Malware Analysis Report

2024-11-16 13:49

Sample ID 240629-knhhxsthnh
Target !#Fileş_#!UŞe~Passw0rd__~.~29068~.~__.rar
SHA256 01fc7e69bcb48e8b470ada7d4c4a9a75e7306fc3916b0f834ebd275c4ef43789
Tags
stealc vidar discovery evasion spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

01fc7e69bcb48e8b470ada7d4c4a9a75e7306fc3916b0f834ebd275c4ef43789

Threat Level: Known bad

The file !#Fileş_#!UŞe~Passw0rd__~.~29068~.~__.rar was found to be: Known bad.

Malicious Activity Summary

stealc vidar discovery evasion spyware stealer trojan

Vidar

Stealc

Detect Vidar Stealer

Downloads MZ/PE file

Reads user/profile data of web browsers

Checks computer location settings

Executes dropped EXE

Reads data files stored by FTP clients

Loads dropped DLL

Checks installed software on the system

Checks whether UAC is enabled

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Enumerates physical storage devices

Modifies data under HKEY_USERS

Suspicious use of SetWindowsHookEx

Suspicious behavior: GetForegroundWindowSpam

Enumerates system info in registry

Modifies registry class

Checks SCSI registry key(s)

Suspicious use of FindShellTrayWindow

Delays execution with timeout.exe

Suspicious behavior: MapViewOfSection

Checks processor information in registry

Suspicious use of SendNotifyMessage

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Opens file in notepad (likely ransom note)

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-29 08:45

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-29 08:44

Reported

2024-06-29 08:53

Platform

win10v2004-20240611-en

Max time kernel

411s

Max time network

336s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Setup.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Vidar

stealer vidar

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\VIDA.au3 N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3484 set thread context of 1608 N/A C:\Users\Admin\AppData\Roaming\nodealt\JRWeb.exe C:\Windows\SysWOW64\more.com
PID 5044 set thread context of 4364 N/A C:\Users\Admin\AppData\Roaming\nodealt\JRWeb.exe C:\Windows\SysWOW64\more.com

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\VIDA.au3 N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\VIDA.au3 N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\VIDA.au3 N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\VIDA.au3 N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133641246190209411" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings C:\Windows\system32\taskmgr.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings C:\Program Files\7-Zip\7zFM.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nodealt\JRWeb.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\nodealt\JRWeb.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\nodealt\JRWeb.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\more.com N/A
N/A N/A C:\Windows\SysWOW64\more.com N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VIDA.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VIDA.au3 N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VIDA.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VIDA.au3 N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\VIDA.au3 N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\nodealt\JRWeb.exe N/A
N/A N/A C:\Windows\SysWOW64\more.com N/A
N/A N/A C:\Users\Admin\AppData\Roaming\nodealt\JRWeb.exe N/A
N/A N/A C:\Windows\SysWOW64\more.com N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\VIDA.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VIDA.au3 N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4812 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Users\Admin\AppData\Local\Temp\nodealt\JRWeb.exe
PID 4812 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Users\Admin\AppData\Local\Temp\nodealt\JRWeb.exe
PID 2992 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Temp\nodealt\JRWeb.exe C:\Users\Admin\AppData\Roaming\nodealt\JRWeb.exe
PID 2992 wrote to memory of 3484 N/A C:\Users\Admin\AppData\Local\Temp\nodealt\JRWeb.exe C:\Users\Admin\AppData\Roaming\nodealt\JRWeb.exe
PID 3484 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Roaming\nodealt\JRWeb.exe C:\Windows\SysWOW64\more.com
PID 3484 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Roaming\nodealt\JRWeb.exe C:\Windows\SysWOW64\more.com
PID 3484 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Roaming\nodealt\JRWeb.exe C:\Windows\SysWOW64\more.com
PID 3484 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Roaming\nodealt\JRWeb.exe C:\Windows\SysWOW64\more.com
PID 1608 wrote to memory of 4188 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\VIDA.au3
PID 1608 wrote to memory of 4188 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\VIDA.au3
PID 1608 wrote to memory of 4188 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\VIDA.au3
PID 1608 wrote to memory of 4188 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\VIDA.au3
PID 1608 wrote to memory of 4188 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\VIDA.au3
PID 1608 wrote to memory of 4188 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\VIDA.au3
PID 4188 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\VIDA.au3 C:\Windows\SysWOW64\cmd.exe
PID 4188 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\VIDA.au3 C:\Windows\SysWOW64\cmd.exe
PID 4188 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\VIDA.au3 C:\Windows\SysWOW64\cmd.exe
PID 2976 wrote to memory of 2428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2976 wrote to memory of 2428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2976 wrote to memory of 2428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4504 wrote to memory of 2720 N/A C:\Windows\system32\OpenWith.exe C:\Windows\system32\NOTEPAD.EXE
PID 4504 wrote to memory of 2720 N/A C:\Windows\system32\OpenWith.exe C:\Windows\system32\NOTEPAD.EXE
PID 3816 wrote to memory of 3640 N/A C:\Windows\system32\OpenWith.exe C:\Windows\system32\NOTEPAD.EXE
PID 3816 wrote to memory of 3640 N/A C:\Windows\system32\OpenWith.exe C:\Windows\system32\NOTEPAD.EXE
PID 4232 wrote to memory of 2728 N/A C:\Windows\system32\OpenWith.exe C:\Windows\system32\NOTEPAD.EXE
PID 4232 wrote to memory of 2728 N/A C:\Windows\system32\OpenWith.exe C:\Windows\system32\NOTEPAD.EXE
PID 2388 wrote to memory of 4832 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 4832 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 3580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 4772 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 4772 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 1988 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 1988 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2388 wrote to memory of 1988 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\Setup.exe"

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Users\Admin\AppData\Local\Temp\nodealt\JRWeb.exe

C:\Users\Admin\AppData\Local\Temp\nodealt\JRWeb.exe

C:\Users\Admin\AppData\Roaming\nodealt\JRWeb.exe

C:\Users\Admin\AppData\Roaming\nodealt\JRWeb.exe

C:\Windows\SysWOW64\more.com

C:\Windows\SysWOW64\more.com

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\AppData\Local\Temp\VIDA.au3

C:\Users\Admin\AppData\Local\Temp\VIDA.au3

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\FIIEHJDBKJKE" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\VIDA.au3"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO853C9C29\1000

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO85363799\166

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO853C3A4A\.text

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffd4c4ab58,0x7fffd4c4ab68,0x7fffd4c4ab78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2304 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2884 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2908 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4392 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4528 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4672 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4608 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4844 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff68513ae48,0x7ff68513ae58,0x7ff68513ae68

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4516 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4844 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3600 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3588 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5148 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5260 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5308 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5444 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5496 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5504 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5520 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=6060 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5796 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6596 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5576 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=6032 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=5312 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=4680 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3620 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5388 --field-trial-handle=1932,i,17058151714064643761,1318385114835449948,131072 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\Setup.exe"

