Malware Analysis Report

2024-09-23 03:24

Sample ID 240625-qata6avanq
Target Nursultan NextGen Crack.exe
SHA256 e766bc3bd8513eadc0d54e511049f1d35bc5c503aeef6cd38aa500d39d66da11
Tags
xworm execution persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e766bc3bd8513eadc0d54e511049f1d35bc5c503aeef6cd38aa500d39d66da11

Threat Level: Known bad

The file Nursultan NextGen Crack.exe was found to be: Known bad.

Malicious Activity Summary

xworm execution persistence rat trojan

Xworm

Detect Xworm Payload

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Drops desktop.ini file(s)

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Checks processor information in registry

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Scheduled Task/Job: Scheduled Task

Suspicious behavior: AddClipboardFormatListener

Checks SCSI registry key(s)

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

Modifies data under HKEY_USERS

Suspicious use of SendNotifyMessage

Uses Task Scheduler COM API

Modifies registry class

Uses Volume Shadow Copy service COM API

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-25 13:03

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 13:03

Reported

2024-06-25 13:43

Platform

win7-20240508-ja

Max time kernel

2333s

Max time network

2276s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Users\\Admin\\wininit" C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1724 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe
PID 1724 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe
PID 1724 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe
PID 1724 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe C:\Windows\system32\cmd.exe
PID 1724 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe C:\Windows\system32\cmd.exe
PID 1724 wrote to memory of 1244 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe C:\Windows\system32\cmd.exe
PID 1244 wrote to memory of 2556 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 1244 wrote to memory of 2556 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 1244 wrote to memory of 2556 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2944 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2944 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2944 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2944 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2944 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2944 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2944 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2944 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2944 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2944 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2944 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2944 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2944 wrote to memory of 868 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\schtasks.exe
PID 2944 wrote to memory of 868 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\schtasks.exe
PID 2944 wrote to memory of 868 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\schtasks.exe
PID 2708 wrote to memory of 2732 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 2732 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 2732 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 1784 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 1784 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 1784 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 2344 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 2344 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 2344 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 2872 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 2872 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 2872 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 1524 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 1524 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 1524 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 1852 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 1852 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 1852 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 1068 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 1068 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 1068 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 604 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 604 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 604 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 1828 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 1828 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 1828 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 752 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 752 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 752 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 1840 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 1840 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 1840 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 2720 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 2720 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 2720 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 2396 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 2396 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 2396 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit
PID 2708 wrote to memory of 1228 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\wininit

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe

"C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe"

C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe

"C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe"

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\и.bat" "

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Nursultan NextGen Crack.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\wininit'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'wininit'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "wininit" /tr "C:\Users\Admin\wininit"

C:\Windows\system32\taskeng.exe

taskeng.exe {2BC84334-8B44-4FCD-9E49-2607A3EC2640} S-1-5-21-268080393-3149932598-1824759070-1000:UHRQKJCP\Admin:Interactive:[1]

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

Network

Country Destination Domain Proto
US 8.8.8.8:53 seems-poet.gl.at.ply.gg udp

Files

memory/1724-0-0x000007FEF5203000-0x000007FEF5204000-memory.dmp

memory/1724-1-0x0000000000230000-0x000000000026A000-memory.dmp

C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe

MD5 a9aee64b701db5f8cfc3c963872403b4
SHA1 48079f6822d84ea354f301cdb97d2ecb59552e06
SHA256 f46d7ae8973b42a0cb892c6aa8d6a559b4cc1d0c67b1d5df3072c4f7f77b53fb
SHA512 696e745d488841c3b1a55a350d754b69a1d6b0d83fd9eac247229239951b12bfd98d8cbbcbfffd567966495a10950040edd77398702763071f6eeb50f13a3a1e

C:\Users\Admin\AppData\Roaming\и.bat

MD5 9885bc1f632421f329efe28818361344
SHA1 9d0838fa885728361703a6e2b36e2aa3603b05ce
SHA256 6a218880f23edb2a809ee20919f355f80ef4a0b545c3d79ffa8c848441eced7a
SHA512 ddb5252457e9e02a91073f58662cd2eb72d670827f5173e8705c9e41d55a4ba4efdab80f24371ff61573d250f7b8463ce05f9cec7c48085dcacd38cd21e65203

memory/2944-15-0x00000000000E0000-0x0000000000106000-memory.dmp

memory/2944-17-0x000007FEF5200000-0x000007FEF5BEC000-memory.dmp

memory/2120-22-0x000000001B210000-0x000000001B4F2000-memory.dmp

memory/2120-23-0x0000000001F20000-0x0000000001F28000-memory.dmp

memory/2120-24-0x0000000001F50000-0x0000000001F60000-memory.dmp

memory/2120-25-0x000000001B550000-0x000000001B5A0000-memory.dmp

memory/2120-26-0x00000000023A0000-0x00000000023AA000-memory.dmp

memory/2120-27-0x00000000023B0000-0x00000000023B8000-memory.dmp

memory/2120-28-0x000000001B9F0000-0x000000001BA48000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 686cb6753954c3613d18ea3cb7143850
SHA1 711538c8ba1620bf30d4a850ed1c9e9e59f0c871
SHA256 775c4c5d814383eee35b06b264635b3991d671f2789d1edaf3fd9135f8b0abe2
SHA512 b8aa57de53833bf30bc1f01b2102b90718a365b08078adf92b3955aa67ece7ebd4594ca8ffd9d18aa0a5ce5dd6c08d5e1702cb3dc404cb3ef22e033cd82afaf5

memory/2772-34-0x000000001B200000-0x000000001B4E2000-memory.dmp

memory/2772-35-0x00000000024A0000-0x00000000024A8000-memory.dmp

memory/2772-36-0x00000000025F0000-0x0000000002600000-memory.dmp

memory/2772-37-0x000000001B4F0000-0x000000001B540000-memory.dmp

memory/2772-38-0x0000000002690000-0x000000000269A000-memory.dmp

memory/2772-39-0x00000000027C0000-0x00000000027C8000-memory.dmp

memory/2772-40-0x000000001B9E0000-0x000000001BA38000-memory.dmp

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2944-53-0x000007FEF5200000-0x000007FEF5BEC000-memory.dmp

memory/2944-54-0x000007FEF5200000-0x000007FEF5BEC000-memory.dmp

memory/2944-55-0x000007FEF5200000-0x000007FEF5BEC000-memory.dmp

memory/2732-59-0x0000000000AE0000-0x0000000000B06000-memory.dmp

memory/1784-61-0x0000000001260000-0x0000000001286000-memory.dmp

memory/1852-66-0x0000000000260000-0x0000000000286000-memory.dmp

memory/1068-68-0x0000000000AA0000-0x0000000000AC6000-memory.dmp

memory/604-70-0x0000000000E80000-0x0000000000EA6000-memory.dmp

memory/2720-75-0x00000000001E0000-0x0000000000206000-memory.dmp

memory/2396-77-0x00000000010A0000-0x00000000010C6000-memory.dmp

memory/1960-81-0x0000000001210000-0x0000000001236000-memory.dmp

memory/1612-85-0x00000000002C0000-0x00000000002E6000-memory.dmp

memory/2728-87-0x0000000000160000-0x0000000000186000-memory.dmp

memory/2300-89-0x0000000000850000-0x0000000000876000-memory.dmp

memory/2036-91-0x00000000011B0000-0x00000000011D6000-memory.dmp

memory/1964-94-0x00000000003C0000-0x00000000003E6000-memory.dmp

memory/2772-96-0x0000000001040000-0x0000000001066000-memory.dmp

memory/1568-100-0x00000000010E0000-0x0000000001106000-memory.dmp

memory/2424-102-0x00000000011C0000-0x00000000011E6000-memory.dmp

memory/2888-104-0x00000000013E0000-0x0000000001406000-memory.dmp

memory/832-108-0x0000000000280000-0x00000000002A6000-memory.dmp

memory/2088-110-0x00000000008A0000-0x00000000008C6000-memory.dmp

memory/1716-112-0x0000000000C60000-0x0000000000C86000-memory.dmp

memory/2228-114-0x0000000000DC0000-0x0000000000DE6000-memory.dmp

memory/2576-118-0x0000000000FC0000-0x0000000000FE6000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-25 13:03

