c3c99c6f63b0cf9ac46168c90d7d0781f3dc164cd6f9b9e53dfe50f7f31d37315a1c602a5d2caf0ad9843

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 03ae3fbe6cc2aea446bedaf039c26f99
SHA1 0f3e10b72025f9879a2eabb11e83c1fecace1ebd
SHA256 7c41e2ba588d2aa8cd89a0fe7df4cc4fb768af2ae1a79b9bac98e3709277287d
SHA512 3c42822519c06a506ee581a1c153ebef2a6f51af8d8b789d41e4c0bf9e6693a25e3260ed755fc4c4ad55f9814500177da525159b8bc9d927496bf13d28a9a540

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 225ebeb70ae90586bba0b8bb1046486b
SHA1 3a47a47e0f488ba730f4da461292e1214ea950ad
SHA256 bb3fdca5593f7ad84131cb85b2d4a5e2c5cb486b291ddfce950feadb339e718b
SHA512 3903120b4321f2c75ae964d742e62f35081b9e4ae53dc33c200e270e7579147b1ffaa870348ae53a2ae0dcbad86a13e9b9f60924b43588c5c2f0f560e84a9d53

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 fa035bbd93a6ebac2948c38505de0bf4
SHA1 27af67d030ee2d439160e47fbc47f505185b05ac
SHA256 02726ba185dbabce6dc28e05ef9e0fe9e012c9c2427122ecbd2885d4c9a4eb89
SHA512 daac59985afd73ab517719cafd86a18f6c4b0e94d2533f8654ce7a536bc12efbb308eb524b02d49507b3bec75e62a92204d934341691f50a33618492b8731d16

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017

MD5 82b03f239b58044f1dc310a32f0f0cff
SHA1 58184e5e351719ec9b10bee1693260f4f34e37ee
SHA256 18a1e3a37e5cb38d38d452d2f0ea83b78b915a507ffa9860cac9c33575a3c105
SHA512 884d2835624980f8a8c4eab8da57f93f3b2de8dc4978070d48ce0df355db8a82c291cc8bb7c42703aa55fa11c7180ece5d5bd1877e77ac875fa6155e64576cd9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 ff510edbc4bc0064c3fbc47e0fd8dd06
SHA1 1c21071be904f341e7a9c57257fa8b7c73df3a81
SHA256 4b298d306530e51295e76e6806fc7f01357ae8d7b38bddd51eedf2080eb24e3f
SHA512 9cc2440c825215a2e5901fb4ccf414ba2009202ab8c5f069449aabe76395c00731f0dda82c1fee24f51e4543c8473863bdae6b70e9d2b76aa831d67435d80ac8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 07ce195e13041b9e5ad0e2a6c9ddcdca
SHA1 7633458bdfbbe6afd8eecdb9d309babd6191e348
SHA256 471447df6e8c8c04888074095eed1670b6018df22a79477959e85e94551c5aad
SHA512 4d63eb061942a130f29cdb3440cf7614eccfd58d30e353db3c441f5f96be10ac7f971d3aa18f994e0a80e0b63be43c31e45c47006d04c6c1e2fd251d069b0016

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000031

MD5 9b86dc777539aebfd789e96d617d56d3
SHA1 47dc2e3d14228e709d698f444aaaafcca1332c5b
SHA256 a7c52c6a098b711c6ba4d01aba64893cb94b3eee98ea481e9a4ce31f5e0d9077
SHA512 235c2a139d0f4a01b46d874044e1372a0e18ad9b1e91af1cad97b059935f7f38af1336077239ce16b6baa689e192c7bcf2173d3d8d3585ddde40840533322710

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028

MD5 98d9df53a47f21e2d4132fbfc3d80f2a
SHA1 5005bdd58df36d2034a8c90e3739fc4046ac7379
SHA256 8bf3ba80d43452c196bc554bd30ff184b13eda67d94b26e5ff6050e15cd4e4e8
SHA512 bc6319bbbdfa4a8ac317378cdb4cd1c4f979018ff4b550a8b5f914a58f1b746f62df402f7f54ea96a3b82cb54660c24fb94fd9e398d06fb91d38a40e2d02a9e5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000036

MD5 8daece21b0e579bdf5ad970a80d623ae
SHA1 33735687d888224512009c3d7c17dcc7eef4e9cd
SHA256 4b5f7a9a1d9c10ec2e8e568c2294c0939ea24ab117eebd4c5c67ae063a802d8d
SHA512 ca021b0d449bdce99c7ae792a5a4c49d995d2acb60033d11dcae3c8eff981fe60ad66884b27fa5afb77bffefe22211e2135e979853cccf04d4ec7de5273fe2e8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 6d7ea5f456f08b805ad9e950fb0e01a8
SHA1 8718093e64cf7fbeaefc74d91c026317f6b19f17
SHA256 0f981c672e6dc286ace5350c4d01a37fbb6ac80965fb9f18eec744983d3118ea
SHA512 c48197c219d522077796dcf4850a4619d9134444d5cb2593fcecc71adfc5a4f6d9af6894b91c12f509e056e41a27560fa2d96fc13061d38388af891dd8affd62