C:\Users\Admin\AppData\Local\Temp\nodealt\JRWeb.exe

C:\Users\Admin\AppData\Local\Temp\nodealt\JRWeb.exe

C:\Users\Admin\AppData\Roaming\nodealt\JRWeb.exe

C:\Users\Admin\AppData\Roaming\nodealt\JRWeb.exe

C:\Windows\SysWOW64\more.com

C:\Windows\SysWOW64\more.com

C:\Users\Admin\AppData\Local\Temp\VIDA.au3

C:\Users\Admin\AppData\Local\Temp\VIDA.au3

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\3777294602\payload.dat

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
DE 195.201.251.214:9000 195.201.251.214 tcp
US 8.8.8.8:53 99.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 214.251.201.195.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
DE 195.201.251.214:9000 195.201.251.214 tcp
DE 195.201.251.214:9000 195.201.251.214 tcp
DE 195.201.251.214:9000 195.201.251.214 tcp
DE 195.201.251.214:9000 195.201.251.214 tcp
DE 195.201.251.214:9000 195.201.251.214 tcp
DE 195.201.251.214:9000 195.201.251.214 tcp
DE 195.201.251.214:9000 195.201.251.214 tcp
DE 195.201.251.214:9000 195.201.251.214 tcp
DE 195.201.251.214:9000 195.201.251.214 tcp
DE 195.201.251.214:9000 tcp
DE 195.201.251.214:9000 tcp
DE 195.201.251.214:9000 tcp
DE 195.201.251.214:9000 tcp
DE 195.201.251.214:9000 tcp
DE 195.201.251.214:9000 tcp
DE 195.201.251.214:9000 195.201.251.214 tcp
DE 195.201.251.214:9000 195.201.251.214 tcp
US 8.8.8.8:53 professionalresources.pw udp
DE 195.201.251.214:9000 195.201.251.214 tcp
DE 195.201.251.214:9000 195.201.251.214 tcp
DE 195.201.251.214:9000 195.201.251.214 tcp
DE 195.201.251.214:9000 195.201.251.214 tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
DE 195.201.251.214:9000 195.201.251.214 tcp
DE 195.201.251.214:9000 195.201.251.214 tcp
US 8.8.8.8:53 tea.arpdabl.org udp
DE 207.180.253.128:80 tea.arpdabl.org tcp
US 8.8.8.8:53 128.253.180.207.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.200.14:443 apis.google.com udp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 195.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 172.217.169.46:443 play.google.com udp
GB 172.217.169.46:443 play.google.com tcp
US 8.8.8.8:53 46.169.217.172.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.187.206:443 clients2.google.com udp
GB 142.250.187.206:443 clients2.google.com tcp
US 8.8.8.8:53 codebeautify-org.webpkgcache.com udp
GB 216.58.212.225:443 codebeautify-org.webpkgcache.com tcp
GB 216.58.212.225:443 codebeautify-org.webpkgcache.com udp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 225.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 consent.google.com udp
GB 142.250.187.238:443 consent.google.com tcp
US 8.8.8.8:53 www.base64decode.org udp
FR 51.83.2.171:443 www.base64decode.org tcp
FR 51.83.2.171:443 www.base64decode.org tcp
US 8.8.8.8:53 jconnor.org udp
US 8.8.8.8:53 cdn.base64decode.org udp
US 8.8.8.8:53 content-autofill.googleapis.com udp
FR 51.83.2.171:443 jconnor.org tcp
US 104.21.77.25:443 cdn.base64decode.org tcp
US 104.21.77.25:443 cdn.base64decode.org tcp
US 104.21.77.25:443 cdn.base64decode.org tcp
US 8.8.8.8:53 cmp.inmobi.com udp
US 8.8.8.8:53 tpc.googlesyndication.com udp
GB 142.250.200.10:443 content-autofill.googleapis.com tcp
US 8.8.8.8:53 238.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 171.2.83.51.in-addr.arpa udp
US 8.8.8.8:53 25.77.21.104.in-addr.arpa udp
US 8.8.8.8:53 104.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 10.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 region1.analytics.google.com udp
US 8.8.8.8:53 stats.g.doubleclick.net udp
US 8.8.8.8:53 www.google.co.uk udp
US 8.8.8.8:53 cdn.fuseplatform.net udp
BE 2.17.107.211:443 cdn.fuseplatform.net tcp
US 216.239.32.36:443 region1.analytics.google.com tcp
BE 64.233.167.154:443 stats.g.doubleclick.net tcp
GB 18.244.114.118:443 cmp.inmobi.com tcp
US 8.8.8.8:53 c.amazon-adsystem.com udp
US 8.8.8.8:53 securepubads.g.doubleclick.net udp
BE 2.17.107.211:443 cdn.fuseplatform.net tcp
GB 13.224.223.9:443 c.amazon-adsystem.com tcp
GB 142.250.200.34:443 securepubads.g.doubleclick.net tcp
US 8.8.8.8:53 cdn.jsdelivr.net udp
GB 18.244.114.118:443 cmp.inmobi.com tcp
US 151.101.65.229:443 cdn.jsdelivr.net tcp
US 8.8.8.8:53 36.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 211.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 154.167.233.64.in-addr.arpa udp
US 8.8.8.8:53 118.114.244.18.in-addr.arpa udp
US 8.8.8.8:53 9.223.224.13.in-addr.arpa udp
GB 13.224.223.9:443 c.amazon-adsystem.com tcp
US 8.8.8.8:53 34.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 config.aps.amazon-adsystem.com udp
GB 142.250.200.34:443 securepubads.g.doubleclick.net udp
US 8.8.8.8:53 cdn.id5-sync.com udp
GB 52.84.90.40:443 config.aps.amazon-adsystem.com tcp
US 104.22.53.86:443 cdn.id5-sync.com tcp
US 8.8.8.8:53 btloader.com udp
US 172.67.41.60:443 btloader.com tcp
US 8.8.8.8:53 api.cmp.inmobi.com udp
DE 52.28.237.142:443 api.cmp.inmobi.com tcp
DE 52.28.237.142:443 api.cmp.inmobi.com tcp
US 8.8.8.8:53 api.btloader.com udp
US 8.8.8.8:53 ad-delivery.net udp
US 130.211.23.194:443 api.btloader.com tcp
US 172.67.69.19:443 ad-delivery.net tcp