Reported

2024-06-25 13:19

Platform

win10v2004-20240611-ja

Max time kernel

926s

Max time network

929s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation C:\Windows\SYSTEM32\CMD.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation C:\Windows\SYSTEM32\CMD.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ytoaly.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\system32\wuauclt.exe N/A
N/A N/A C:\Windows\system32\wuauclt.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Users\\Admin\\wininit" C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini C:\Windows\system32\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Logs\MoSetup\UpdateAgent.log C:\Windows\system32\wuauclt.exe N/A
File created C:\Windows\SoftwareDistribution\Download\6552516fd4c3b69631580dfc880ed1cb\Metadata\UpdateAgent.dll C:\Windows\system32\wuauclt.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\6552516fd4c3b69631580dfc880ed1cb\Metadata\UAOneSettings.dll C:\Windows\system32\wuauclt.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\6552516fd4c3b69631580dfc880ed1cb\Metadata\WinREAgent.dll C:\Windows\system32\wuauclt.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\6552516fd4c3b69631580dfc880ed1cb\windlp.state-old.xml C:\Windows\system32\wuauclt.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\6552516fd4c3b69631580dfc880ed1cb\Metadata\dpx.dll C:\Windows\system32\wuauclt.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\6552516fd4c3b69631580dfc880ed1cb\Metadata\Mitigation.dll C:\Windows\system32\wuauclt.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\6552516fd4c3b69631580dfc880ed1cb\Metadata\78902938-e1a7-4f20-9988-af1f7b7b0cb4.AggregatedMetadata.cab C:\Windows\system32\wuauclt.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\6552516fd4c3b69631580dfc880ed1cb\windlp.state.xml C:\Windows\system32\wuauclt.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\6552516fd4c3b69631580dfc880ed1cb\Metadata\wcp.dll C:\Windows\system32\wuauclt.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\6552516fd4c3b69631580dfc880ed1cb\Metadata\TurboStack.dll C:\Windows\system32\wuauclt.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\6552516fd4c3b69631580dfc880ed1cb\Metadata\ReserveManager.dll C:\Windows\system32\wuauclt.exe N/A
File opened for modification C:\Windows\SoftwareDistribution\Download\6552516fd4c3b69631580dfc880ed1cb\Metadata\DesktopTargetServicedCompDB_Neutral.xml.cab C:\Windows\system32\wuauclt.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002b58b4804f1d39ed0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800002b58b4800000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809002b58b480000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d2b58b480000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000002b58b48000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\system32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\svchost.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000fffffffffffffffffffffffffffffffff8ffffff550000007e040000bd020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115009" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "729882641" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{570A821F-32F4-11EF-90FB-EE2A85AAE362} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115009" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "729882641" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\IESettingSync C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\MINIE C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0713d2c01c7da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0003b2c01c7da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000aa9cad4c9673b74c9a378d3b281cdc3700000000020000000000106600000001000020000000e3b16f13e7ee8d3e4e3a6d4db31a733fc5c54a539ac256ef91f658223982560a000000000e8000000002000020000000af5ad29e7209957c34425ac84e1ec89808ce2b039f3871f5dc234956a1b69af6200000003ce778e11a9310b3788c307be16e4ffc5b49acda7f0a78454a88cf8d41aa6c1140000000b1930d385fe36e24abdac4c2fa27bcc92cf525a0c7fa91ed7a445e55f2ad1e2ea05d219e050ab06fccbc36fefe5bd923a201bda22e195413c24caa95dd90101d C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000aa9cad4c9673b74c9a378d3b281cdc37000000000200000000001066000000010000200000009b4d475dbd498d1c652d338b4853c6a5019e5b36db49ca43a0f3aedd0f58f7f9000000000e800000000200002000000024a600c5c57bf81653df0c8002bd9b677b894f8ef22c32e1c638bfc28bb5ddaa200000000812c83b46a57761c6ce97144b75250cd06f53ec6ac9c5d20fab4bbc34c00a48400000000058ddd963bc3abd8ef9c997e90c404c748b9e636e2c225cc44e7e3c4959c2fcf308f7815a04afeff32d0aac4e5cb6c0509f2bee5c55e8f35649cf9ca4b02f71 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\wuauclt.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133637946656608249" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\wuauclt.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3665033694-1447845302-680750983-1000\{97906816-EA7A-4433-AEF1-7B28072932C2} C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3665033694-1447845302-680750983-1000\{D663289B-ADC8-439D-BF68-923E9566488F} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\CLSID C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{92680698-75CD-4800-A550-FEE6E05F70C2} C:\Windows\system32\wuauclt.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{92680698-75CD-4800-A550-FEE6E05F70C2}\AppID = "{7FB72955-BD6B-4CE2-9EBA-5CEEB67C24EE}" C:\Windows\system32\wuauclt.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings C:\Windows\SYSTEM32\CMD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings C:\Windows\SYSTEM32\CMD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3665033694-1447845302-680750983-1000\{AF6070F6-9172-4791-80E8-B6501718C487} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\wininit N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2756 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe
PID 2756 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe
PID 2756 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe C:\Windows\system32\cmd.exe
PID 2756 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe C:\Windows\system32\cmd.exe
PID 2340 wrote to memory of 2684 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2340 wrote to memory of 2684 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2340 wrote to memory of 1188 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\choice.exe
PID 2340 wrote to memory of 1188 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\choice.exe
PID 1372 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1372 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1372 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1372 wrote to memory of 1480 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1372 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1372 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1372 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1372 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1372 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\schtasks.exe
PID 1372 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\System32\schtasks.exe
PID 1372 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\SYSTEM32\CMD.EXE
PID 1372 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\SYSTEM32\CMD.EXE
PID 1644 wrote to memory of 1952 N/A C:\Windows\SYSTEM32\CMD.EXE C:\Windows\System32\WScript.exe
PID 1644 wrote to memory of 1952 N/A C:\Windows\SYSTEM32\CMD.EXE C:\Windows\System32\WScript.exe
PID 1644 wrote to memory of 2640 N/A C:\Windows\SYSTEM32\CMD.EXE C:\Windows\System32\WScript.exe
PID 1644 wrote to memory of 2640 N/A C:\Windows\SYSTEM32\CMD.EXE C:\Windows\System32\WScript.exe
PID 1644 wrote to memory of 8 N/A C:\Windows\SYSTEM32\CMD.EXE C:\Windows\System32\WScript.exe
PID 1644 wrote to memory of 8 N/A C:\Windows\SYSTEM32\CMD.EXE C:\Windows\System32\WScript.exe
PID 1372 wrote to memory of 228 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\SYSTEM32\CMD.EXE
PID 1372 wrote to memory of 228 N/A C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe C:\Windows\SYSTEM32\CMD.EXE
PID 228 wrote to memory of 5688 N/A C:\Windows\SYSTEM32\CMD.EXE C:\Windows\System32\WScript.exe
PID 228 wrote to memory of 5688 N/A C:\Windows\SYSTEM32\CMD.EXE C:\Windows\System32\WScript.exe
PID 228 wrote to memory of 3520 N/A C:\Windows\SYSTEM32\CMD.EXE C:\Windows\System32\WScript.exe
PID 228 wrote to memory of 3520 N/A C:\Windows\SYSTEM32\CMD.EXE C:\Windows\System32\WScript.exe
PID 228 wrote to memory of 1544 N/A C:\Windows\SYSTEM32\CMD.EXE C:\Windows\System32\WScript.exe
PID 228 wrote to memory of 1544 N/A C:\Windows\SYSTEM32\CMD.EXE C:\Windows\System32\WScript.exe
PID 5488 wrote to memory of 2000 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 5488 wrote to memory of 2000 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 5488 wrote to memory of 2000 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2356 wrote to memory of 5792 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2356 wrote to memory of 5792 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2356 wrote to memory of 5724 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2356 wrote to memory of 5724 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2356 wrote to memory of 5724 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2356 wrote to memory of 5724 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2356 wrote to memory of 5724 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2356 wrote to memory of 5724 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2356 wrote to memory of 5724 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2356 wrote to memory of 5724 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2356 wrote to memory of 5724 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2356 wrote to memory of 5724 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2356 wrote to memory of 5724 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2356 wrote to memory of 5724 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2356 wrote to memory of 5724 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2356 wrote to memory of 5724 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2356 wrote to memory of 5724 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2356 wrote to memory of 5724 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2356 wrote to memory of 5724 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2356 wrote to memory of 5724 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2356 wrote to memory of 5724 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2356 wrote to memory of 5724 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2356 wrote to memory of 5724 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2356 wrote to memory of 5724 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2356 wrote to memory of 5724 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2356 wrote to memory of 5724 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2356 wrote to memory of 5724 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe