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5bef3e.TMP

MD5 952add123d5cf22e14b16a69d6aa4813
SHA1 7840fa3c531459b39b518ce6e9f2acd7ace21a71
SHA256 584ecebaee06b4090cd07e0fcec9e20f14bfd7a6d52242ab2f3d73b39a146fe3
SHA512 0886de85a3e85030203ae7b631aa9e30fd64009ed877346f127f05d057f1d8c0e6da03a3291f961f6bfa196496f1e8d095b01849577340b63645618d6b07dead

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 8bf9abb8fa0e127269ecac6a152943a6
SHA1 cbb23a9f63bdcbf30052439326cdd1c0ae3e9f20
SHA256 dd4ed3ed7ec0890734496cbb88de33f4ddffbc1421697779876a763e41bafdd1
SHA512 1861ba6ccd1e36f0256469ad8a76f5c28c510afd7b1d542a7baa29ca0ba1da127335259a40ae17d6e3629f5588eff53fb296432230b3080f60f33f82bf7508a8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018

MD5 69b550731f9a789a39d18eb917e43a4c
SHA1 20721285bcc8dfc47777e43b2d94a224469a0b50
SHA256 230bd4129d0d79dd196efcf6d9e8db962c5e750fa539dfb5b72ba43666485066
SHA512 0de48338b7108eb2b9206c57d382c69703f1424788f7c665f44e4ebf8fbc92da8f11d10416c03f37d62c0d72cf760b902ef52f8e41caeb89ec221f0fac76702b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000021

MD5 1ec0ba058c021acf7feaa18081445d63
SHA1 73e7eabf7a8ae9be149a85d196c9f3f26622925b
SHA256 ae17c16afbea216707b2203ea1cf9bdb45b9bfe47d0f4ae3258ddbc6294dd02f
SHA512 16a1b8a067ad4a33dcf4483c8370ca42e32f1385e3c4e717f8d0ce9995ca1f8397b15a63c0cee044c4b0fca96c4b648c850f483eeb1188a20f8b6cbf11d2b208

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024

MD5 077c5e4c290be431f65bf45bcb84756b
SHA1 91436c22edf2fbf452f051719f6569d11d53aede
SHA256 c268d69d4dd2d54eaf562d61f67f0b356bbaa70daadb768f627980362aa19f4c
SHA512 6adb63e28db53472f1b8800471cd69271632ef43460baf047563486bdfd67e0142693ae18c8c321629291a968154e872317357f37e240b511918b74d29149a40

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a

MD5 b596ff98a05792f3d86cc5033d20059d
SHA1 817b0e3af01a119396e0ee050626c5c3c147cf01
SHA256 e11b338a0c7e28a5a9b2002ca4cbb5f78a91544fec11cc96c48a2f6f000b4388
SHA512 a9e4419ac91b2f989b094ae54c8b31f2e57bd61915c1d28bf52323e3b6fed069c8092e2a5e7d019e57bbd03f34fb5160ff47cd48b19b0bce498825fa9adaa957

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019

MD5 c3e0371f47e1d0f9aa8c579b7830aff4
SHA1 45454ca0acd85f407ac2352835124360ef0a24d7
SHA256 ba0e395d09e14a9c25a53ddd9abba5b76c8c8f3887e4aabb74bbe3c49c07f514
SHA512 71b3f73a32a9446034cf59f4dd605fbb3be054ee11d2534737fa31d263491c220da5bf13fe0313cb12f5c2bc5f821eeb0095f7c53e069c92fc103defef541a2a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016

MD5 2e152ea9996806843082ed6acef52d00
SHA1 64d22bbc0ecd519b689edaa86c3fab7bfb9489df
SHA256 da3feaa23d32a129fc26f550c8dab39a3b00375b9e252093d4874733e5e60ecc
SHA512 bc112291d1eaa95218a1252659abe90f8d40d0de0b93b080ecd033a1d01add2e54cdd04ced465fa3de319e58bf16ab5d3cd2c3f779d89ed12b95e7d9b3791995

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022

MD5 87e8230a9ca3f0c5ccfa56f70276e2f2
SHA1 eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7
SHA256 e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9
SHA512 37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023

MD5 aaefd1e1290c9bfaf9ebed7e9a229d2c
SHA1 bdc4093d8e1b6fe3b5e947232d0c2a73fee9244f
SHA256 7521da082d84701882b3a7f6b137dfcae3a5f42c36a6758d1b0fb5024936af0e
SHA512 797149df0f6a3329ae224df83b659160008ab63de394c3d4109a4065b962834b5bde76013e7435e28e7f68ccb8c4c060c8ba1c437aa8c5c74ddf49f1e85d49ec

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 4538231ef152b4b153980fc44b21bf02
SHA1 491389320c7abe07af21151bd0fa926fbedf3913
SHA256 9302a168415308cef00ab65dd6c52c3892f1b6d7a9d7a0c78381ad47217ccbe8
SHA512 2cce02afc9da2f7ffb09c67383803032456aa803ffb45d48daebea069c634f8a34eb86ab4619a08798665755378b83d2147c225453b7c2dbf3bd4ec80d176354

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003b

MD5 eb28cda0920d6703e0c2107b5db54f1e
SHA1 07c4e6e87be08bd923d85a3bfd34a2e83b5cbe40
SHA256 923ef309ff13938eaf8129d6c938cb9d207c3387f5fe3b6b2951103633ec81a3
SHA512 2301f0dd57c1835106b4964e3d60073003df63cd7673063455780d35e20622cea56bdb8d5b1e66dd10fb72e50927e12ef2e12a3967d72c9c250e17b6cdad2bd9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000039