US 172.67.69.19:443 ad-delivery.net tcp
FR 51.83.2.171:443 jconnor.org tcp
US 104.21.77.25:443 cdn.base64decode.org udp
US 130.211.23.194:443 api.btloader.com udp
US 8.8.8.8:53 229.65.101.151.in-addr.arpa udp
US 8.8.8.8:53 40.90.84.52.in-addr.arpa udp
US 8.8.8.8:53 86.53.22.104.in-addr.arpa udp
US 8.8.8.8:53 60.41.67.172.in-addr.arpa udp
US 8.8.8.8:53 142.237.28.52.in-addr.arpa udp
US 8.8.8.8:53 194.23.211.130.in-addr.arpa udp
US 8.8.8.8:53 6.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 19.69.67.172.in-addr.arpa udp
US 8.8.8.8:53 id5-sync.com udp
US 8.8.8.8:53 lb.eu-1-id5-sync.com udp
US 8.8.8.8:53 tags.crwdcntrl.net udp
US 8.8.8.8:53 aax.amazon-adsystem.com udp
US 8.8.8.8:53 fastlane.rubiconproject.com udp
US 8.8.8.8:53 prg8.smartadserver.com udp
US 8.8.8.8:53 prg-apac.smartadserver.com udp
US 8.8.8.8:53 a.teads.tv udp
US 8.8.8.8:53 hbopenbid.pubmatic.com udp
US 8.8.8.8:53 ib.adnxs.com udp
US 8.8.8.8:53 prebid.a-mo.net udp
US 8.8.8.8:53 htlb.casalemedia.com udp
US 8.8.8.8:53 i.connectad.io udp
US 8.8.8.8:53 ssc.33across.com udp
US 8.8.8.8:53 bidder.criteo.com udp
DE 141.95.98.64:443 lb.eu-1-id5-sync.com tcp
US 8.8.8.8:53 tlx.3lift.com udp
DE 141.95.33.120:443 lb.eu-1-id5-sync.com tcp
GB 18.245.143.118:443 tags.crwdcntrl.net tcp
DE 37.252.173.215:443 ib.adnxs.com tcp
US 172.64.151.101:443 htlb.casalemedia.com tcp
NL 145.40.97.66:443 prebid.a-mo.net tcp
FR 51.178.195.209:443 prg-apac.smartadserver.com tcp
FR 51.178.195.209:443 prg-apac.smartadserver.com tcp
NL 69.173.156.139:443 fastlane.rubiconproject.com tcp
NL 69.173.156.139:443 fastlane.rubiconproject.com tcp
NL 69.173.156.139:443 fastlane.rubiconproject.com tcp
GB 185.64.190.77:443 hbopenbid.pubmatic.com tcp
FR 91.134.110.128:443 prg-apac.smartadserver.com tcp
FR 91.134.110.128:443 prg-apac.smartadserver.com tcp
FR 91.134.110.128:443 prg-apac.smartadserver.com tcp
BE 104.90.25.54:443 a.teads.tv tcp
US 104.22.54.206:443 i.connectad.io tcp
GB 18.245.189.34:443 aax.amazon-adsystem.com tcp
US 34.149.20.76:443 ssc.33across.com tcp
US 34.149.20.76:443 ssc.33across.com tcp
US 34.149.20.76:443 ssc.33across.com tcp
US 34.149.20.76:443 ssc.33across.com tcp
US 34.149.20.76:443 ssc.33across.com tcp
NL 178.250.1.8:443 bidder.criteo.com tcp
DE 18.157.230.4:443 tlx.3lift.com tcp
US 8.8.8.8:53 bcp.crwdcntrl.net udp
IE 52.215.98.156:443 bcp.crwdcntrl.net tcp
US 8.8.8.8:53 rtb.gumgum.com udp
IE 52.48.239.33:443 rtb.gumgum.com tcp
US 8.8.8.8:53 118.143.245.18.in-addr.arpa udp
US 8.8.8.8:53 64.98.95.141.in-addr.arpa udp
US 8.8.8.8:53 120.33.95.141.in-addr.arpa udp
US 8.8.8.8:53 101.151.64.172.in-addr.arpa udp
US 8.8.8.8:53 66.97.40.145.in-addr.arpa udp
US 8.8.8.8:53 209.195.178.51.in-addr.arpa udp
US 8.8.8.8:53 139.156.173.69.in-addr.arpa udp
US 8.8.8.8:53 215.173.252.37.in-addr.arpa udp
US 8.8.8.8:53 76.20.149.34.in-addr.arpa udp
US 8.8.8.8:53 77.190.64.185.in-addr.arpa udp
US 8.8.8.8:53 34.189.245.18.in-addr.arpa udp
US 8.8.8.8:53 206.54.22.104.in-addr.arpa udp
US 8.8.8.8:53 128.110.134.91.in-addr.arpa udp
US 8.8.8.8:53 8.1.250.178.in-addr.arpa udp
US 8.8.8.8:53 54.25.90.104.in-addr.arpa udp
US 8.8.8.8:53 156.98.215.52.in-addr.arpa udp
US 8.8.8.8:53 33.239.48.52.in-addr.arpa udp
US 8.8.8.8:53 4.230.157.18.in-addr.arpa udp
US 8.8.8.8:53 1x1.a-mo.net udp
US 8.8.8.8:53 ice.360yield.com udp
DE 18.194.57.210:443 1x1.a-mo.net tcp
DE 18.194.57.210:443 1x1.a-mo.net tcp
DE 18.194.57.210:443 1x1.a-mo.net tcp
DE 18.194.57.210:443 1x1.a-mo.net tcp
IE 34.248.247.14:443 ice.360yield.com tcp
US 8.8.8.8:53 42c6fd91b6c29e9d41c0ac6c04a8939b.safeframe.googlesyndication.com udp
US 8.8.8.8:53 aax-eu.amazon-adsystem.com udp
GB 172.217.169.65:443 42c6fd91b6c29e9d41c0ac6c04a8939b.safeframe.googlesyndication.com tcp
IE 67.220.228.202:443 aax-eu.amazon-adsystem.com tcp
GB 172.217.16.225:443 tpc.googlesyndication.com tcp
US 8.8.8.8:53 d.turn.com udp
NL 46.228.164.13:443 d.turn.com tcp
GB 172.217.16.225:443 tpc.googlesyndication.com udp
US 8.8.8.8:53 x.bidswitch.net udp
US 8.8.8.8:53 cs.media.net udp
US 8.8.8.8:53 match.prod.bidr.io udp
US 8.8.8.8:53 s.ad.smaato.net udp
US 8.8.8.8:53 onetag-sys.com udp
US 8.8.8.8:53 trace-eu.mediago.io udp
US 8.8.8.8:53 b1sync.zemanta.com udp
DE 51.75.86.98:443 onetag-sys.com tcp
IE 52.31.82.199:443 match.prod.bidr.io tcp
US 35.71.131.137:443 match.adsrvr.org tcp
GB 108.156.39.69:443 s.ad.smaato.net tcp
GB 142.250.200.34:443 securepubads.g.doubleclick.net udp
NL 35.214.168.80:443 trace-eu.mediago.io tcp
US 50.31.142.63:443 b1sync.zemanta.com tcp
SE 23.34.232.19:443 cs.media.net tcp
NL 35.214.149.91:443 x.bidswitch.net tcp
US 8.8.8.8:53 ssum-sec.casalemedia.com udp
US 8.8.8.8:53 u.openx.net udp
US 8.8.8.8:53 ssbsync.smartadserver.com udp
US 8.8.8.8:53 sync.inmobi.com udp
US 8.8.8.8:53 amazon-tam-match.dotomi.com udp
US 8.8.8.8:53 ads.pubmatic.com udp
US 8.8.8.8:53 eb2.3lift.com udp
US 34.98.64.218:443 u.openx.net tcp
SE 23.34.232.193:443 ads.pubmatic.com tcp
US 13.248.245.213:443 eb2.3lift.com tcp
NL 89.149.193.100:443 ssbsync.smartadserver.com tcp
IE 67.220.228.202:443 aax-eu.amazon-adsystem.com tcp