"C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe"

C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe

"C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\и.bat" "

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\choice.exe

choice /c 12 /n /m "Enter your choice:"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Nursultan NextGen Crack.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\wininit'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'wininit'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "wininit" /tr "C:\Users\Admin\wininit"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=ja --service-sandbox-type=asset_store_service --field-trial-handle=4236,i,10582458631009492839,12932125510981375204,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault54146dbfh7a84h44d0hb134hcf3437a52441

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Windows\SYSTEM32\CMD.EXE

"CMD.EXE"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ipk

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /skms kms.xspace.in

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ato

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Windows\SYSTEM32\CMD.EXE

"CMD.EXE"

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ipk W269N-WFGWX-YVC9B-4J6C9-T83GX

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /skms kms8.msguides.com

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ato

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RestartCopy.xhtml

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5488 CREDAT:17410 /prefetch:2

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffef00eab58,0x7ffef00eab68,0x7ffef00eab78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2232 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3124 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3148 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4256 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4524 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4664 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4180 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4784 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4064 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=ja --service-sandbox-type=asset_store_service --field-trial-handle=4152,i,10582458631009492839,12932125510981375204,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\CompleteRestore.mpeg2"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1604 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5084 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97} -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicePickerUserSvc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://rt.pornhub.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --field-trial-handle=4372,i,10582458631009492839,12932125510981375204,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --field-trial-handle=2232,i,10582458631009492839,12932125510981375204,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=ja --service-sandbox-type=asset_store_service --field-trial-handle=5328,i,10582458631009492839,12932125510981375204,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=ja --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5360,i,10582458631009492839,12932125510981375204,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {2F93C02D-77F9-46B4-95FB-8CBB81EEB62C} -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=5368,i,10582458631009492839,12932125510981375204,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=6044,i,10582458631009492839,12932125510981375204,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:1

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=5400,i,10582458631009492839,12932125510981375204,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --field-trial-handle=6632,i,10582458631009492839,12932125510981375204,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.92 --initial-client-data=0x23c,0x240,0x244,0x238,0x258,0x7ffeea324ef8,0x7ffeea324f04,0x7ffeea324f10

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2304,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --field-trial-handle=1964,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --field-trial-handle=2324,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=ja --service-sandbox-type=none --field-trial-handle=4484,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=ja --service-sandbox-type=none --field-trial-handle=4484,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --field-trial-handle=4592,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --field-trial-handle=4616,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --field-trial-handle=4612,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --field-trial-handle=4628,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --field-trial-handle=4684,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\ytoaly.exe

"C:\Users\Admin\AppData\Local\Temp\ytoaly.exe"

C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe

"C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\и.bat" "

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\choice.exe

choice /c 12 /n /m "Enter your choice:"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --field-trial-handle=4480,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --field-trial-handle=120,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --field-trial-handle=4952,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:8

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:2

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://underical.suppport/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5100,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5084,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=ja --service-sandbox-type=asset_store_service --field-trial-handle=5668,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=ja --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5696,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5728,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5732,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=6120,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5088,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=4224,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=ja --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=6528,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -s LxpSvc

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultbbd9f53ah4ffeh4cc8hb9cche50beb7c71bd

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=4112,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1

C:\Windows\System32\FodHelper.exe

C:\Windows\System32\FodHelper.exe -Embedding

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Users\Admin\wininit

C:\Users\Admin\wininit

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.92 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f4,0x7ffeea324ef8,0x7ffeea324f04,0x7ffeea324f10

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3272,i,6877360656168868205,11918701633379547433,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --field-trial-handle=1956,i,6877360656168868205,11918701633379547433,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --field-trial-handle=2212,i,6877360656168868205,11918701633379547433,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=ja --service-sandbox-type=none --field-trial-handle=4520,i,6877360656168868205,11918701633379547433,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=ja --service-sandbox-type=none --field-trial-handle=4520,i,6877360656168868205,11918701633379547433,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8

C:\Windows\system32\srtasks.exe

C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2

C:\Windows\system32\wuauclt.exe

"C:\Windows\system32\wuauclt.exe" /UpdateDeploymentProvider UpdateDeploymentProvider.dll /ClassId f12dc78d-4f58-4a02-803e-92ac3b0ee753 /RunHandlerComServer

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --field-trial-handle=4292,i,6877360656168868205,11918701633379547433,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --field-trial-handle=4304,i,6877360656168868205,11918701633379547433,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --field-trial-handle=4700,i,6877360656168868205,11918701633379547433,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:8