MD5 5366c57b20a86f1956780da5e26aac90
SHA1 927dca34817d3c42d9647a846854dad3cbcdb533
SHA256 f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa
SHA512 15d7127970436f2510344600f3acecc19c39a05f8e82c8a7950095386382b2e2da55883a5a9faa97b84452e67315b9ac1693b6592274c8c1c35c813dfeb543a2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000038

MD5 344ee6eaad74df6b72dec90b1b888aab
SHA1 490e2d92c7f8f3934c14e6c467d8409194bb2c9a
SHA256 a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196
SHA512 2a9a9162d610376512a8fae2cf9eb7e5146cc44c8ebde7a12e9a3985da1718c62ae517c25b00de7c0269efab61b4850a0becfbf04382a25730dbe9cf59825a62

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003a

MD5 64258145fad4e0f5df584713435d3981
SHA1 1f3c78951d6ea01d386d32175f6ef57884b6dc7c
SHA256 34efe60b875d9b510e3284ebcd235372e9ebce9c6bbd85901c8246b9763004c6
SHA512 9f978457533e5ab50e978f0ecce3e2a90a5362e3ca9f195a9e6bb6372744bb31e63a7e6099845b301339c31ccd83f01e3e982c21774891909eacc0952072c5d1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000048

MD5 e78f9f9e3c27e7c593b4355a84d7f65a
SHA1 562ce4ba516712d05ed293f34385d18f7138c904
SHA256 75488ac5677083f252c43009f026c2ec023ac4da3e65c5d7a084742e32abce3d
SHA512 05f9fbbd59c286024b3ad49961c4e0eaa1abcf36ed29a1d07ea73d2b057075d46fbfdda56f135145f942bd0c3d48246c73be1771c21861eec4ddf8bbc365a286

C:\Users\Admin\Downloads\Unconfirmed 486051.crdownload

MD5 54daad58cce5003bee58b28a4f465f49
SHA1 162b08b0b11827cc024e6b2eed5887ec86339baa
SHA256 28042dd4a92a0033b8f1d419b9e989c5b8e32d1d2d881f5c8251d58ce35b9063
SHA512 8330de722c8800ff64c6b9ea16a4ff7416915cd883e128650c47e5cb446dd3aaa2a9ba5c4ecda781d243be7fb437b054bbcf942ea714479e6cc3cef932390829

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 b81691fa6b061d25cd670fe47bb4f7a2
SHA1 69a9c94b7bf17f47882e2f34a0705e0809a07d8e
SHA256 66fb247d0f093cfd9f2e519ec7110b5f1fe13a837532619de773e58a947f5432
SHA512 bda030190df5e939bda2cd89d946defa1489b582c5a03c3ed262e05993b52abaa1eb555086e75da999915b419c851b177436337ae4a2d3e8c6a8b11a8a9fb510

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 93e58c487a9da0a4090346cfdc2c307a
SHA1 d9d68a929f12d5dddf57bae004080709e1e0df0c
SHA256 0c41a0f4cbbc2b8cf995f5996bf506703f5226143246525a3b07ee883a2efe3a
SHA512 753c63e3c3a5c5657da7ce6c71427868e508ff88ceca9d71e28e81a986507fd15142cf00abce33caf19db88d55ab0e39703988f1232ee9bcdd904dca11c261b8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 0d21fa3ac9b97e04257c4115792eda84
SHA1 39be711c64a49651c54071c220786e5202882a9f
SHA256 e51ae5819a83fa2b9959df1e89d2bc554ae77a3d2c92d5065c3866bcd0cf770c
SHA512 f73b55b2edaaabbab8cd19cefb9420454e81af3b527337d640a36efd958ff6e29f387f7bcb49ebc337064cd9e228da2a579e9449f2f15f12aee69c7397808f05

memory/3904-780-0x0000000000400000-0x000000000042B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-C9V5S.tmp\processhacker-2.39-setup.tmp

MD5 1c96ed29e0136825e06f037bf10b2419
SHA1 b74a55279474253639bebf9c92f10f947145ff30
SHA256 b10cf8cdf541ca0dd6df79e66fb4b0854dcac717aba034ba0c4961bff92fd021
SHA512 0e74854d9de4e3944b2cff9b5de7eb19fdec1fee6c9576cae6cd81741adf84eac421cb743b1df30183f645ffe849357b6a85b5be8d7f6e2efe289bbe4573e177

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 40707688a4bffc1e530c1a285bb28dc4
SHA1 d92f931beb83a60cfce517048fbe4cc0f150ef9f
SHA256 7144b1c2125d525a21e5398a8872f5cfbbb6d1c5a91a31da5c52c99119f615cc
SHA512 8b8323f4834afde81e55cef0da96ac8258869d4c4d26961e7ff1c1524b4e25eb273fb73ec36110a589635235f5bcf0d696c68743cb81212f16d30f0d3dce5b38

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 6030bbefd6223a78509ffa3089d4059d
SHA1 23571b3b997506d4f775b9c3e5ea8a66ff7c31b3
SHA256 8313e1596c3da4b894e9bbe2d20cb789a838dc361b86f5866927ac594a9e9cba
SHA512 3bebfb176019eebfad9cc6e053c29ddffed48a5c2c8348a3c7818122868b406d7f635f94489dd87d842321c89d83cbeb4f181b367b08fd1d3b12f2cfdfdd6635