US 20.253.0.30:443 sync.inmobi.com tcp
NL 63.215.202.137:443 amazon-tam-match.dotomi.com tcp
IE 67.220.228.202:443 aax-eu.amazon-adsystem.com tcp
US 104.18.36.155:443 ssum-sec.casalemedia.com udp
IE 67.220.228.202:443 aax-eu.amazon-adsystem.com tcp
US 8.8.8.8:53 210.57.194.18.in-addr.arpa udp
US 34.98.64.218:443 u.openx.net udp
US 8.8.8.8:53 m.media-amazon.com udp
US 8.8.8.8:53 14.247.248.34.in-addr.arpa udp
US 8.8.8.8:53 98.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 65.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 202.228.220.67.in-addr.arpa udp
US 8.8.8.8:53 225.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 13.164.228.46.in-addr.arpa udp
US 8.8.8.8:53 137.131.71.35.in-addr.arpa udp
US 8.8.8.8:53 69.39.156.108.in-addr.arpa udp
US 8.8.8.8:53 199.82.31.52.in-addr.arpa udp
US 8.8.8.8:53 98.86.75.51.in-addr.arpa udp
US 8.8.8.8:53 80.168.214.35.in-addr.arpa udp
US 8.8.8.8:53 19.232.34.23.in-addr.arpa udp
US 8.8.8.8:53 91.149.214.35.in-addr.arpa udp
US 8.8.8.8:53 63.142.31.50.in-addr.arpa udp
US 20.253.0.30:443 sync.inmobi.com tcp
IE 67.220.228.202:443 aax-eu.amazon-adsystem.com tcp
IE 67.220.228.202:443 aax-eu.amazon-adsystem.com tcp
US 8.8.8.8:53 s.amazon-adsystem.com udp
US 8.8.8.8:53 ts.amazon-adsystem.com udp
GB 18.245.230.229:443 m.media-amazon.com tcp
GB 18.245.230.229:443 m.media-amazon.com tcp
GB 18.245.230.229:443 m.media-amazon.com tcp
GB 18.245.230.229:443 m.media-amazon.com tcp
GB 18.245.230.229:443 m.media-amazon.com tcp
GB 18.245.230.229:443 m.media-amazon.com tcp
GB 18.245.230.229:443 m.media-amazon.com tcp
US 52.46.130.91:443 s.amazon-adsystem.com tcp
US 52.46.130.91:443 s.amazon-adsystem.com tcp
GB 18.245.218.37:443 ts.amazon-adsystem.com tcp
US 52.46.130.91:443 s.amazon-adsystem.com tcp
GB 18.245.230.229:443 m.media-amazon.com udp
US 8.8.8.8:53 aan.amazon.co.uk udp
IE 3.254.237.44:443 aan.amazon.co.uk tcp
GB 18.245.218.37:443 ts.amazon-adsystem.com tcp
IE 3.254.237.44:443 aan.amazon.co.uk tcp
US 8.8.8.8:53 ce.lijit.com udp
IE 99.81.85.68:443 ce.lijit.com tcp
IE 3.254.237.44:443 aan.amazon.co.uk tcp
IE 3.254.237.44:443 aan.amazon.co.uk tcp
IE 3.254.237.44:443 aan.amazon.co.uk tcp
US 8.8.8.8:53 s2.paa-reporting-advertising.amazon udp
IE 3.254.237.44:443 aan.amazon.co.uk tcp
GB 54.192.137.102:443 s2.paa-reporting-advertising.amazon tcp
GB 54.192.137.102:443 s2.paa-reporting-advertising.amazon tcp
US 8.8.8.8:53 218.64.98.34.in-addr.arpa udp
US 8.8.8.8:53 193.232.34.23.in-addr.arpa udp
US 8.8.8.8:53 213.245.248.13.in-addr.arpa udp
US 8.8.8.8:53 100.193.149.89.in-addr.arpa udp
US 8.8.8.8:53 155.36.18.104.in-addr.arpa udp
US 8.8.8.8:53 137.202.215.63.in-addr.arpa udp
US 8.8.8.8:53 30.0.253.20.in-addr.arpa udp
US 8.8.8.8:53 229.230.245.18.in-addr.arpa udp
US 8.8.8.8:53 91.130.46.52.in-addr.arpa udp
US 8.8.8.8:53 44.237.254.3.in-addr.arpa udp
US 8.8.8.8:53 68.85.81.99.in-addr.arpa udp
US 8.8.8.8:53 102.137.192.54.in-addr.arpa udp
US 8.8.8.8:53 static.criteo.net udp
US 8.8.8.8:53 uipglob.semasio.net udp
US 8.8.8.8:53 sq-tungsten-ts-eu.amazon-adsystem.com udp
IE 3.253.169.168:443 sq-tungsten-ts-eu.amazon-adsystem.com tcp
DK 77.243.51.122:443 uipglob.semasio.net tcp
NL 178.250.1.3:443 static.criteo.net tcp
IE 3.253.169.168:443 sq-tungsten-ts-eu.amazon-adsystem.com tcp
US 8.8.8.8:53 tungsten-service.prod.eu.adsqtungsten.a9.amazon.dev udp
GB 108.156.39.71:443 tungsten-service.prod.eu.adsqtungsten.a9.amazon.dev tcp
GB 108.156.39.71:443 tungsten-service.prod.eu.adsqtungsten.a9.amazon.dev tcp
US 8.8.8.8:53 gum.criteo.com udp
GB 18.245.230.229:443 m.media-amazon.com udp
NL 178.250.1.11:443 gum.criteo.com tcp
US 8.8.8.8:53 dis.eu.criteo.com udp
US 8.8.8.8:53 image6.pubmatic.com udp
NL 178.250.1.9:443 dis.eu.criteo.com tcp
US 8.8.8.8:53 c1.adform.net udp
GB 185.64.190.78:443 image6.pubmatic.com tcp
US 8.8.8.8:53 cm.g.doubleclick.net udp
DK 37.157.3.26:443 c1.adform.net tcp
GB 172.217.16.226:443 cm.g.doubleclick.net tcp
GB 172.217.16.226:443 cm.g.doubleclick.net tcp
IE 3.253.169.168:443 sq-tungsten-ts-eu.amazon-adsystem.com tcp
US 8.8.8.8:53 us-u.openx.net udp
GB 172.217.16.226:443 cm.g.doubleclick.net tcp
US 8.8.8.8:53 dsum-sec.casalemedia.com udp
US 8.8.8.8:53 dmp.brand-display.com udp
US 8.8.8.8:53 ups.analytics.yahoo.com udp
GB 172.217.16.226:443 cm.g.doubleclick.net tcp
US 34.160.19.107:443 dmp.brand-display.com tcp
DE 3.75.62.37:443 ups.analytics.yahoo.com tcp
NL 178.250.1.11:443 gum.criteo.com tcp
US 8.8.8.8:53 122.51.243.77.in-addr.arpa udp
US 8.8.8.8:53 168.169.253.3.in-addr.arpa udp
US 8.8.8.8:53 71.39.156.108.in-addr.arpa udp
US 8.8.8.8:53 11.1.250.178.in-addr.arpa udp
US 8.8.8.8:53 9.1.250.178.in-addr.arpa udp
US 8.8.8.8:53 78.190.64.185.in-addr.arpa udp
US 8.8.8.8:53 226.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 107.19.160.34.in-addr.arpa udp
US 8.8.8.8:53 3.1.250.178.in-addr.arpa udp
GB 172.217.16.226:443 cm.g.doubleclick.net udp
US 8.8.8.8:53 ow.pubmatic.com udp
NL 35.214.149.91:443 x.bidswitch.net tcp
US 50.31.142.63:443 b1sync.zemanta.com tcp
US 8.8.8.8:53 image8.pubmatic.com udp
US 8.8.8.8:53 creativecdn.com udp