C:\Users\Admin\wininit

C:\Users\Admin\wininit

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 seems-poet.gl.at.ply.gg udp
US 147.185.221.20:30996 seems-poet.gl.at.ply.gg tcp
US 8.8.8.8:53 20.221.185.147.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 cxcs.microsoft.net udp
BE 104.68.66.114:443 cxcs.microsoft.net tcp
NL 23.62.61.152:443 www.bing.com tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 152.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 114.66.68.104.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 147.185.221.20:30996 seems-poet.gl.at.ply.gg tcp
US 8.8.8.8:53 kms.xspace.in udp
US 103.224.212.237:1688 kms.xspace.in tcp
US 147.185.221.20:30996 seems-poet.gl.at.ply.gg tcp
US 147.185.221.20:30996 seems-poet.gl.at.ply.gg tcp
US 147.185.221.20:30996 seems-poet.gl.at.ply.gg tcp
US 8.8.8.8:53 4.173.189.20.in-addr.arpa udp
US 147.185.221.20:30996 seems-poet.gl.at.ply.gg tcp
US 8.8.8.8:53 kms8.msguides.com udp
US 107.175.77.7:1688 kms8.msguides.com tcp
US 147.185.221.20:30996 seems-poet.gl.at.ply.gg tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com udp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.200.14:443 apis.google.com udp
US 8.8.8.8:53 10.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 195.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 172.217.169.46:443 play.google.com udp
US 8.8.8.8:53 46.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.187.206:443 clients2.google.com udp
N/A 224.0.0.251:5353 udp
GB 142.250.187.206:443 clients2.google.com tcp
US 8.8.8.8:53 206.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 161.19.199.152.in-addr.arpa udp
GB 142.250.187.196:443 www.google.com udp
GB 172.217.169.46:443 play.google.com udp
US 8.8.8.8:53 rt.pornhub.com udp
US 8.8.8.8:53 rt.pornhub.com udp
US 66.254.114.41:443 rt.pornhub.com tcp
US 8.8.8.8:53 rt.pornhub.com udp
US 8.8.8.8:53 rt.pornhub.com udp
US 8.8.8.8:53 rt.pornhub.com udp
US 8.8.8.8:53 41.114.254.66.in-addr.arpa udp
US 66.254.114.41:443 rt.pornhub.com tcp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 rt.pornhub.com udp
US 8.8.8.8:53 rt.pornhub.com udp
US 8.8.8.8:53 rt.pornhub.com udp
US 13.107.6.158:443 business.bing.com tcp
US 13.107.6.158:443 business.bing.com tcp
US 66.254.114.41:443 rt.pornhub.com tcp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 2.20.12.87:443 bzib.nelreports.net tcp
US 8.8.8.8:53 static.trafficjunky.com udp
US 8.8.8.8:53 static.trafficjunky.com udp
US 8.8.8.8:53 ei.phncdn.com udp
US 8.8.8.8:53 ei.phncdn.com udp
GB 64.210.156.17:443 ei.phncdn.com tcp
GB 64.210.156.17:443 ei.phncdn.com tcp
GB 64.210.156.16:443 ei.phncdn.com tcp
GB 64.210.156.16:443 ei.phncdn.com tcp
GB 64.210.156.16:443 ei.phncdn.com tcp
GB 64.210.156.16:443 ei.phncdn.com tcp
GB 64.210.156.16:443 ei.phncdn.com tcp
GB 64.210.156.16:443 ei.phncdn.com tcp
US 8.8.8.8:53 87.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 158.6.107.13.in-addr.arpa udp
US 8.8.8.8:53 16.156.210.64.in-addr.arpa udp
US 8.8.8.8:53 17.156.210.64.in-addr.arpa udp
US 8.8.8.8:53 media.trafficjunky.net udp
US 8.8.8.8:53 media.trafficjunky.net udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
GB 64.210.156.21:443 media.trafficjunky.net tcp
US 8.8.8.8:53 21.156.210.64.in-addr.arpa udp
US 8.8.8.8:53 prvc.io udp
US 8.8.8.8:53 prvc.io udp
US 8.8.8.8:53 cdn1-smallimg.phncdn.com udp
US 8.8.8.8:53 cdn1-smallimg.phncdn.com udp
US 172.67.177.254:443 prvc.io udp
US 172.67.177.254:443 prvc.io tcp
US 66.254.114.156:443 cdn1-smallimg.phncdn.com tcp
US 8.8.8.8:53 254.177.67.172.in-addr.arpa udp
US 8.8.8.8:53 156.114.254.66.in-addr.arpa udp
US 8.8.8.8:53 ei.phprcdn.com udp
US 8.8.8.8:53 ei.phprcdn.com udp
GB 64.210.156.18:443 ei.phprcdn.com tcp
US 8.8.8.8:53 18.156.210.64.in-addr.arpa udp
GB 64.210.156.16:443 ei.phprcdn.com tcp
US 8.8.8.8:53 r.trackwilltrk.com udp
US 8.8.8.8:53 r.trackwilltrk.com udp
US 8.8.8.8:53 r.trackwilltrk.com udp
US 8.8.8.8:53 rt.pornhub.com udp
NL 45.131.147.145:443 r.trackwilltrk.com tcp
US 8.8.8.8:53 static.javhdhello.com udp
US 8.8.8.8:53 static.javhdhello.com udp
US 8.8.8.8:53 static.javhdhello.com udp
US 8.8.8.8:53 r.trackwilltrk.com udp
GB 195.181.164.18:443 static.javhdhello.com tcp
US 8.8.8.8:53 104.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 145.147.131.45.in-addr.arpa udp
US 8.8.8.8:53 18.164.181.195.in-addr.arpa udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
GB 51.140.244.186:443 nav-edge.smartscreen.microsoft.com tcp
GB 51.140.244.186:443 nav-edge.smartscreen.microsoft.com tcp
NL 45.131.147.145:443 r.trackwilltrk.com tcp
US 8.8.8.8:53 r.trackwilltrk.com udp
US 8.8.8.8:53 rt.pornhub.com udp
US 8.8.8.8:53 data-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 data-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 static.javhdhello.com udp
US 8.8.8.8:53 r.trackwilltrk.com udp
US 8.8.8.8:53 186.244.140.51.in-addr.arpa udp
US 8.8.8.8:53 14.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 ss.phncdn.com udp
US 8.8.8.8:53 ss.phncdn.com udp
US 8.8.8.8:53 region1.google-analytics.com udp
US 8.8.8.8:53 region1.google-analytics.com udp
US 216.239.34.36:443 region1.google-analytics.com tcp
US 8.8.8.8:53 storage.googleapis.com udp
US 8.8.8.8:53 storage.googleapis.com udp
GB 142.250.200.27:443 storage.googleapis.com tcp
US 8.8.8.8:53 164.189.21.2.in-addr.arpa udp
US 8.8.8.8:53 36.34.239.216.in-addr.arpa udp
US 8.8.8.8:53 27.200.250.142.in-addr.arpa udp
NL 23.62.61.155:443 www.bing.com tcp
US 8.8.8.8:53 rt.pornhub.com udp
US 8.8.8.8:53 rt.pornhub.com udp
US 8.8.8.8:53 155.61.62.23.in-addr.arpa udp
US 216.239.34.36:443 region1.google-analytics.com udp
NL 23.62.61.155:443 www.bing.com udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 edge-mobile-static.azureedge.net udp
US 8.8.8.8:53 edge-mobile-static.azureedge.net udp
NL 23.62.61.194:443 www.bing.com tcp
GB 142.250.187.206:443 clients2.google.com tcp
US 13.107.253.64:443 edge-mobile-static.azureedge.net tcp
US 8.8.8.8:53 clients2.googleusercontent.com udp
US 8.8.8.8:53 clients2.googleusercontent.com udp
GB 172.217.16.225:443 clients2.googleusercontent.com tcp
US 8.8.8.8:53 64.253.107.13.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 225.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 10.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 edge-consumer-static.azureedge.net udp
US 8.8.8.8:53 edge-consumer-static.azureedge.net udp
US 13.107.253.64:443 edge-consumer-static.azureedge.net tcp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
GB 172.217.169.67:443 beacons.gcp.gvt2.com tcp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 147.185.221.20:30996 seems-poet.gl.at.ply.gg tcp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 underical.suppport udp
US 8.8.8.8:53 underical.suppport udp
IE 94.245.104.56:443 api.edgeoffer.microsoft.com tcp
US 8.8.8.8:53 underical.suppport udp
US 8.8.8.8:53 underical.suppport udp
US 8.8.8.8:53 underical.suppport udp
US 8.8.8.8:53 underical.suppport udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 13.107.6.158:443 business.bing.com tcp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
GB 172.165.61.93:443 nav-edge.smartscreen.microsoft.com tcp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 2.20.12.87:443 bzib.nelreports.net tcp
US 8.8.8.8:53 56.104.245.94.in-addr.arpa udp
US 8.8.8.8:53 93.61.165.172.in-addr.arpa udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 underical.suppport udp
US 8.8.8.8:53 underical.suppport udp
US 8.8.8.8:53 underical.suppport udp
US 8.8.8.8:53 underical.suppport udp
US 8.8.8.8:53 underical.suppport udp
US 8.8.8.8:53 underical.suppport udp
US 8.8.8.8:53 underical.suppport udp
NL 23.62.61.72:443 www.bing.com udp
US 8.8.8.8:53 72.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 underical.suppport udp
US 8.8.8.8:53 underical.suppport udp
US 8.8.8.8:53 underical.suppport udp
US 8.8.8.8:53 underical.suppport udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
NL 23.62.61.72:443 www.bing.com udp
BE 104.68.66.114:443 cxcs.microsoft.net tcp
NL 23.62.61.152:443 www.bing.com tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 0.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
NL 23.62.61.129:443 www.bing.com udp
US 8.8.8.8:53 129.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 underical.suppport udp
US 8.8.8.8:53 underical.suppport udp
US 8.8.8.8:53 underical.suppport udp
US 8.8.8.8:53 underical.suppport udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
GB 172.217.169.67:443 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 beacons3.gvt2.com udp
GB 216.58.213.3:443 beacons3.gvt2.com tcp
GB 216.58.213.3:443 beacons3.gvt2.com udp
US 8.8.8.8:53 3.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
NL 23.62.61.155:443 www.bing.com udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 edge-consumer-static.azureedge.net udp
US 8.8.8.8:53 edge-consumer-static.azureedge.net udp
US 13.107.253.64:443 edge-consumer-static.azureedge.net tcp
BE 104.68.66.114:443 cxcs.microsoft.net tcp