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003d

MD5 0afdf107648b6ef157e7387f51eb2591
SHA1 2b3af11e2c4f554243690ef15c6f16cc4ca8cad1
SHA256 6e34c4f0dbda2be1efa3ad70a465928898699d15678949501a3d9e537e7b641f
SHA512 f27e8078763bd3855277579f86f3f15f850bc7537c6a4e2515dc3f282fbb8fa7e13f3e6f6445802dc9854fef0f5e3a52fddbb30b1d3df98da3d16513847ec700

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003f

MD5 dc64ce9643f420dce14516d9d1dd597c
SHA1 080e3ead8bd4e82e3114fb1874625f2499b6ec16
SHA256 6ffb874d4fdd83d2c7813cf33871abb4cb82b42e24d8845eb5552c603e14b234
SHA512 c5bb28ad7c0b5e05dc94b03e6da3f4a590191fd8065e97368d2d67ecd79012fc52e78ddf08f868ac2e14daa6e1c9bc1824ebddc5a0b15249340ace46bb5f81df

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000042

MD5 249caf58d601397658a5a3976407bbf0
SHA1 01e496bee108855cd3db2b18b9a86d4ad55a4874
SHA256 b3c747a6d7a635ffbb4dc242338f93235da562840ec63241091d22d765fc3b28
SHA512 3f8d50bb64664053d1d1db2c9ce4090b33f646855cad70a6a33bbd13427b161290d8db7ca0ca988b910155caa3fec72788b8aea55facf10fb01e470460833448

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000047

MD5 34d5015941e4901485c7974667b85162
SHA1 cf032e42cf197dcc3022001a0bde9d74eb11ac15
SHA256 5c166a5d40aeefd0679a14f95e47ff28824e66abba82adfa30be41803cc25632
SHA512 42cef1d6847f535a6e8afc0469b9f5ef79ce4ab21512ac7eeda8ef9667d5f24bb33b30aba9a29824b3d853d41d4addf6bdee2042cf4fbd0a033b61657c671f0c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000044

MD5 c869845493bc0ef07bbf72ff19a0379d
SHA1 31f779dcb67c4938a9965bebc9790a4e12c8ffb1
SHA256 d8fc8967e1f0e8cdf7c79d316e0b37d55c09070d598039c03c06c7aac3f2a10d
SHA512 ce58b30222630f2fe726bd3f19eff7b6f43cd78218e99021d7d51b841a9fb71d5ef691dc5ad91a7ceb700a77db5b137225f7002751e36e72944ef680e2b62b3d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000043

MD5 7cf211daec2b58da85cd4738520a9974
SHA1 60e4fbb3c8603b32ff8bc5d42719471f30872fc7
SHA256 f6bf10bfc69583a52a963f6154c380a2ee0c93fb4d24d9ac9ca03c9629482f0b
SHA512 c3c22d00469c152929ed278d194229880df1c5d341f2950638a5551bb2e95233aa9fe566095b5db93797af422f365863d085feefa965f802eae3ccb9ce3b435a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000046

MD5 ee6fbebf1a9aa793e43cc477afe313ea
SHA1 f501f5ed93a9e44920c698ec48863caa2d2c9112
SHA256 5a21d54dc3fe7ef406c6beaa92d780b962f83b8b300a52eac6f079fc36d4704f
SHA512 b4ee701cd9d76dc0b9ba1a97e172a39a7668132b53d37875a4a5cba40ee5b0f2d65fa509b9ef484f3b37d83c1dff055f6e6e077b035db0c9b244155ce83ac999

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000045

MD5 aae005860ecf5f6ed079c29f6a82fe72
SHA1 11fa8b7ffa2bb580621f74fd31bca4e14dbfec25
SHA256 d756476eeb0947ab05912e619613800e439b634b105104fe2edc73b80b9b1777
SHA512 e33b3d9f611b50a2896d44e2bcf0fd3026dcba2f816496afd12a39fc54fae6b24f827e6a162bac0256c67ee6eb5ddaf00007a072747925eb1549fd35e1d6a4fc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004d

MD5 94f3cd075711c9533d5c34754d748eef
SHA1 6d17b83bacb2d1aea0b3e7995dc7128cf7b88e56
SHA256 26922c1a98440b0c6b8141d2ed4d0f485fdca942fc1bdf304c723ad17224e7ba
SHA512 4996ef6edf0e7616cc778f06fafb3cacaf81de8ab66559b60617d87cbb6c7e8fbc3209aa2455dcc480f9e40bb6e162ed22a7ee25eca5563052530b1830a626e1

C:\Program Files\Process Hacker 2\ProcessHacker.exe

MD5 b365af317ae730a67c936f21432b9c71
SHA1 a0bdfac3ce1880b32ff9b696458327ce352e3b1d
SHA256 bd2c2cf0631d881ed382817afcce2b093f4e412ffb170a719e2762f250abfea4
SHA512 cc3359e16c6fe905a9e176a87acf4c4ed5e22c29bfca11949799caf8442e00ec0d1679b3d8754dbc3e313528d3e8e82c0ec1941e2c3530b48229c1cb337f6b8b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\2eaccbbc510c7d97_0