US 8.8.8.8:53 sync.adkernel.com udp
US 8.8.8.8:53 sync.1rx.io udp
US 8.8.8.8:53 sync.srv.stackadapt.com udp
US 8.8.8.8:53 csync.loopme.me udp
NL 185.184.8.90:443 creativecdn.com tcp
NL 77.245.57.72:443 sync.adkernel.com tcp
NL 185.64.189.116:443 ow.pubmatic.com tcp
GB 185.64.191.214:443 image8.pubmatic.com tcp
US 52.86.229.235:443 sync.srv.stackadapt.com tcp
NL 46.228.174.117:443 sync.1rx.io tcp
US 8.8.8.8:53 dis.criteo.com udp
US 8.8.8.8:53 sync.crwdcntrl.net udp
US 8.8.8.8:53 cr.frontend.weborama.fr udp
US 8.8.8.8:53 mwzeom.zeotap.com udp
NL 35.214.131.36:443 csync.loopme.me tcp
US 8.8.8.8:53 um.simpli.fi udp
NL 35.214.131.36:443 csync.loopme.me tcp
US 8.8.8.8:53 sonata-notifications.taptapnetworks.com udp
NL 178.250.1.9:443 dis.criteo.com tcp
US 172.67.40.173:443 mwzeom.zeotap.com tcp
NL 35.204.158.49:443 um.simpli.fi tcp
US 34.111.129.221:443 cr.frontend.weborama.fr tcp
DE 3.75.159.177:443 sonata-notifications.taptapnetworks.com tcp
US 8.8.8.8:53 a.sportradarserving.com udp
US 8.8.8.8:53 ap.lijit.com udp
US 8.8.8.8:53 tracker-shr.ortb.net udp
US 8.8.8.8:53 pr-bh.ybp.yahoo.com udp
IE 34.243.105.245:443 ap.lijit.com tcp
IE 54.74.86.51:443 pr-bh.ybp.yahoo.com tcp
US 147.135.71.152:443 tracker-shr.ortb.net tcp
NL 35.214.174.141:443 a.sportradarserving.com tcp
US 8.8.8.8:53 simage2.pubmatic.com udp
FR 51.83.2.171:443 jconnor.org tcp
US 8.8.8.8:53 dsum.casalemedia.com udp
US 8.8.8.8:53 tr.blismedia.com udp
GB 185.64.191.210:443 simage2.pubmatic.com tcp
US 34.96.105.8:443 tr.blismedia.com tcp
US 8.8.8.8:53 cs.admanmedia.com udp
US 8.8.8.8:53 eu-u.openx.net udp
US 80.77.87.161:443 cs.admanmedia.com tcp
IE 3.253.169.168:443 sq-tungsten-ts-eu.amazon-adsystem.com tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 216.239.32.36:443 region1.analytics.google.com udp
GB 142.250.180.2:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 37.62.75.3.in-addr.arpa udp
US 8.8.8.8:53 214.191.64.185.in-addr.arpa udp
US 8.8.8.8:53 90.8.184.185.in-addr.arpa udp
US 8.8.8.8:53 72.57.245.77.in-addr.arpa udp
US 8.8.8.8:53 116.189.64.185.in-addr.arpa udp
US 8.8.8.8:53 117.174.228.46.in-addr.arpa udp
US 8.8.8.8:53 36.131.214.35.in-addr.arpa udp
US 8.8.8.8:53 173.40.67.172.in-addr.arpa udp
US 8.8.8.8:53 221.129.111.34.in-addr.arpa udp
US 8.8.8.8:53 235.229.86.52.in-addr.arpa udp
US 8.8.8.8:53 49.158.204.35.in-addr.arpa udp
US 8.8.8.8:53 177.159.75.3.in-addr.arpa udp
US 8.8.8.8:53 51.86.74.54.in-addr.arpa udp
US 8.8.8.8:53 245.105.243.34.in-addr.arpa udp
US 8.8.8.8:53 141.174.214.35.in-addr.arpa udp
US 8.8.8.8:53 152.71.135.147.in-addr.arpa udp
US 8.8.8.8:53 210.191.64.185.in-addr.arpa udp
US 8.8.8.8:53 8.105.96.34.in-addr.arpa udp
US 8.8.8.8:53 161.87.77.80.in-addr.arpa udp
US 8.8.8.8:53 2.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 8.8.8.8:53 image2.pubmatic.com udp
US 34.111.129.221:443 cr.frontend.weborama.fr udp
US 8.8.8.8:53 ad.turn.com udp
NL 198.47.127.205:443 image2.pubmatic.com tcp
NL 198.47.127.205:443 image2.pubmatic.com tcp
NL 35.214.174.141:443 a.sportradarserving.com udp
NL 46.228.164.11:443 ad.turn.com tcp
US 8.8.8.8:53 csm.nl3.eu.criteo.net udp
NL 178.250.1.25:443 csm.nl3.eu.criteo.net tcp
US 104.22.54.206:443 i.connectad.io udp
US 34.149.20.76:443 ssc.33across.com udp
US 8.8.8.8:53 fff14d9cf95fc489a466d39c18ef7f3b.safeframe.googlesyndication.com udp
US 8.8.8.8:53 1.80.190.35.in-addr.arpa udp
US 8.8.8.8:53 205.127.47.198.in-addr.arpa udp
US 8.8.8.8:53 11.164.228.46.in-addr.arpa udp
US 8.8.8.8:53 25.1.250.178.in-addr.arpa udp
DE 51.75.86.98:443 onetag-sys.com udp
NL 35.214.168.80:443 trace-eu.mediago.io udp
US 8.8.8.8:53 inmobi-match.dotomi.com udp
NL 89.207.16.140:443 inmobi-match.dotomi.com tcp
IE 3.253.169.168:443 sq-tungsten-ts-eu.amazon-adsystem.com tcp
IE 3.253.169.168:443 sq-tungsten-ts-eu.amazon-adsystem.com tcp
IE 3.253.169.168:443 sq-tungsten-ts-eu.amazon-adsystem.com tcp
IE 3.253.169.168:443 sq-tungsten-ts-eu.amazon-adsystem.com tcp
US 8.8.8.8:53 dpm.demdex.net udp
IE 99.80.168.104:443 dpm.demdex.net tcp
IE 3.253.169.168:443 sq-tungsten-ts-eu.amazon-adsystem.com tcp
US 8.8.8.8:53 140.16.207.89.in-addr.arpa udp
US 8.8.8.8:53 104.168.80.99.in-addr.arpa udp
DE 3.122.214.165:443 ps.eyeota.net tcp
US 8.8.8.8:53 rtd-tm.everesttech.net udp
US 151.101.130.49:443 rtd-tm.everesttech.net tcp
US 8.8.8.8:53 ads.travelaudience.com udp
US 35.190.0.66:443 ads.travelaudience.com tcp
US 8.8.8.8:53 165.214.122.3.in-addr.arpa udp
US 8.8.8.8:53 49.130.101.151.in-addr.arpa udp
US 8.8.8.8:53 66.0.190.35.in-addr.arpa udp
NL 35.214.131.36:443 csync.loopme.me tcp
US 8.8.8.8:53 253.15.104.51.in-addr.arpa udp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
DE 195.201.251.214:9000 195.201.251.214 tcp
US 8.8.8.8:53 23.249.124.192.in-addr.arpa udp
DE 195.201.251.214:9000 195.201.251.214 tcp
DE 195.201.251.214:9000 195.201.251.214 tcp
DE 195.201.251.214:9000 195.201.251.214 tcp
DE 195.201.251.214:9000 195.201.251.214 tcp
DE 195.201.251.214:9000 195.201.251.214 tcp
DE 195.201.251.214:9000 195.201.251.214 tcp
DE 195.201.251.214:9000 195.201.251.214 tcp