Files

memory/2756-1-0x00007FFEF41F3000-0x00007FFEF41F5000-memory.dmp

memory/2756-0-0x0000000000220000-0x000000000025A000-memory.dmp

C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe

MD5 a9aee64b701db5f8cfc3c963872403b4
SHA1 48079f6822d84ea354f301cdb97d2ecb59552e06
SHA256 f46d7ae8973b42a0cb892c6aa8d6a559b4cc1d0c67b1d5df3072c4f7f77b53fb
SHA512 696e745d488841c3b1a55a350d754b69a1d6b0d83fd9eac247229239951b12bfd98d8cbbcbfffd567966495a10950040edd77398702763071f6eeb50f13a3a1e

memory/1372-17-0x00000000001D0000-0x00000000001F6000-memory.dmp

memory/1372-18-0x00007FFEF41F0000-0x00007FFEF4CB1000-memory.dmp

C:\Users\Admin\AppData\Roaming\и.bat

MD5 9885bc1f632421f329efe28818361344
SHA1 9d0838fa885728361703a6e2b36e2aa3603b05ce
SHA256 6a218880f23edb2a809ee20919f355f80ef4a0b545c3d79ffa8c848441eced7a
SHA512 ddb5252457e9e02a91073f58662cd2eb72d670827f5173e8705c9e41d55a4ba4efdab80f24371ff61573d250f7b8463ce05f9cec7c48085dcacd38cd21e65203

memory/1544-20-0x00000267E7EB0000-0x00000267E7F42000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yn4rh3pv.a3o.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1544-31-0x00000267E7E10000-0x00000267E7E32000-memory.dmp

memory/1544-30-0x00000267E7DA0000-0x00000267E7DB0000-memory.dmp

memory/1544-32-0x00000267E8160000-0x00000267E826E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 da5c82b0e070047f7377042d08093ff4
SHA1 89d05987cd60828cca516c5c40c18935c35e8bd3
SHA256 77a94ef8c4258445d538a6006ffadb05afdf888f6f044e1e5466b981a07f16c5
SHA512 7360311a3c97b73dd3f6d7179cd979e0e20d69f380d38292447e17e369087d9dd5acb66cd0cbdd95ac4bfb16e5a1b86825f835a8d45b14ea9812102cff59704b

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 e5663972c1caaba7088048911c758bf3
SHA1 3462dea0f9c2c16a9c3afdaef8bbb1f753c1c198
SHA256 9f7f29a4696876cadca3f14d7e43f9ede0c97fd64be3f5d94bda49a91b6a419e
SHA512 ff4e72c46cf083de62baa2ce2661555dd91b5f144294015f7b262fd4500cb67fe80e1871a82da63b607e3e9cef401f4b73c587bf1134637881ecad51aad1eddc

memory/1372-70-0x00007FFEF41F0000-0x00007FFEF4CB1000-memory.dmp

memory/1372-73-0x00007FFEF41F0000-0x00007FFEF4CB1000-memory.dmp

C:\Users\Admin\Videos\Captures\desktop.ini

MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

memory/1372-88-0x00007FFEF41F0000-0x00007FFEF4CB1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wininit.log

MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

memory/1372-94-0x0000000002400000-0x000000000240A000-memory.dmp

memory/1372-95-0x000000001B1C0000-0x000000001B1CC000-memory.dmp

memory/1372-96-0x000000001B200000-0x000000001B212000-memory.dmp

memory/1372-97-0x000000001C100000-0x000000001C148000-memory.dmp

memory/1372-102-0x000000001B8F0000-0x000000001B904000-memory.dmp

\??\pipe\crashpad_2356_QVAAOSWGLSSFWSHE

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 904172b9eb0b3dda2db63c2dfc083a9d
SHA1 56118d0e05010dcff505b9f1f1a36f6729ab9771
SHA256 44080f018e4b3d9acc403520c5dd2d4179d8bb11271ff00b7377effeca47bdc1
SHA512 05899f474ae6d169ec48c2fd41f1d93e2df414cba1acb2696ed3f381f38914e42b8470a2baf8eded2d2817fb71896634bd8df25b8805cbaebaf79a1ed918f99c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 bb627dd41c5229e31c290e924c90094b
SHA1 b1d82b092da6469aa5bc7fad996352936fbecc49
SHA256 fc634ed56dcd401cb3acf6a7a9b869da3812628a4f86fc0cbc311355baf66ebf
SHA512 17a940c5afd0af8a7ff1dffd8f3eb60cd97bcb75cf800640872e7a18f26a1c78c96abf0915e72fb68255b686bf2927473bbd36257217da0aad159bed047e51a0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 ec57088f805fac5adf5ea569ee675184
SHA1 3f5a32431bbc1d3f3253c28317011aa2e714ecd5
SHA256 448023f453e719cf4c071a86812bb4552a30c9495231fde58702bcdbe4be390d
SHA512 efeed2f3ef63f69d01eef0ba09bd4e6be10d1621ff66e8808abcbfd654085c1593ba0ecc6e06ab603894e10f360f39a73b48fe584d6a9282feab2a0a348989be