MD5 fb31daaecc6fb4000467e47a96434c83
SHA1 d423d4d102609242df02b7f3bfe4ed8ad214d9b3
SHA256 ee2e0265140c84f71dca3496da00070ad7f0eb06705e899a11f6c8bc63fc007f
SHA512 99e9894c4fc5b7cf473c2800215c79d58f704977dd08ef2f02df0fb978814fc8c6d8eb09d683606312406cbc13ec0eeb3c412b92fd63cdfe069d72c2eb41331b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\6ab79d33f9de9c36_0

MD5 3e63636468da6d5fd6eb5fef2a885cb3
SHA1 ed55fe57f207a741ca37b2a54d8b6d3a552d313a
SHA256 638417ba0f7b524629e7a6522eb69e0026205458c9dcb9567ef803a513be0a42
SHA512 a556f631cf3e58d3a6b172e8b4eb6e1c0bef86e4afdbefa54cee8af64fa440a17bfa6eba703fda83be5069b18eaf427bdf9cc050f2aeeb96d75288015420d13d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 e7ce6e0563601128436c7f667664b121
SHA1 010e5a7ee865bd4441a3753211f6c0885bd76e2f
SHA256 b511a0a3d1d94a8fe7d52c7c950b653e5c0ac8d998189be78ab37c60964a4cd9
SHA512 c4f44d5e536ed48205278fa990c0ea2443b3469915491471ce752faabde0b91347ac9f3babf2b767f24a308ce5bd6385781e837856abac7bc8d821f4b4b091fa

memory/3904-1035-0x0000000000400000-0x000000000042B000-memory.dmp

memory/1020-1036-0x0000000000400000-0x00000000004D4000-memory.dmp

memory/1020-1039-0x0000000000400000-0x00000000004D4000-memory.dmp

memory/3904-1040-0x0000000000400000-0x000000000042B000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 f6dec0aa3103ba0a0ed34f9344e0d07b
SHA1 54b13f8612652884c000575d17bec818b9841829
SHA256 db9861f5928bda7a20d616208c647c21971111a0eaf4178d1cbc59a898c4dec3
SHA512 2fd105f36b0635987c003c2d9f5211b0a1294296b967f09f8e2d3b3aae907512c7cdaf32c83621c7350540fdc925ce27e707d4bcb7553e69e8b6e9eff255b2c1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 84485ac57f260dca85294e3868818198
SHA1 8bad0fd6dad80e10fe17806a7daf62a56ee95fac
SHA256 3541fbd5d54cf79ebcf516ea0b283abadad9f22776b93708a7cc90b39ec1acc7
SHA512 4e4216cb6e527fac7b741c83637b8c1fa9b929fbc81e2b5ec1583b3005020664e1f47f5ccc02468dec57f4b95f404fde597e8eefe91d86f7d25b48113ac4c38e

C:\Program Files\Process Hacker 2\plugins\HardwareDevices.dll

MD5 a46c8bb886e0b9290e5dbc6ca524d61f
SHA1 cfc1b93dc894b27477fc760dfcfb944cb849cb48
SHA256 acd49f2aa36d4efb9c4949e2d3cc2bd7aee384c2ced7aa9e66063da4150fcb00
SHA512 5a4d2e0fa7a1a14bc4c94a0c144bfbfcef1ecabe4dc15f668605d27f37f531934778f53e7377bab0ff83531732dc15e9fc40b16f2d1f7e925429681bd5bdca73

C:\Program Files\Process Hacker 2\plugins\ExtendedTools.dll

MD5 bc61e6fb02fbbfe16fb43cc9f4e949f1
SHA1 307543fcef62c6f8c037e197703446fcb543424a
SHA256 f2805e0f81513641a440f1a21057a664961c22192cb33fca3870362c8f872d87
SHA512 0bbfe53e1dd933a3080d9775ad890fcbd73f9820885efa6b69e9664261249f34eaae3870f74de8511734fc9a0114f36e1bfc529a032d303a8e3e583e37a506c6

C:\Program Files\Process Hacker 2\plugins\ExtendedServices.dll

MD5 4858bdb7731bf0b46b247a1f01f4a282
SHA1 de2f9cbcec1e1fa891d9693fb3cadfdd4cfe1f60
SHA256 5ae7c0972fd4e4c4ae14c0103602ca854377fefcbccd86fa68cfc5a6d1f99f60
SHA512 41b39560e15d620733ca29dc37f55a939a653f99686ac86643ccc67fbb807ad95d1996b867319d98506f3b8a30772fff3c3317bbcc205987f48031923f674d9a

C:\Program Files\Process Hacker 2\plugins\ExtendedNotifications.dll

MD5 be4dc4d2d1d05001ab0bb2bb8659bfad
SHA1 c0ed9e375b447b61c07c0b00c93bb81c87bcfc2e
SHA256 61e8cd8de80a5c0d7ced280fe04ad8387a846a7bf2ee51bcbba96b971c7c1795
SHA512 31389e268fe3bf1175fa3c251ca026f77dc59361b8425c9826f31d18c5174e6de68c6092aef187f2bd2c92d89b3093a660b2fe6189af369293c1117c856b5cdf

