Malware Analysis Report

2025-04-14 08:09

Sample ID 250310-f6ht7atry9
Target 0b4df70b068c231a06bb8fcc5a256e34
SHA256 3ddb787dc820ae5ac61121bc0ff42e0cc86164f00bbe694d524497bd03123e93
Tags
raccoon redline vidar 4 5076357887 76426c3f362f5a47a469f0e9d8bc3eef @tag12312341 afb5c633c4650f69312baef49db9dfa4 nam3 ruxarr_gg discovery infostealer stealer spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3ddb787dc820ae5ac61121bc0ff42e0cc86164f00bbe694d524497bd03123e93

Threat Level: Known bad

The file 0b4df70b068c231a06bb8fcc5a256e34 was found to be: Known bad.

Malicious Activity Summary

raccoon redline vidar 4 5076357887 76426c3f362f5a47a469f0e9d8bc3eef @tag12312341 afb5c633c4650f69312baef49db9dfa4 nam3 ruxarr_gg discovery infostealer stealer spyware

Redline family

Raccoon family

Raccoon

Vidar family

RedLine

Vidar

RedLine payload

Checks computer location settings

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

Checks installed software on the system

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Browser Information Discovery

System Location Discovery: System Language Discovery

Program crash

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

Modifies Internet Explorer settings

Checks SCSI registry key(s)

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-03-10 05:28

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-03-10 05:28

Reported

2025-03-10 05:31

Platform

win7-20240903-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe"

Signatures

Raccoon

stealer raccoon

Raccoon family

raccoon

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

Vidar

stealer vidar

Vidar family

vidar

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Company\NewProduct\nuplat.exe C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe N/A
File opened for modification C:\Program Files (x86)\Company\NewProduct\safert44.exe C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe N/A
File opened for modification C:\Program Files (x86)\Company\NewProduct\rawxdev.exe C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe N/A
File opened for modification C:\Program Files (x86)\Company\NewProduct\EU1.exe C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe N/A
File opened for modification C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe N/A
File opened for modification C:\Program Files (x86)\Company\NewProduct\real.exe C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe N/A
File opened for modification C:\Program Files (x86)\Company\NewProduct\tag.exe C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe N/A
File opened for modification C:\Program Files (x86)\Company\NewProduct\jshainx.exe C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe N/A
File opened for modification C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe N/A
File opened for modification C:\Program Files (x86)\Company\NewProduct\F0geI.exe C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe N/A
File opened for modification C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Company\NewProduct\nuplat.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Company\NewProduct\jshainx.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Company\NewProduct\safert44.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Company\NewProduct\tag.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Company\NewProduct\F0geI.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95F003D1-FD70-11EF-A094-FE6EB537C9A6} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95F727F1-FD70-11EF-A094-FE6EB537C9A6} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95EDA271-FD70-11EF-A094-FE6EB537C9A6} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "447746414" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff00000000000000008604000065020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff19000000190000009f0400007e020000 C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2128 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2128 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Company\NewProduct\F0geI.exe
PID 2128 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Company\NewProduct\F0geI.exe
PID 2128 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Company\NewProduct\F0geI.exe
PID 2128 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Company\NewProduct\F0geI.exe
PID 2128 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
PID 2128 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
PID 2128 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
PID 2128 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe
PID 2128 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
PID 2128 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
PID 2128 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
PID 2128 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe
PID 2128 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Company\NewProduct\nuplat.exe
PID 2128 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Company\NewProduct\nuplat.exe
PID 2128 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Company\NewProduct\nuplat.exe
PID 2128 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Company\NewProduct\nuplat.exe
PID 2096 wrote to memory of 1336 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2096 wrote to memory of 1336 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2096 wrote to memory of 1336 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2096 wrote to memory of 1336 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2128 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Company\NewProduct\real.exe
PID 2128 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Company\NewProduct\real.exe
PID 2128 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Company\NewProduct\real.exe
PID 2128 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Company\NewProduct\real.exe
PID 2128 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Company\NewProduct\safert44.exe
PID 2128 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Company\NewProduct\safert44.exe
PID 2128 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Company\NewProduct\safert44.exe
PID 2128 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Company\NewProduct\safert44.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe

"C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1AbtZ4

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1RyjC4

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1A4aK4

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1RLtX4

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1naEL4

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1RCgX4

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1nhGL4

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1A3AZ4

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1AUSZ4

C:\Program Files (x86)\Company\NewProduct\F0geI.exe

"C:\Program Files (x86)\Company\NewProduct\F0geI.exe"

C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe

"C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"

C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe

"C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"

C:\Program Files (x86)\Company\NewProduct\nuplat.exe

"C:\Program Files (x86)\Company\NewProduct\nuplat.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Company\NewProduct\real.exe

"C:\Program Files (x86)\Company\NewProduct\real.exe"

C:\Program Files (x86)\Company\NewProduct\safert44.exe

"C:\Program Files (x86)\Company\NewProduct\safert44.exe"

C:\Program Files (x86)\Company\NewProduct\tag.exe

"C:\Program Files (x86)\Company\NewProduct\tag.exe"

C:\Program Files (x86)\Company\NewProduct\jshainx.exe

"C:\Program Files (x86)\Company\NewProduct\jshainx.exe"

C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe

"C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe"

C:\Program Files (x86)\Company\NewProduct\rawxdev.exe

"C:\Program Files (x86)\Company\NewProduct\rawxdev.exe"

C:\Program Files (x86)\Company\NewProduct\EU1.exe

"C:\Program Files (x86)\Company\NewProduct\EU1.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2852 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2616 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3060 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2656 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2660 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1476 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2728 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 iplogger.org udp
VN 103.89.90.61:34589 tcp
RU 31.41.244.134:11643 tcp
US 8.8.8.8:53 insttaller.com udp
RU 62.204.41.144:14096 tcp
NO 195.54.170.157:16525 tcp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
SK 45.95.11.158:80 tcp
US 172.67.74.161:443 iplogger.org tcp
US 172.67.74.161:443 iplogger.org tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.179.227:80 c.pki.goog tcp
GB 142.250.179.227:80 c.pki.goog tcp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 c.im udp
US 104.26.6.33:443 c.im tcp
US 172.67.74.161:443 iplogger.org tcp
US 172.67.74.161:443 iplogger.org tcp
US 172.67.74.161:443 iplogger.org tcp
US 172.67.74.161:443 iplogger.org tcp
US 172.67.74.161:443 iplogger.org tcp
US 172.67.74.161:443 iplogger.org tcp
US 172.67.74.161:443 iplogger.org tcp
US 172.67.74.161:443 iplogger.org tcp
US 172.67.74.161:443 iplogger.org tcp
US 172.67.74.161:443 iplogger.org tcp
US 172.67.74.161:443 iplogger.org tcp
US 172.67.74.161:443 iplogger.org tcp
US 172.67.74.161:443 iplogger.org tcp
US 172.67.74.161:443 iplogger.org tcp
US 172.67.74.161:443 iplogger.org tcp
US 172.67.74.161:443 iplogger.org tcp
SK 45.95.11.158:80 tcp
RU 31.41.244.134:11643 tcp
VN 103.89.90.61:34589 tcp
RU 62.204.41.144:14096 tcp
NO 195.54.170.157:16525 tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.19.252.157:80 crl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 23.37.198.101:80 www.microsoft.com tcp
VN 103.89.90.61:34589 tcp
RU 31.41.244.134:11643 tcp
RU 62.204.41.144:14096 tcp
NO 195.54.170.157:16525 tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
RU 31.41.244.134:11643 tcp
VN 103.89.90.61:34589 tcp
RU 62.204.41.144:14096 tcp
NO 195.54.170.157:16525 tcp
RU 31.41.244.134:11643 tcp
VN 103.89.90.61:34589 tcp
RU 62.204.41.144:14096 tcp
NO 195.54.170.157:16525 tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
US 104.26.6.33:443 c.im tcp
RU 31.41.244.134:11643 tcp
NO 195.54.170.157:16525 tcp
VN 103.89.90.61:34589 tcp
RU 62.204.41.144:14096 tcp