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 5b6c9859ac002b962a4f30d2045a44f6
SHA1 08cd086d003bd96797fd1555ce223eb86dab61b8
SHA256 4dd2234adc27c3fa2ea43761b5f61713daf25ae1bc703f4d80e402ce7ca27018
SHA512 3fb76835e40b2fd9fc6260af6feea7ec4707153d661d5d4ca7efd082e392c470b4d9d640b7e0b752e17eede7972fafbcd32cec1bb057c88cde0496aa1c17a6a1

C:\Users\Admin\AppData\Local\Temp\~DFAD38426004830D84.TMP

MD5 306d491be4a27e9b7cfabd5f06e09c57
SHA1 4450c1f6322f0a952cb739027f6f2f6e6a753cae
SHA256 a2ddd711764d91cd2c1524a4334f1b5034f3481e2c7111914213d2682e1a1f53
SHA512 5abeb70c21ed2b86c9f4cb32a303b102691bd4e252f6631b96d704542611ac7043caf173ace0e21dd9bfae23e643b081b265478b86a4242723bcf595aa1d94c5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 4245449e690349596d5d21fb288e3bc3
SHA1 0ab40197339553c8dc9d04cbaef2c7ccb6fbcadb
SHA256 cd44ea4d4a813bfa4a2f58ecf3501f732acf645e77f73e62f42bd829f428259d
SHA512 0a9d5156dc51415f445838ba90dc08bbd7a0cff51eddf5da5f139f903ad4ee922d9fc344aebe3eadb3d55e744945dc4c477ba5e8d99e52d1cfea54283dbbdbc7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 cf82fd99fffdac85c7b1d68a0aef0073
SHA1 4985a76b6e56ff0712886d8492b93cd5a7424909
SHA256 fbd6a29ba1edb58f81a697f333a2ba90c35d2f86fa71c81eb53ff3664941192d
SHA512 ccb2d5e442175b08ce300bc89664597691041293b1c7f86996bd2a7256e68710db47901a02531cb4545a6c31c24601e0a56c0cefc8e056658dd09e49784c1532

memory/2636-244-0x00007FFEF66E0000-0x00007FFEF6714000-memory.dmp

memory/2636-243-0x00007FF744F50000-0x00007FF745048000-memory.dmp

memory/2636-252-0x00007FFEF1280000-0x00007FFEF1291000-memory.dmp

memory/2636-250-0x00007FFEF54D0000-0x00007FFEF54E1000-memory.dmp

memory/2636-253-0x00007FFEEAB20000-0x00007FFEEAD2B000-memory.dmp

memory/2636-249-0x00007FFEF54F0000-0x00007FFEF5507000-memory.dmp

memory/2636-248-0x00007FFEF66C0000-0x00007FFEF66D1000-memory.dmp

memory/2636-246-0x00007FFEF68F0000-0x00007FFEF6908000-memory.dmp

memory/2636-245-0x00007FFEE9140000-0x00007FFEE93F6000-memory.dmp

memory/2636-251-0x00007FFEF12A0000-0x00007FFEF12BD000-memory.dmp

memory/2636-261-0x00007FFEE7D60000-0x00007FFEE7E6E000-memory.dmp

memory/2636-260-0x00007FFEEFDA0000-0x00007FFEEFDB1000-memory.dmp

memory/2636-259-0x00007FFEEFDC0000-0x00007FFEEFDD1000-memory.dmp

memory/2636-254-0x00007FFEE3FA0000-0x00007FFEE5050000-memory.dmp

memory/2636-258-0x00007FFEF0610000-0x00007FFEF0621000-memory.dmp

memory/2636-256-0x00007FFEF0AE0000-0x00007FFEF0B01000-memory.dmp

memory/2636-257-0x00007FFEF0630000-0x00007FFEF0648000-memory.dmp

memory/2636-255-0x00007FFEF0D40000-0x00007FFEF0D81000-memory.dmp

memory/2636-247-0x00007FFEF6750000-0x00007FFEF6767000-memory.dmp

memory/2636-323-0x00007FFEE3FA0000-0x00007FFEE5050000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Log.tmp

MD5 a60b1e4aea06efbc4a992faf6b2103ed
SHA1 4e88b75b5a689b5236a920e087538b16352dfe5c
SHA256 3524ab61a42f0be7509dd5b3b50ae69a2bbf1d50c96e970228ad455b1e934039
SHA512 da59bedf276b98d3fa7ab55b663d9799448d3c622a28042c9dbe2dfa1522c20483440e2743e458a5ec388ee46e0e17b49e85175b0e66ce60d5525455b6c91a88

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 6551b09fde2bbca312eb53e274f8d400
SHA1 a10c326ed8020733409b680c37f3b8b9d2e8ebe1
SHA256 821b6babb5350c927a0f1fef98c542de9e829f61c64143e9f414e6237d05355d
SHA512 1025d839e29a03c95da74b50d681de52e5660f8a62786abe5705ed626c4d8defc463a786042e520b2e88c437c66618d5bdb5d60aef1cd5327f6c45243719cb5a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 ae9ab065b10c6a1502c2402870bb0315
SHA1 21c9af93227491499f8947b2d56c5cf3f715970f
SHA256 1a69e68050224160e73315f4a62e4abb18df0a5d5fe573813b1cf072d7333a2e
SHA512 3d85eb8f3e80828a1b8ddf414538afcfb92ae8ded1ca60e219398019b73d9b175e40612176fd86790048e6e3f4cace4fd95c850d4f08edee969184fe65f39f0e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 e8316a17f9ddfe162636dba93373621a
SHA1 8d66a815e1ad8cf3737dfaa038e2fcb39e96a149
SHA256 8e3113e59794c927cf73157399ede177a8c048a1c1e43954341fcb6ed36276b4
SHA512 9c57a88e899035af11bd0ed9a112361133d2c4f1d758635c8c3019ba6892004d4002af64b6314a9f08cc742d46d35275cf3c1d1d45e30621a3bc34e40fe707fe

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 6f2140379346c8da0a9b59829c9d6546
SHA1 fd634e583f58e332349d503007a37ffeb4a36234
SHA256 666971f1f784a1e44b039f2c893034b7017abd8eaf2e3ad788fef8c00ef1afd4
SHA512 0f98c30a8a80994980f0afc861ec5b43cff070faea6aa1829b5d88e64aa941f114479aa4d2748611ffd859fc39ee5dd39cfeb496a9b6b20720d00e35ae2562b7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 30949c611a6873332a8fb30989717961
SHA1 42001b35edfb1abf29ffab8509f82378444e14e4
SHA256 2df6bd1d07757fa3d8d596ba74225504c86457930e8277e1ae90789a17452c57
SHA512 5bf98fde495831b8c874bd2ec42142de2cd7532531065fa1355dda5b8df490bfc9209406e1d10991f6de9baf688eb0ed05b24df213d1b1ce6c52327eebf17dca