C:\Program Files\Process Hacker 2\plugins\DotNetTools.dll

MD5 b16ce8ba8e7f0ee83ec1d49f2d0af0a7
SHA1 cdf17a7beb537853fae6214d028754ce98e2e860
SHA256 b4cc0280e2caa0335361172cb7d673f745defc78299ded808426ffbc2458e4d9
SHA512 32de59c95d1690f4221b236376e282c8be1bb7f5d567592b935dcd798b36b80e86da81741c5845fa280386f75f6eafc9bbd41035362984150b134d24aede61eb

C:\Program Files\Process Hacker 2\ProcessHacker.sig

MD5 2ccb4420d40893846e1f88a2e82834da
SHA1 ef29efec7e3e0616948f9fe1fd016e43b6c971de
SHA256 519c2c2ca0caf00db5b3eb2b79dfe42e6128161c13aeb4b4d8b86fbffc67e3d4
SHA512 b2a000b33d4a9b2e886208fc78aeb3a986f7bd379fb6910da9f6577603aa6e8237cb552eabca70445f37b427419beeff0b061090cb952331b8db322ce2e58bc6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 09e465f2ecefc7facffdc6dc917fbc51
SHA1 916a17616e3465f8b7fd91dbba5322370b00b1c5
SHA256 e369bfaafd964e0158b7eef4c87a22dfa1b325bfde476e6bdc4bd816c51321b1
SHA512 755a69a38eeeeae841c499ea94d5cb883ad2732536ffcd2d708a621a1154cff05908ed37aa4a99b07e4b8461e95b34c601f428da5036475067e475926e8f0fbf

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 9ec9a2421b21feec59e1d895ea84b4ac
SHA1 befc8fdb88f0eb3ebb9a707b118a57a3f86303b4
SHA256 6e5b50c2aaad7626b86b5161c94b459441b060ef5bfdda16d04838c382c2dd89
SHA512 adc7f9f035081be49a6165fba551ac524459e0f8ce4026309e538c1472c78e1380a85f0cc07352fcc5efc2e2da2571a52b2080095836b2b18f3b3dae3ffe0dd6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 aaea2448abeee81daecaef2709445151
SHA1 b11a6075e4d8a262509a6980818731e4b374468c
SHA256 8934ac416671a5f9d79c924f0dd7fa98fa4148a4ed23e52c64f2019d7d07fc4a
SHA512 8435231e823d6d60528e7c8d80093fe8c94e2bbf41890d269d0753673b6b180adc6370c6b74210a15e4757b702b1a30fe0dcd11b771b7198983981511a9da46c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 45d72e3342ae683b8215fceffd08757f
SHA1 02adec9bacd7d6f4dc3dcd6a0713561e1f3c5a9a
SHA256 476071283155d50f1598bd95941ec2003b428a31eeda7a5729e94b48c183fa5b
SHA512 19fe935bf63f88c7c74f21f14f3d01729e88cc10994f975d03617859b69f39922999edc255e5cafd7fa354b52a943ad44cdef31db407fabeb4071d60d2b901dc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004b

MD5 481f5276ad0115cc3a3795544187b170
SHA1 4f5195443166c762bc2930b5a26c0c094c59138d
SHA256 2378d1b08310b3fade0d8ca6be27f3cdcf6e22eb4b910b1642d1645a06fc3f19
SHA512 45dcd09c6bfc73df65946b24aa9ae064398b9cb0ecde680b94bdfb2147a259472305c7763a9d1a0065805613b769cd39dc17bf559136f2ab356e7074466e895f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004c

MD5 213ee0fb15c15f4d60668f76eb6ce849
SHA1 10724af05228b412a607b9da530b32ebd3ed63b8
SHA256 32e6af6526aecb416f3d3e74bf4add4becb3eedf7bd98e4c245df72f57e42478
SHA512 4ea2dd06222c2c4caa4ef4b3046e1a7d7bd05aabaf15dba55d17b186dd5c61c1a1d956f3ecc439c99b0945c3dce55f2136f949b8049e1b377aba649c9904f82f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 b8c8a3c5617ce000fde7b9ce3e9d55da
SHA1 cbf5a63ccf3b1980315a3a84f7331f3bc70a9cca
SHA256 73e84a847f49c6499f3f265cfa8efb3a564b6bbea66a1b7cf96b0869e90696da
SHA512 cbc25c16bb853516107b1dfe85e49153bdab264a7f1b44040f7c8866fcf8550d65c42114311c7d867e84c7cc96d0515b91992f5b525daa5ab3a52a171514cd4a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 fe20367c8955df8edcb50d68b10d049a
SHA1 330084911a1d7bbc96b6b72bcb3f090226d37e1b
SHA256 8bf8646b3e7c962805d97c5e2cd6efc2c1a83cb124581604b25170fbf4fae89c
SHA512 7490136eb01f7b95f6938a2f05681e0fcaa981a3daac4c24c96b835b8f498f091ae1c86bfd86ce20253c9924f8eae15f1c9ba35331dbede855f74ca222bf4881

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 01820831b3425cb05b01c80f1a7caac0
SHA1 51432c6a272c123287eb0f66fe9ed73c93873097
SHA256 bf26fad23c71028de245404fdc89ed0ff686bace3f53fbdc7dfb77e67860aa36
SHA512 1413159ce167bfd82e1b53e6803611fa4f5b3eb942aaaf2ce01d956bb9156c66fb0155526ee464f70460026471e8f764ce98d66363859330ff0783fabd99eabc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000054