Files

memory/4696-0-0x000002A2E4800000-0x000002A2E4801000-memory.dmp

memory/4696-2-0x000002A2E4800000-0x000002A2E4801000-memory.dmp

memory/4696-1-0x000002A2E4800000-0x000002A2E4801000-memory.dmp

memory/4696-12-0x000002A2E4800000-0x000002A2E4801000-memory.dmp

memory/4696-11-0x000002A2E4800000-0x000002A2E4801000-memory.dmp

memory/4696-10-0x000002A2E4800000-0x000002A2E4801000-memory.dmp

memory/4696-9-0x000002A2E4800000-0x000002A2E4801000-memory.dmp

memory/4696-8-0x000002A2E4800000-0x000002A2E4801000-memory.dmp

memory/4696-7-0x000002A2E4800000-0x000002A2E4801000-memory.dmp

memory/4696-6-0x000002A2E4800000-0x000002A2E4801000-memory.dmp

memory/4812-13-0x00007FF685A90000-0x00007FF686901000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\f0fc3379

MD5 269b7fe84066adeabdc1ccf7b8d0641a
SHA1 1148ecb7e08a4ad4f334d524b348c2dea033120a
SHA256 7c654bff9135e6b86c1aa7c40e29c704dea1945c96a559169bfc3300191b180d
SHA512 a1e1a7885dde35f0aa7f003422ececa24bc8f8013252b527d1dc3dcb6ffd83cc29c7fd112942a4813e46ba2e5f276235569f282c74a9fe33aed5c001ab93eea3

memory/4812-19-0x00007FFFE3020000-0x00007FFFE3192000-memory.dmp

memory/4812-21-0x00007FFFE3020000-0x00007FFFE3192000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nodealt\JRWeb.exe

MD5 c047ae13fc1e25bc494b17ca10aa179e
SHA1 e293c7815c0eb8fbc44d60a3e9b27bd91b44b522
SHA256 6c30c8a2e827f48fcfc934dd34fb2cb10acb8747fd11faae085d8ad352c01fbf
SHA512 0cfb96d23b043bcb954cc307f85e5bbc349c0c8a0c6eaa335ea9a8fa19ce65b047f30ed0049562d40880400d4f70e3bb28975d6970f3ae4af6da1ba06e36d48c

C:\Users\Admin\AppData\Local\Temp\nodealt\WebView2Loader.dll

MD5 4a99cb402c0d843b61a83015e0d3d731
SHA1 ac59e7722c85fef8050a715e6f4c3a3e5085d98e
SHA256 4ae3f7437a6991db64eac8e5d2fa02e9edce56ad98aaa273006963fed39548a8
SHA512 1eceb6ff5f53a98e61f21c90de9242e46c9607817eeb7ce77f500a5b225e123ac52b357c7729b334063cd8c8b37c2fbe38e76c1a5ee77244b176aa3e08d7eb18

C:\Users\Admin\AppData\Local\Temp\nodealt\perfidy.svg

MD5 d7046da347cd1c24f9af82a326413734
SHA1 a8ecd6cd212e0b866ef9611bf07b6826262da0c4
SHA256 580209f46352f01b832c81a836e72d05819d33502f51bdda6212eefe0b7675d6
SHA512 cd0327dce2c68ee800e204972a88afc30b59e93847a4837fb72ddb2ee0de73e40b8e4450d7f800d50adf239ee0bdf6a1818e21c05677d1893906fc898f59c9de

C:\Users\Admin\AppData\Local\Temp\nodealt\butadiene.wav

MD5 4f43217ff7e7fcb652b20534150b9f0d
SHA1 035e35018b9c88309c8fdd7edde4d3add42606b8
SHA256 223b47f477447d6584a7d27a10e92694a5a9c4c3823e126a2753a1e700128017
SHA512 e06b90045ad605de2fae14a65959e684d4a64a85dec8eedf26b179ca16d3d17601afa2766a4cbde4f2061f70ee99f4d9746d7edc1a0e93648abe366616560479

memory/2992-35-0x00007FFFE3020000-0x00007FFFE3192000-memory.dmp

memory/3484-46-0x00007FFFE3020000-0x00007FFFE3192000-memory.dmp

memory/4812-48-0x00007FFFE3020000-0x00007FFFE3192000-memory.dmp

memory/3484-49-0x00007FFFE3020000-0x00007FFFE3192000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fa6bdcf1

MD5 4aefc0b6ff2fe1864c229571ee703ff0
SHA1 3c6a2bd3d6399e373d8f9b32f181695bf0b0f9d9
SHA256 ee0769ed0429544c09ac64369f884d68773cf8347dfe6e4ae5e7de5037219b4a
SHA512 8b5a7d024729d5b4ce29a225cddbdf45d1cffb51be8323c2f2b3b0eec2c7fc15905302757d91667f8b182aaa1fca5f1bf3bfb120c03ad0ca14ea236e7d1ed92a

memory/1608-52-0x00007FFFF25B0000-0x00007FFFF27A5000-memory.dmp

memory/1608-54-0x00000000755F0000-0x000000007576B000-memory.dmp

\??\c:\users\admin\appdata\local\temp\vida.au3

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/4188-61-0x0000000001800000-0x0000000001A49000-memory.dmp

memory/4188-63-0x00007FFFF25B0000-0x00007FFFF27A5000-memory.dmp

memory/4188-66-0x0000000001800000-0x0000000001A49000-memory.dmp

memory/4188-68-0x000000001B5E0000-0x000000001B83F000-memory.dmp

memory/4188-107-0x0000000001800000-0x0000000001A49000-memory.dmp

memory/4188-108-0x0000000001800000-0x0000000001A49000-memory.dmp

memory/4188-113-0x0000000001800000-0x0000000001A49000-memory.dmp

memory/4188-114-0x0000000001800000-0x0000000001A49000-memory.dmp

memory/4188-115-0x0000000001800000-0x0000000001A49000-memory.dmp

memory/4188-117-0x0000000001800000-0x0000000001A49000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zO853C9C29\1000