Files

\Program Files (x86)\Company\NewProduct\kukurzka9000.exe

MD5 681d98300c552b8c470466d9e8328c8a
SHA1 d15f4a432a2abce96ba9ba74443e566c1ffb933f
SHA256 8bbc892aedc1424ca5c66677b465c826f867515a3fea28821d015edcee71c912
SHA512 b909975d0212d5a5a0cb2e2809ee02224aac729cb761be97a8e3be4ee0a1d7470946da8cf725953c1b2d71fb5fc9dc3c26fd74bce5db5cc0e91a106f8bded887

\Program Files (x86)\Company\NewProduct\nuplat.exe

MD5 17c42a0dad379448ee1e6b21c85e5ac9
SHA1 2fec7fbb4a47092f9c17cd5ebb509a6403cb6d69
SHA256 e080161f57d4eaaad9173b63219ba5a9c2c595324a6b3ffe96783db40839807b
SHA512 5ddfe9af625c54e417452fe582041cdd373b52d4ededbcba71a88050fd834bc8af822257f7ad606e89db3fde15be98f58c1d8ff139dac71d81a23f669617a189

C:\Program Files (x86)\Company\NewProduct\real.exe

MD5 8a370815d8a47020150efa559ffdf736
SHA1 ba9d8df8f484b8da51161a0e29fd29e5001cff5d
SHA256 975457ed5ae0174f06cc093d4f9edcf75d88118cbbac5a1e76ad7bc7c679cd58
SHA512 d2eb60e220f64e76ebed2b051cc14f3a2da29707d8b2eb52fb41760800f11eafeb8bb3f1f8edcfca693a791aa60e56e263063f2b72abe4ad8784061feee6f7bf

C:\Program Files (x86)\Company\NewProduct\tag.exe

MD5 2ebc22860c7d9d308c018f0ffb5116ff
SHA1 78791a83f7161e58f9b7df45f9be618e9daea4cd
SHA256 8e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89
SHA512 d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e

C:\Program Files (x86)\Company\NewProduct\jshainx.exe

MD5 2647a5be31a41a39bf2497125018dbce
SHA1 a1ac856b9d6556f5bb3370f0342914eb7cbb8840
SHA256 84c7458316adf09943e459b4fb1aa79bd359ec1516e0ad947f44bdc6c0931665
SHA512 68f70140af2ad71a40b6c884627047cdcbc92b4c6f851131e61dc9db3658bde99c1a09cad88c7c922aa5873ab6829cf4100dc12b75f237b2465e22770657ae26

C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe

MD5 bbd8ea73b7626e0ca5b91d355df39b7f
SHA1 66e298653beb7f652eb44922010910ced6242879
SHA256 1aa3fdc24e789b01a39944b85c99e4ac08864d2eae7530164cea2821acbf184e
SHA512 625cc9c108b4660030be1282493700e5f0ccfb973f466f61254ed1e1a96f5f042cdeaa94607825a2f694647468e2f525a6451542fe3aac785ebac1ccfe39864f

C:\Program Files (x86)\Company\NewProduct\safert44.exe

MD5 dbe947674ea388b565ae135a09cc6638
SHA1 ae8e1c69bd1035a92b7e06baad5e387de3a70572
SHA256 86aeac2a4ee8e62265ee570718bbd41a4e643e0bad69e7b4fa6c24baeb220709
SHA512 67441aebbf7ce4d53fbb665124f309faed7842b3e424e018454ff6d6f790219633ce6a9b370aeaf77c5092e84f4391df13e964ca6a28597810dee41c3c833893