MD5 b17255d44e7a6e203b72d7dbe2d17921
SHA1 7e50dd8ebb4af6fba066b0a23bc019f54d00089a
SHA256 6aa0234078ec77154960bbfd5e3eaa0c78388dd9d5abccf1f5f901086e03d2d5
SHA512 1847b92d50ca859eab0403563821c8a3d6dee0ab7388076a0cf295860dc6d7df76db47bb99886a75a4e5c7660a5d4fabb04ff12b1b04a041ac8d16f918653761

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\8a21a1ec4ee516f3_0

MD5 3959478f7ee12571558b10b806e3a4c8
SHA1 1e4dc78048e9e34710f940f1f079a05760612b70
SHA256 f74b177cf70c2feacb1d2dae5274de0509da8a61986acaa59745a5acaf62c034
SHA512 3a46d2bba4bab61ad8f4595bd9135ca6d4cc1a5b21e994eb3151be2bd54148fae0136a0a835ebb40c8618d0cd5ee4e42c784d05e37db9871f1ffedad693bbc74

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\d9527240db278163_0

MD5 e09396736af6852c250bd71242e13ce3
SHA1 4a9d617acd104ffad849a9fa92d6473a18b02d96
SHA256 8bdfb48d7f88d6a020648562cc2abbefe3cb9aec8d4d79515e68a6863a41d7bb
SHA512 70c5f7462712d15541365652e751f6a2f4c187871d52ad4adbc2dd231b7a80e591312b970b123fca72e15cc66eaa183a826f3cdc00abde5afcb993b34ed880e9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\60c0a88caa2cee10_0

MD5 ea1d5c6c4069ce14dadbecaae0fc778e
SHA1 af24a4890aa78e1a5a23755ef02c6d089382ec9e
SHA256 5614686cf2a49f906e73805557377aea6a9ee840f8b1909277788e170439cd36
SHA512 a45977269491cf24a246b145f48bf680b55587845cc2b5b2becaaeafa12fb2b928ef8ab11a64f1ef1b0f6e7eebb8aad6a4de25b5778108c221f2d7b77b393a11

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 099cc6a9e38d35030987decd28c28898
SHA1 95537560ccaf6c06a6c2c8c5cb655317d9856a95
SHA256 0f9befe825ece3478eb760f039347a4ace6ce086a481491dec29d5a04f7f1e1a
SHA512 8d221729f92eeb33aa9c1f0228eda1ce2eba7b47c3b9fdf7802a7952f2198c2a4a1037a54aef9f3c19150abea9a81b45c28e7c4697ace6a5e003b0990c9eee92

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 ce5c61951ce84f4072141e3e36f9755a
SHA1 5b86cbdaa6d962ce9368174c43a3a5eb07985c09
SHA256 67cec38b9f956a1a032f78d4d6ed52f3fa339d576a2b9f0cb809e47b25b1d361
SHA512 22a80d19e5d439a3009ad71560b0a963e96d57ea0b19bd0aa476df34d157315dca9138487bdddc6a94f97e9116409df45f3920c33e3cd03a3d363c525d572af0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 50093bf5daf867b7b7200aa3eb408239
SHA1 bb3732665724a2ecf3c24cb83e8f836fa224f85e
SHA256 694e8cb7d47c39d0196a1f8aa9ddefee1d05593999a13bd9507243dca3491d74
SHA512 3960b98b6d99750b83c9f7161012c3c171f14adaf7a1e25f8d1d052eb08c87747149101cadecff048fb1b19ae64ed4eb85b7f9453b41f85e43bce54570748235

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 62bad8111ba03c0a5f8638318101d48f
SHA1 26385bfa23b3b0f8a3f9d1f6d4f5c4f82dcec3fc
SHA256 6de7f2d79246b919aa835dddde954bb9f0c1d1c6a12dde786e92fe98638e7806
SHA512 45e56b5c49bdf06005ba9ad3ef703e1bac94696b6db7dbc31c9a76ba84842f35207b27a153c4153cc4f34c642758b99d7637e636499250589efe26cb7c65a6fb

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 7d3485ff6cdd2be57eab18c5894ca48d
SHA1 52032a0426fa00066bc8bb6ebffee4ddd5a8d22c
SHA256 ae67b1dc0e3d74a06afd4bce832a334eea61421e82f4d9f81157cdb7001a8c9e
SHA512 d014bc2f52900abcb7adaebf1fb5b32426623b1369d1dbb59e15d3d9be10e9b794df8063cc34503527f8e8fd2efe7946a84074e1d56de0c2e5249bece0e94206

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\39f996dd28d1a282_0

MD5 fb6adeea1176087bcc2c42fc56dddd7d
SHA1 063ead583209c9c7fa8dc94c19691c38dcb9c69d
SHA256 521e9818844ae6c0c8049b2fbc065a33af15452ca03983d9cdda71c41cddf441
SHA512 672c99ad5f663c8ba38a2876df625c3145c9a5e2d902b56904bc3689b0dc02ca0b39d7d71f7d989f7931c23f8394f8e8cb40446b64165fae6c6c895026ab08e9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\a17d98206430e09b_0