MD5 08e5fdcbcb2ab21352c8fc0e05b07ddb
SHA1 25d4fcfaba7226a6b786bba3bcbad3ed7391b385
SHA256 7de7438fb4425f608109111fdce25be7d2381938f6c5984bcfb14b3b88e9c883
SHA512 9d9b269ebca11f9fd72836761131141239e406d741155e0621f80046e6919cacf17da58b6a006f6737784d4a7c0b9572eaaedd9e721a55bbaab8fc2b2afb18c9

C:\Users\Admin\AppData\Local\Temp\7zO85363799\166

MD5 8140596ab00b98a11c13e6977d2d0977
SHA1 58abc231c2b5ac778a543a5dffcfabe867a6758d
SHA256 54f5e2ecbfc4f87380ca7466337676b99d0c4a21f806cf83f69fd48934c857ab
SHA512 ba6525eee05af1251d92c55d302cd8efa36873128857ca7244e8766f267249878ae0a9d6ac42ec74099606f3708e7eda171eadb037880b2518ce0f934d5e174f

C:\Users\Admin\AppData\Local\Temp\7zO853C3A4A\.text

MD5 37545704cd94410041e41f7b2d95d901
SHA1 8e9612760cf3d292149679485dc68b3033c590e4
SHA256 e5852635547d75252b6415bc614590e9c288d264e1e8cb6e19aff7568fa6aa01
SHA512 4b95cbd1ccb2a5d4ec3d6d843e20dc2ef7e9c9a90f051b20f3ebe6a4e8d112873ddd21533f1dc99a7dc5dbfe4f887c65c3fbdf929e95fa58585beb3ea65dbac2

\??\pipe\crashpad_2388_URPHNPRSDLSJTPYW

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 bd53e7cf931a6e62def9dc032c8620ee
SHA1 e13084584fe4c9ab8cd45f62038512d75e9c5b46
SHA256 1ad10bad511013484c59553d7095d3ab9552e21cd1d9850d2c21ff1a6bf2f03f
SHA512 07e5cd5f85d61dd7b2cce0be9f4a90393b7d2edbc1e00d0002ca690af58151967e64bfcc33e52b22cb1e89b442a8b0a297eb69ff222a74748affc4950f639c4b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 953a4e7fefa59d685da2d1a775f4957d
SHA1 0cea014f45fc2e911e867902543419cb9d5d73ca
SHA256 20e664922fd077e46d96a4b6c26b3537b9c9d7d0a55553d1eb1d2222fe136f9f
SHA512 e3dff04be50961665ccb0cc1e98f3c4faec40a5f5720872ec09e35ee3a4b586e7c61df26e65ce9950ae7ed75fb1a692b31ef190012a1e230072ea946a598b4fd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 0f2c410b3a5cdff1c2ba1d4e0b663efa
SHA1 6fdbc459b9c01dbdd06ba524382682b7351bb67d
SHA256 10c9166100202e21dd0eeda2cc9dfab0edb94c993404e47f62f02dddaf02c511
SHA512 45df9113a4d5bc48dcb443ec02c6db20ce2effc30a1c1d1fa7359121065bcc66255778831145ad36551a406c09c10cbe5081befacb010aa7b9a79a7653c70250

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e0f3c472-c8d6-4d5a-b048-e7182ad9b833.tmp

MD5 1c6096632e720bae19f3c1a5850d2a98
SHA1 6520a437d89bda0991d7371807f7a5a61f2ecf1f
SHA256 5a2d35c511d0ea8179f3b71108a94d3b0959c792431d26247bcb5a2c8d70d3d4
SHA512 efcd7368f2774c00f49d709f35a6162362235aae3757fadeb8e998d8ea9878f2841bfb1e847c248cb26623884b2cfcdf8cf23596ee3e6094ec45e46fe383aa83

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 439f3f4ea1ea41c93de91b22860cfaf1
SHA1 c25ffcb0af08610748a1dfa66e858aa7acc168cd
SHA256 83771f49e9f3f39882c3d6915be7f31157c14faf86e7cd175d156efb16334f56
SHA512 248662f2eff76a101b648ff26d30659e14318104e78f751ff75200ceeaf693482be16f82cffbf3bf483e1ce5d11ba909844a7da27d3eb5752220453e9d90a759

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 a7763d34a229f9ce1ef0e6ed314f8028
SHA1 9dbbfd776de48bdf9bcaf2e9d523b8480787b2f1
SHA256 f2c6220beadb0f9946c612f95f5ecb896c1e899a790b8862b88aef9322a50522
SHA512 3eded09ba9f3adbdd3163049f582b385b985d0860120b9f883a8981502e32ac5dac1c9f0810edb98b49ce3b8daa68483ac6d46b0d8acfd877d0f1d1639e440ef

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\77d99218742b4b32_0

MD5 d703180b6eebf6528a92f779f435f5e0
SHA1 0b71ce956734835065df57b1b307f03d683b55f2
SHA256 8b84bc47fb5fe3546a684b849c6c609ebbfda5120d6d88bd04785eb01e8d14f9
SHA512 0ce7386b7807d6b78c11f875914243a10262e773e1efd753e02cbbf2e435ca5c6cb6ac4b093ccef99408537a62503d83e99f0478bc57e78352e3137c594c9f94

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024

MD5 40faa0c4150091170644046bbe98ca75
SHA1 d07b30afeaad31c52a1e9dcc2b5362065cc46625
SHA256 c3973eeb11e12431e06d1ef84661ade738e2f9d653e09bb1882dfdee5f887158
SHA512 afa3bf63f9211982ff39b058d0dc8b5ade5339ed68615df5f0c16477dac454897dc1d61e67d78ef1191c1f5859407828d297a5102ee7f28addd10449fd07c85d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\77d99218742b4b32_0

MD5 1b9a7734607e6ec54212eaf0fa05c0c8
SHA1 b0a1edd285bc7b42a393da4ea2d995a37e0f383f
SHA256 0252dc7b19350a0d41b2525023a71683ec89dd5dc5c05f38af3a32ac7697ee76
SHA512 39a9c55422086ac2f32a9b99d414d76977500f58d717ecef27fbc49c34560c492a2cbf5c28a2ec8249a9652d07961a80f094ee4d256720c21396716f69b6c1ec

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\83d3881891293a9e_0

MD5 a5a1532990497f13dc8ee42f26fe3e26
SHA1 a4d6584bc2fe40130dfc2f13df7b3dc0055d44fa
SHA256 8b9abb9c5dcb83c9b9992c223aa08be98ddd89aec669df3f45e8c74a0c2a0631
SHA512 a31b52f01a4f1ff5acfc4bf1fdde6124676616ca0234bf6ec9e1e91136b3321bf9b2ee381c5f478fa2c61224be5a911bb292782fd0f0f290c49eaa880501b6d4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\9862a3cb91851f34_0