\Program Files (x86)\Company\NewProduct\rawxdev.exe

MD5 3434d57b4ceb54b8c85974e652175294
SHA1 6d0c7e6b7f61b73564b06ac2020a2674d227bac4
SHA256 cdd49958dd7504d9d1753899815a1542056372222687442e5b5c7fbd2993039e
SHA512 f06fa676d10ff4f5f5c20d00e06ad94895e059724fea47cdf727bd278d9a3ba9daec26f5a0695cb74d87967d6d8020e14305e82725d5bc8c421c095e6704d9aa

\Program Files (x86)\Company\NewProduct\EU1.exe

MD5 eaa8eacd3c59ed71b7f68ef7a96602a3
SHA1 9b35e7b6cd147a4a729d3f6b1791e774a754c589
SHA256 2f7a5ab1ce00d00b1196b2cd815457176467928a47a8c652b8af41e6bab8772b
SHA512 c19934e143dcf1242f2f1584baaad4cebbd2e06d048c2ef9d347683ef0d77e2791c364608957e8ea4c1b9613450c3c2e4112bb56280ee12a4b1b1a63c714d83e

memory/2128-115-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe

MD5 4bf892a854af9af2802f526837819f6e
SHA1 09f2e9938466e74a67368ecd613efdc57f80c30b
SHA256 713eeb4e9271fe4b15160d900ad78498838bb33f7f97ad544a705ab2a46d97cf
SHA512 7ef9d8cb4daf6be60c5a41439dab4e7384676b34de2341ac52cb33815645fbb51a4b78725ea97479d287a8d7a0a61b4b337b1ad49cce2a23c9192fd9b7678d44

C:\Program Files (x86)\Company\NewProduct\F0geI.exe

MD5 501e0f6fa90340e3d7ff26f276cd582e
SHA1 1bce4a6153f71719e786f8f612fbfcd23d3e130a
SHA256 f07d918c6571f11abf9ab7268ac6e2ecbcd931c3d9d878895c777d15052aae2b
SHA512 dee3aabfca7912f15b628253222cfe8d8e13cd64f0438e8d705b68b0a14b4c9523b7a207583be7b424e444d6b05f237484a0c38bf2e075d347ef937d409a3a69

memory/2528-123-0x00000000009E0000-0x0000000000A00000-memory.dmp

memory/1972-122-0x0000000000F20000-0x0000000000F40000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{95F003D1-FD70-11EF-A094-FE6EB537C9A6}.dat

MD5 b1146c652f0b9c69c48e92f33f7cce77
SHA1 6a60086871c82c3a47e103031c16ef6cc2442567
SHA256 deb08d51b143ec65970f66cf4a67c31900337d0834e27c0f4bd9bb5f6edd49a9
SHA512 97ef0b6df6491d7f84beabd960084690da541fb237da82db1d1366979e35475da49fc8a7bdecd84eaf3f8387608b91cf9674905837d482c40d6c3c9018a84ab8

memory/2288-124-0x0000000000240000-0x0000000000284000-memory.dmp

memory/2076-126-0x0000000000040000-0x0000000000060000-memory.dmp

memory/2268-125-0x0000000001200000-0x0000000001220000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{95F003D1-FD70-11EF-A094-FE6EB537C9A6}.dat

MD5 9a3abd543df13f6665e772cd540c37b7
SHA1 c9cda620a23c84469412e51fb739841065e2f1d0
SHA256 8bde785a15b3488e235a5a6cdcd4ca65bf71b02581ed6e6a9ab99f8493b7e511
SHA512 aec32c64b1fdae60a0376fff516e1c6125b35f9329ded108c8dbf18af188a0e9f637c6530cef03c03d36e203fb26fbba7b93d1083f35ae23022f0f05e866e0d6

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{95EDA271-FD70-11EF-A094-FE6EB537C9A6}.dat