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f8d3187e-afa5-4887-8f27-ca234160ba4a.tmp

MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

C:\Users\Admin\AppData\Local\Temp\scoped_dir6724_526119310\426f3567-85b4-45cc-b209-b118ca593d14.tmp

MD5 f8e609603d53c701422bbc4e026740c8
SHA1 5d08ba917111a8fce835be950477156720e57437
SHA256 aea99c066addc7157626d59326d8e5589402f6aac551a0560b92710ba68ded8a
SHA512 5cbdfc06d076665752b4a1aefd697f8af7dd2f673c2a65d363dde5e27e97451bbf6d6097c0b9003cccc886b1ec0cc3cd66be58c57076c181d2749249395462bc

C:\Users\Admin\AppData\Local\Temp\ytoaly.exe

MD5 c249d5324c19769443136eca7c0f5551
SHA1 0bf9b432f1308db8194ed60e0befb91b7e3cddb0
SHA256 e766bc3bd8513eadc0d54e511049f1d35bc5c503aeef6cd38aa500d39d66da11
SHA512 5a6d602aef885c1c601a20ea1f76f7becc6f85e81480130ea85b4298f447253192b70b2490d80ab9f045b776433896648e038f7da8e10c4e81ad6ac048c726fd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8e6a4dfbc8f5f7c12f014cb69efe2738
SHA1 41473a27fb27c0cf8ec7ab856b636c1ecafe9fef
SHA256 6b80dc0723853e4b790889d1a2a45f1c4cd0cdabdeb13818d94499e3c6c6edbe
SHA512 665e14cc9412558b7ba7b6cc3d988e6c6ed5e5f57b00599688891cd40f319c9c46ffa3386011d6414779fceb713d99b185503a50bff6a94196b69b732ddf8688

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 82685e2fcf9ba9b1e59d114e18f1d8d1
SHA1 1983aa172428fb22e4826fde7c09a283bc53b8e1
SHA256 6422d07834a131ed81395600c1f823933b31467854d421a5043b311905581b04
SHA512 cbbd6e82b1f0cda8c5d1a62f82c1f14defd57627c16e9dddd912579e83d114dd5550265d841a0bf9add4cf046ec554c1de8dea7e5caea154339e9810b52e2476

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 a0dfb601913acea95a20cc4cdb264b46
SHA1 2f6ad34930c4b2fe885c80272e8672d51a86f78c
SHA256 7a91e3cde05ce9c902f05ddd703767d968fecd40b63437b7235a5672e1adc1f5
SHA512 e04125db8267c98de4f8dcf8f7ccecd69030a23c4e995d1ec0c67796db2226269ee06066cdcee02862bc291a18d9e8842c568c4d6cbe9ce47ea6b1e23e8c4559

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 0e25722ba2136b2e01171dee9ff3c98f
SHA1 ebb8a47609c324b63239c8d1e21e009742086df4
SHA256 e6b82e6b62753ce3650c6c2da78abcd4cb80f82656cd23237b895093e76c79ff
SHA512 358f1af99b98be46750e2e24000dda6a3dfd0c6a6e7b0557280410601053bbf6c8cd2d2d5b901d750ee34d8b3f039d6aedc5aadd1a756a86f352a788d3b34912

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

MD5 e4f619f665316f800c24ddf799615977
SHA1 c769ba4329fcf833b8d780d3fc744f60b330e5e4
SHA256 8a5ee514d7b71bed2be83c47f119c8df7098546c65725057cc2e559ef1e080c4
SHA512 3bfa738a7247e68f9793dc15bf978f80fcd0b8bf9cca1c0525a686b6452bc702c0bac87c1d3c684db0f7d9466e7be9c27c778bb42870f1d5f7a8ce0859444f1f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 276601c862b7db805a987a5bd1ae60fb
SHA1 0ba121f59e406aecc86b3d9e246a1ad5d88aac9a
SHA256 752735b10eb305136d6f8fbce492935931a59daf5a6a12c19d9aa690c449149a
SHA512 9b373d37c52322cf2ed05aebd94f329d17e345d0aa352d009a147c870f250a0816529059f3448326618b2d2afca7ef3b5b353c3279eb93c27b1e1ea64fe548e0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 5385db4107c003d331b6550ee6c99586
SHA1 fdd88999453404d157c54c59e9867def844bceab
SHA256 99a1db84ca16c5ab57f2036725fb4edfe750e6459405cc9627d88764c2aea81d
SHA512 c5d9974fd032ab096e0239f5d56e636e8a63768d04b910493fb6f1383bb77e575f600dbf64e8d48dd8e6d545dde629334da179b4e2c03af9cccebd7407af5e42

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8593c743fd8078156a57ae4f08780380
SHA1 0d991c8b77c89360c632121ceee97861a4d3bb6a
SHA256 fda4393ec32d807d2fc2c1d4258f9ce54c9407f5e8778505e1b13ccb014bce3d
SHA512 56b7dd57e29e18c919cc340acac90d26d22752922f5e554463c08d87e0f7454f9b99382ccccd78f0a4de56ac3d221c6ac53224231f761442a229ca8d3827656c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

MD5 24f14130bbc98016ccc103d7f16865df
SHA1 480d1b0d1f4f473d23b9f36b15508c181af4f5f8
SHA256 4d852094aceb62a02a9e45d8e9fc34ab5647c4afbe44fb1da7d91cf2926cc4b1
SHA512 9b90557ab8e95da84b9f92cbdc892eb26d7b1af282a3ba485861243ec2a968960be5fa4835b06183dd3b140c8089519dce12a7999f976a4f4f4f707add2dadc2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 300453ea5df58d5fc831fc97eba70f7b
SHA1 9c53d3c56c8137748f802d7537a1dab915947e0b
SHA256 b1bdb027f9fb9e9e282a98d488187fef05122d00fcc5690da2a119a8fc79c3c0
SHA512 442d479b0efde33f7240d005120b5489b930bdf3c8d6b053a48ae82a8e1b7da28925521fd2e7dbe86412e6feb9ded2b492622f18ec7741b0978d1750d9fa7ac5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 367c87d00ecf99283c40e460b28f3d56
SHA1 d420aed0c119c7566a3585f3f01c81cb81aabd80
SHA256 b661c9a4c6da5b3eae97e9194bd01a0a944ec9d120517668575c94967efecba5
SHA512 7ec625ca7f10198f2f98d7dc9d41eb1dd1da9f07cd1afa8c3d5d9693e977c0690192df6c4ae2041fe19c3919a1c864fb90bc2eb2d4980c7f4bc3892335937d56

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

MD5 35942a7e1ab463364749df50a483c5fc
SHA1 6b4f8da8bdb7b4f887aca539a27751a4b561ec95
SHA256 1e885847d3ccdeda8d2887b6872cdb11ff4374a1ef63f7f73c4b1f93ac75a420
SHA512 af23d542af857361709e25604c633e89583ed03231121febafeb4570e3feeeeca408203804fd6aa9e0d79ca10d3ad29948538e4078f32349db24c3d84144249b