MD5 23a2e22d42ebade53e3044674237b7e7
SHA1 fa04df9948afc3d01088c85749eacffdf5083f66
SHA256 90294bb3229a5ca92414704471b54b8c1d0d5e7f24a5431a4c89f02668eaf2e3
SHA512 efa431b2a422280b76e245daa8fd7ef3e5010d8877209ecd161b06de865d1b30e0893c75808193202b5cdf9b77518ab4b7b954f40f5aa0fc41c78ed32639d1d1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\7e11be7244f38434_0

MD5 b88f0a471c25f8ea407ca6aa92f607e0
SHA1 be034b90ced5283d56d4a5d3bc8e3fb9f176d40c
SHA256 336b948be4ae73a825017966e977c2f34e3ca686f2e2b1dabf3ad28f4a9eb842
SHA512 f980bbb91ca0450fd777f6cec1717efc32f5f3d8138c8f783b68ca399ccf90529aa546d1018834d60aa79901aeaab40200d56cbed9619cd0f16743213dc862f7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002d

MD5 70dc4f19424ed6d1eb3edf2e3acffdfe
SHA1 f5e03c8717997457ab5875098caf342e959c52fb
SHA256 4f0529047afe2ad52d6b531440745c009727a374b0302784e5993ad85b3030c5
SHA512 92d0562b604a951bcfcea32569343eeee2c400149faa84375b8eab5f4432bf97bb833b5f9c7c287b1f8f1a330bda52cc9a5868cd35a56789beb7ffc1e9cf7580

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 ad44178267f5212293b130198eaf572b
SHA1 3d69ae5b6a17bb65e398fdeaa3968e7c253af8c3
SHA256 2be3fe51a8e00855a5ce73d6ca124aaef702aca38e90aee897f6939bb31e4a10
SHA512 11059ee9068852207f43759e67529babdb0606a7026cabcf335da6050f413fe23f3251678e804cab156c9f085e216f0fee927dff22ee951b72638a04d3fc2675

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 a9d22116f161bb12796e5f0009fe957e
SHA1 9be9fcef2ac34009869672fc8c26281f27b35f3d
SHA256 704ca1c9949225e3f77d3eec752b164b2bfb832d527662c1e340856afe3bb308
SHA512 416fb1c64b5be7c1b7cf052a5bd1463e5fa3f79529f82810dc52314aa1c3b329e3d779d47f87d3b8ded7e92db2f07e82b81d5b0349e336d67a4e5191fa979e06

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

MD5 503d466cc0bc9f3a37addf47fd9cfec7
SHA1 7cc760121a736ca811fd59833b23a015cb0ff1f3
SHA256 e66ccfbee3168dde480eebbf093e467afe015ae16aa5740fdd8502303893e733
SHA512 954ad87ee8aff66819135eae27a0366ea970a7c3190577986b5bac21c123b49412612e31e43aa6f761ae13218fa81b0f30bdc71c3d2e33100e30cf0cf8ced66d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 34c11a90c51e8fd37353e06faeb7d07c
SHA1 4983e2c589f5bf4985366d5354da5e7a50abfcaa
SHA256 bbaa3a98acceb581ec8695e4b37198a45ae7822dff881e211ff2141852816ee2
SHA512 1a892c7513d7297ec05cb9dfb34a689af865e2e8f817d7ea6a7b09d60347f20e2b3e9bb1c80ecf0e00fff9259e8ac56f8928526ebe75336819945c5d9cbbddd3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 5c20d98852edde46a39457a70f312b93
SHA1 96ff8f9b49843a3df7b56efb1abdcba7f5a28606
SHA256 8fb40f970619a4e7c08ff9786f3070c31e8dceb0ce9a1e0dd296d111352d0ebf
SHA512 d3ff5493f546bf62ee414166bb0ea05bf31ec494e886b938430f72e16f9674ba5e1a46a7752c39bb523bd0ca944f4912ca1cbd546609507b69dfbb309ecea89f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 576b26c57518470f7344d141cee98428
SHA1 bcd75f91718dd7b93d444d92b98749b9537a4516
SHA256 d3b49023c2024b8359c2565f5a20edb0a4a80ba474c2af159a256992def95bcd
SHA512 bd09350c9166f1d7cdadb12fe5bd3b59bb8e450f69af36fdfec3a8af69b01d7082a13e5eda47864dc44ed77275f64bf2967da2f3974d6e03fea3bc1561b10871

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 d2df4aa4500c40cffb78e13083334c70
SHA1 2cf823d34cb368280a313f90003f08cd6629c6a1
SHA256 1c582620737fe82d6a484af61990c9c6aae1d7b2ba491db741e16da7429169af
SHA512 8ecd94045e73dc4aa4979d6a95582baeb0f2baaeb4ee295b57d28c49f1c6060125aa699c86c98e5c754e1ca80588d25183ca4fa446c681f7a9da1af1be525d9c

memory/2300-712-0x00007FF685A90000-0x00007FF686901000-memory.dmp

memory/2300-718-0x00007FFFE3250000-0x00007FFFE33C2000-memory.dmp

memory/2300-720-0x00007FFFE3250000-0x00007FFFE33C2000-memory.dmp

memory/5880-734-0x00007FFFE3250000-0x00007FFFE33C2000-memory.dmp

memory/5044-746-0x00007FFFE3250000-0x00007FFFE33C2000-memory.dmp

memory/2300-747-0x00007FFFE3250000-0x00007FFFE33C2000-memory.dmp

memory/5044-748-0x00007FFFE3250000-0x00007FFFE33C2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\c3158179

MD5 5f0f5d62d37f3678d3e10e85b9588ecb
SHA1 b0a219b49e24939017959c1f5545b02abb23a62b
SHA256 d9e370f998611db2e9095f7dae91293aa7971e7ef2c01d976ab2ae9a3112973b
SHA512 ca0ccabbb6f8641c9cd880481df2ef08060b308ef7db1d1bc78c7a0f1e750ad18a0875c714ef2f0f3cd89000db4004f4114486dfd8a7ded286327df2ab213999

memory/4364-751-0x00007FFFF25B0000-0x00007FFFF27A5000-memory.dmp

memory/4364-752-0x0000000075550000-0x00000000756CB000-memory.dmp

memory/536-757-0x0000000000C00000-0x0000000000E49000-memory.dmp

memory/536-759-0x00007FFFF25B0000-0x00007FFFF27A5000-memory.dmp

memory/536-769-0x0000000000C00000-0x0000000000E49000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V54QW64X\sqlt[1].dll

MD5 90e744829865d57082a7f452edc90de5
SHA1 833b178775f39675fa4e55eab1032353514e1052
SHA256 036a57102385d7f0d7b2deacf932c1c372ae30d924365b7a88f8a26657dd7550
SHA512 0a2d112ff7cb806a74f5ec17fe097d28107bb497d6ed5ad28ea47e6795434ba903cdb49aaf97a9a99c08cd0411f1969cad93031246dc107c26606a898e570323

memory/536-771-0x000000001D070000-0x000000001D2CF000-memory.dmp

memory/536-778-0x0000000000C00000-0x0000000000E49000-memory.dmp