MD5 aa9eedf4ccd343f92e590c5b94dd5a5f
SHA1 00410eb82cd131c91b04e793bb72fe581a123edb
SHA256 5b537ec09e0686357b2044eabf2dc10b5cc18667260111220e2d9c32385bcc7c
SHA512 0575662299e4c20d840b8a2b43ad756cf4c45f8fc425bfae33161754f39dbdbfbf2aaa99098ce1f3d6e8c3bb7ca03fe4f4b3d552e5ed66b9958cfd339a215d99

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{95F4C691-FD70-11EF-A094-FE6EB537C9A6}.dat

MD5 bc4f25adc3bb1c0501c801632a8f00c0
SHA1 e2fe7b8856d80245ba484bd13ea79dc907964e80
SHA256 fb6e791fd18e8fe6ff7a35dde829ef62afb66e82a0e066a7609de898b04e161c
SHA512 e43f5b476b8b3c5d2db6d7df98d2f057bf6f7c107a89f2cb473c58aa057b4d90d69ee5a19fdb400a856f1a6e1831f621db2faf4332cbd43d0c60d37ebd95ea55

memory/2288-130-0x00000000002D0000-0x00000000002D6000-memory.dmp

memory/2832-131-0x0000000000400000-0x0000000000482000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{95E67E51-FD70-11EF-A094-FE6EB537C9A6}.dat

MD5 02802dc533809f008b7f5514dfcd6ce0
SHA1 4517bb7a566f02c32fec56842bf4e9dd823a47ec
SHA256 aa69a77a187e726fb210bbc8431ee303fe9e20f185b0e3abcbe438872bfa22a7
SHA512 619095fa178996fec3f7690074953187dc64d53b8197deaff91f4fb807b8587306e67a4dc552b8fa55cf8dc9f643e669d35e79a8e662714659d51fe3bb9a6c6a

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{95EDA271-FD70-11EF-A094-FE6EB537C9A6}.dat

MD5 45703de48b2e7c28d190fc3ec3383a92
SHA1 e9d09afdf0dde01e10474da30af32134531557bd
SHA256 c0231949cca5fca1c6df062fe9446256c3f80ed870af0ee0fef7a3064f7342c1
SHA512 0505bfcc5a2909ec7795ec2ced45275a0f960341458415008f8173da2228bf917868c4fec1733dbc96cf6c6ed8123502933d2010a341b987ed58172fd13bd8a4

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{95F26531-FD70-11EF-A094-FE6EB537C9A6}.dat

MD5 81dac8ecd8a501e803cd44356deb2ac4
SHA1 4a118c3466183952d23fa875dc402d00216d99c9
SHA256 230c969fb6073122e63dde29997870b739cfe4cb49eae92f8e584d874b3f7919
SHA512 318e62f71f6c480776df5de3515b192415959e3a7eadb89f3ebf6316fcb3a78eee35f59a0b15074a73948efa928125955574c47d622764667f82ceb1a17caf57

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 cf760b616215ca3fdbf35ad26ed645df
SHA1 fba607debb4f5c6b3a250bb50fe5eddba8381aec
SHA256 929216784ba892c8d6e27e5ef0c9972169f4ea25004baca84adfa4d94e1e9728
SHA512 860e634f1e7eb849a661ca432b685815abe2b5c6e616ec1d7eba3387ec5f63ceb94925b4c36cb7c90fdb39bb6dce4a4ac99417bd433323532a6db2a446a9fb4c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 c9be626e9715952e9b70f92f912b9787
SHA1 aa2e946d9ad9027172d0d321917942b7562d6abe
SHA256 c13e8d22800c200915f87f71c31185053e4e60ca25de2e41e160e09cd2d815d4
SHA512 7581b7c593785380e9db3ae760af85c1a889f607a3cd2aa5a2695a0e5a0fe8ee751578e88f7d8c997faeda804e2fc2655d859bee2832eace526ed4379edaa3f5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 732a38d26776b722d42bf8cead1378f4
SHA1 38b3601cf710752a43825a119ab1a0bfc01e2ad8
SHA256 a8df59275dfc30d9a1eb636dd84e79f3127e525c716c42e155c71f8e181ed15c
SHA512 7a881668e4286e6311ad582c33d45d2ac586cdffaa13d5ea0124ba37815360543e86fd05d6f59b8d7120badbdbb48b62069730ffa5f6338a7b7072dbbeefd31a