C:\Users\Admin\AppData\Local\Temp\Log.tmp

MD5 14223a69a9bc994992021cabc77117dd
SHA1 818923d3af126897b2285f9dd4c95b8e240cf2ff
SHA256 ac37bb367f3689946220a2332014e2d44e214e3d2c77986c8e79681e39af9578
SHA512 0eb3bb6c120dd061b619a5bf62ce07a301c3266dcd5f763e1409d2b3f2096b2afb7c54f79036cc92f416cfd40c8f8d4ad2b94f1d6dcb39cc8255a2cb1dde6f9f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 16046289a6d90c9fc275db33a2e44d0d
SHA1 562534c837742c84a71c3169701bb152bc97313c
SHA256 693a0b32436ced38a600b960933a4986253693c96e374ad3d1b1739b6c5de8d7
SHA512 dd71653aacafe905f48a80c5da3a13955ed3c368586b481a654478a7a6d06cade9110a334a2a0d098528eb8afbad110d4cfb4ed1ed0004f5ab23f33ccb05af66

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6b2970f01267b5104cfadb572776adbf
SHA1 911a5df03ec841c1e660dfffbf7591251715fedf
SHA256 53f62638e3b422490b47da7f078754d05f756e2b2d59017faed42f32ee1a2bd7
SHA512 75e20adf02de4de0874f474f59615b72bbfc5c891daa7f82e30c4a89a127951ba5731f6831954077c0a9b13d911fa102519222db48d248c305beca767479cd27

C:\Users\Admin\AppData\Local\Temp\Log.tmp

MD5 e58f3052561063691350d3a7c5c5eb41
SHA1 4d7e44c71a122aed0aec3873f4be063a19e8c030
SHA256 540bbb2833c2506d3b22767cecacdaa6f83e89b0d8389c9497141fe812b2a6de
SHA512 2298cf5086bd4ec356c35e083c9ea5f8ce45049f14889187cca9da281e2b6e9aa39a37ba827428301362a2e5e296676b16e98a57a5020c2c77e0ef1a33b9bd82

C:\Users\Admin\AppData\Local\Temp\Log.tmp

MD5 1f0924dc27b4855a4f66717d67740dbd
SHA1 f6cff15ca5cf44b320050674ec44c426c84e85b7
SHA256 d69727bc0b58a10610b428724a687b1210dd3f4db707f71ad7c2ecfc4af8830b
SHA512 35b9696f3dfb03cd7e20a238e27bf4d8e96bb247c19b9049c7626270c4e064be2fa3d0658592fa299dae04e3ff8eb51309c4829ddb258c48f762998759c2922f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 bae2b4b80e1569701becd0d061e9aa3b
SHA1 29fe0e5d273b94d2ad9663f21404a8b244707bf4
SHA256 7328bbb7fc1796509ee4a38725a6f6521e027d931c3713f81b9602cbce553471
SHA512 c742267065ef21d3badc0ad5e442a5b12a2914b32c3aefe6ce32256f49d9058945cb01711143d713dac83c79331481f93f70ae2ee1d61029bd70f1af941c150d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c9f6e20f9e758a847cabe842ed4c1700
SHA1 aa9f3ce35e28104a3165df477db5696b43ff4891
SHA256 97f35b5df17108c5d62dbedfe3d0b8aba8facee33ee2f598d131d314ee9b26e3
SHA512 759090199607e4934dad1d551f45f0e3dfa3f0bc7374a3a9c0e3e8b594f11a2106f372c9eff8badcf2e6342794993e0006e80601db3a686036daf32523220143

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c5f8c505948b7cca676958a943d4552d
SHA1 09894d4694656bc61a84831f1361d7d2f4310872
SHA256 9f280caa4cf75abea69f19e12e899a156b4142d6317c98814f108a3662531d2b
SHA512 9d0a1fc353f27670fbcd133eea62353ee3c4de4c3cdb539442901b445b553863924b4f04b8e6ba543c94c8800d649cc134535e3322a77be9577bac060fd5b255

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

MD5 d8f05ea5182468df5c130426931d0a8b
SHA1 7ed92511e58b611c812edb4a661b5a4a0f7894b9
SHA256 6e2835b18f0cbcbc8165718ade739cb07e84ed9d769b4845a04ff1c52de5dce0
SHA512 c77f94a1503c170e8db868623c88f0e039ebbc88b7104f26ce2252778aed2578c28855876daa36bcd746ed715be653cffd88ff67944f061f8a8ed8c53294f3c1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 5f3b81c7d30d894476300ba32709cddc
SHA1 1c5bf1e4e62b068356981efd4752e42c333fa29b
SHA256 b11291c66a7d2966cd851debebbe4921494173932e446f979c7f757fe4d3e6d2
SHA512 65b8866be852259a93116f2c07f1185cb39d11039e8938ff458c8d9166af2946390c3fc09d3ed0d1c08b250a0bb267f330dbc294c1c5683fa8c19f333afa6577

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 d3cd8799b010bc775d37cf42f30bef80
SHA1 436f96dbf77e900af198e789b06186af365a4b29
SHA256 7127c72e292bab3939876cf9146fc4558e522b710c511c7a69d0000e0449e242
SHA512 50f9b6ce6feb6f4c04ff0f7792dda3da127a4a6a577883ba2a09e51b9a4d47613d938d18a851fa3760a41ff42ddaf45910fb258bcea85f441423e64ba6e2b8cf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

MD5 2c1b44ea01981b255794f6dd6e93e427
SHA1 f0ad7fa5ed821e057e0c125b51d6b38c926e3dcc
SHA256 113791fa6bbaee78927b052160825e54511c71fcd359228500376bb5da5e5a8a
SHA512 6f27227a50e73c37f73871a2827b9f60d015697fafe08ff9457bdb9f9d384a8ea8c2ece6514b724855f1382f6a08071802ad23e81211337514d9e400d80eea43

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

MD5 87347659da395274a05a6b98c20737b1
SHA1 c32c6d29af7648b5211e38bd0cd70a8c885ea2b8
SHA256 10fb5a12bf4138f160d7e083cf9ded9265075d33e2a5ac30e71f229e18b54d17
SHA512 8bd7d5c5b4eed458384191c86ba766a6c4249f72b43c5ccf071ea31df8599c06177022dd055e34192d6bf70b0412679b64da503abd871aea6bbdbcff9691aab6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 52b6f75ce28fa46c97e947b7dd84e112
SHA1 b78c17c623d7e79adb220b4ffc4c534f1123d550
SHA256 47abc333e0cb5337c4a51401fbf7d447b18e605725f1cc016d13889746e464b5
SHA512 1c3cd55278423c4ac85a6303708bc1574e96f1f63eacf0c0a86806c10543392770735b6f3d0f8dee4751f09e769615cd24f2c7af74ae3dd6c42274a362593f31

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a976c3d309d95d65abc9d05d73e1b04b
SHA1 a712024bf2aa56c8f6a6134016b3e407887a5698
SHA256 26cffd04a3bcc5681a0777c0e00238920fd1e89bbbb8db1e70a0c09657f82967
SHA512 85bfe135ebe5036a5617471ab3d25993c6cc3f78a079928becad4090a11a52ce7d0e091ee9ce215424e4e93d302e9508bbf07a137d14aa440a7dd5b08423c4ff