MD5 89b29e3c4e6442555462e6472c3320dc
SHA1 d6d95a7ac8dd9caa520ae40b72f86f466f54b1d8
SHA256 5d57397ddd494038150cf2efd08931d94dbfc5709f8e72530169efbd20d44e22
SHA512 10e6beac71bbd594b02b17e37fefb0fcd5e7ed717ed29e12ffee4fef2400d147de2fdec502d8608a3211a780cd5f7848c4be8f9fa8e3530a7582cf4bb8518e86

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\7aa649a637b40b1b_0

MD5 87538484e668d64de261b102832a3bef
SHA1 e8e0d720c558a326c40e7861223b280f6447195b
SHA256 99dae4875fd2e60a6e3f9f92af6698b69ab2bc3d1abbed637bea682857ba09ab
SHA512 1db440911e7a5e0b115632e511dc8600ddd55407c19a575ef2dd9fb91ecbe5dc245c188114fb91e01d91a34f778c6d72ac9fc6ffd327486d016bf6f07caf0337

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\eba0ae731cadbee4_0

MD5 992ba0850c83a4a1fa6f26a01c2a99b5
SHA1 5f034f7e4f7214377bae03b32b2c083b84b8ffa8
SHA256 3d82124a37382e2c114a3a861a1a61b2f6ba14da3bdf7b86a89bd9f08ad441e4
SHA512 14c04ff1dea12b64a6205cd694e11b3e2fe6f98ba9aa0d11af5c570f6ec6064c40534a31d5c39fb7185cdb0b828bb9459e3ef7a9963033d5f7c6ab489b4c4564

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\0ed0ad3a13bdec73_0

MD5 82130f099d14e48cd4b0592d7a0757e4
SHA1 0b9f2f3ae79c4c8b8dc978b16eb8ebea295db55f
SHA256 5ccf76220e0c1897de82dc301e436ab4c230ed19a07df0e9da3d49d933abe6c3
SHA512 2e01a4aae5a318c784271dc8c507607237fea895876bd11eb6962d55b7ef941a4d2c8bc7959c5438b4619ff9e02f60539a4251589b4f6228f090933511dc0437

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\435e545f20fa9441_0

MD5 667f568926b70f1737c2f7fa51db7125
SHA1 1c701e9dfade0ef30f04cb3c3dd7b6b1c5ae0534
SHA256 08a5ae9d7258835417a18a1f740cda23cf9437e1878487a99ff41e74c9d785f3
SHA512 be8620cb7e6eff7c7cbefbdbb930dd0887e936f7473fd10faa49d22594c57f5bec515600fdfcfd656ec774dbe85ce9b6a69a4a9fe5b02255fde762548afb4750

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 dd381e82ff6866af5c134df1eb6f667b
SHA1 9fc33141e96f4417f57bb367e9a40bda5494c66e
SHA256 cf74d9caadd5f1c8369546d130eb5777cf712d3639ebab25757d767cb96cbb1c
SHA512 54041f31bd0169d6832f3ea8097ef25ad72187ad39c9958409930b21ee8b2765f1439358aadf45a16bf523b9806bd452fe6895826e0d966b4074a425458b0ddf

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 3925ce3c74e71efeafb5d5af4821f18d
SHA1 068785c6dc968dc2a3ccd350a247ce3d02c57eff
SHA256 0a1e84b82529b4ca2e35b8c6ba0195abf507893d9b228b415ddb12981f223e53
SHA512 e543b37760291a7cae514860be69a80bafdab8ccc5228c6a90909817646c1f184173b6c9c3541672d09518fd0c62dadc50f47398e94c4f09a98d506a50a66582

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 0ce046ffcd9fd0d24d27b1068b2690a8
SHA1 5ccdecee4d02837e4234f21c310d4c7903b6f5ff
SHA256 d44aaa8af9ba2542dba82d6579e7d5bc7a5c54d1bacdfb7bc64fb9542181d4ea
SHA512 fd4cf8cc0b7666cef45710171e1cb78d3fce6f100596be5a85c0d1f1959a0a669aef3446c37d97c7179e0130903b761c09cdac604ca8f12f9ea8b51a5cf810d9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 4ec588354a8e97f07fb0f71ffdcad2c0
SHA1 41802de938da08d3a05c83bf754612b05f4eb644
SHA256 1f8add1361cccbd83f9ec4199c04a2cf366e75d48eade159dc335494819d1c4f
SHA512 c47c1616c135c089115b26b1e2abe807348e91d6f1b39b24e54c7c872b9a3957339aa7958390b6808bdda459a2cbb9fd53889dfcfde846b145e8a68fdb46c4b3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 c9690b328e232326c030376eb384ed15
SHA1 13041a79250eba0d9f26f639d513c3e339b65777
SHA256 e2f3512067d378133f68b68e54f6d01c9b7198ae520d7706dbbb448624f922c5
SHA512 d7851eeef8404613df7115783d6136056367e42781c20cb28739c55d6d525e91c6d03cbccc0245958ae970553b96e966f5fa278b871bf1c6684ca54352ac57d6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 207f54dca248f3ea7a9964b3539e18b3
SHA1 85bf9f0fcb7088a7e1edb2f8520a634c9b60ce3d
SHA256 777d66d98fc6c4ed5f86a66c4e29fdd0ed06e0de4f076d25f22e431a4250f333
SHA512 27c8719e539233bd09a3d6e3ec0de7cea15d169ba84a0af7e9388c9e2d2d5cd136e2fc289df0304507467ce9ac5a4d19e1640f3196929fd1003f3ad66d9aaf95