C:\Users\Admin\AppData\Local\Temp\CabE946.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\guoemn1\imagestore.dat

MD5 bc047252a8f2d5440bc21d42c4801e8b
SHA1 a807bc877a6989489cc264ce9e2a148da352716a
SHA256 2650d1c8150522ca44b43cfe73dad677587c4ffdc8fe4b4ae03f30078a4b442a
SHA512 8efeddcf080ad6f4cee070a5115980511f26b7af8aa4e85844bc97960109f8f80cef93a68c152fca22c13e62f353bf8e486564972088368c75fe37b520cbb51c

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WCATT3E5\favicon[1].png

MD5 18c023bc439b446f91bf942270882422
SHA1 768d59e3085976dba252232a65a4af562675f782
SHA256 e0e71acef1efbfab69a1a60cd8fadded948d0e47a0a27c59a0be7033f6a84482
SHA512 a95ad7b48596bc0af23d05d1e58681e5d65e707247f96c5bc088880f4525312a1834a89615a0e33aea6b066793088a193ec29b5c96ea216f531c443487ae0735

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\R1RHX9XC.txt

MD5 01c8d8376828f548a0d5179e866f48c3
SHA1 dc2db3552ee820ec2978d0fdefcfd1c9109f7272
SHA256 55e7d4e002751ff0665b216143792352e2d1b05c36ce72f2b605bb2303accfca
SHA512 8fefa26f95696e3baaeebc92513344228089d4a6029a4a91f13cd0c2c35ed6a5d1e3859673ea1ab396608f52a8f6d031bd3aea76ce90801940008f7db2de5f9f

C:\Users\Admin\AppData\Local\Temp\TarEC53.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\X6X6UE6R.txt

MD5 ae4e56730fbfc37db52630c8439f0e53
SHA1 32f85bd1346b5659a7f4fd3c2dde51b0df84028c
SHA256 33da463c7e2b3d2771fd90b2870c60caa59dcb728e07da11f0a9c32ee6490b9b
SHA512 168fe8a045b4302d72b15166621235c8da2a1a4321114bfe94d010e47203de62d74f715794aca635c2971019fb7dd1203df8686866907a030d3e07f2657f26cc

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\LM8VXXGW.txt

MD5 6d0b11f09fbaea55ef65665f6599595d
SHA1 661507ee8e664ff7a71a989185256d733c15bbc6
SHA256 61f86ebbb425ee7556ec46bbe2fc4ab2cfa1affcfea8e00ca79645c6fc226246
SHA512 00b6737115882845e59d665a8f61bceb6b751f03882e72b4ca09f3e36a5875a8a3aeb471ad00f91a490dc4a4f5b76d1addfac66f6895e0fe5c5eb7218a207523

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\CFUGYAOJ.txt

MD5 68153daf650c39dd6d340c239c588364
SHA1 25694b846694455616386befa8e8f8cb22a80893
SHA256 483c3c9d8c501c2380ca54331cb484e00b12ca33ebdc4688abebed553be43b31
SHA512 b1c0d1544fb2167a90ba1b4100e8688cdd86cdd04de5be7d0a3389e6f4152c7648b588e4ab09d1c6fbe5919fc1789e66513fe216db10c89d48e5892ea1df3ed0

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\MMWG39RA.txt

MD5 93b0c5bdcdb29150122d7638c58adca8
SHA1 b292e4c6b77c14441c70c536b61973419656e65a
SHA256 fd4fb6fe3f14d544cb2a978a6e1844be41741852aa85d3d3794e22c6d54f6a90
SHA512 bdc700c4025b49328c0647cfdd6d1c4fbd782e946b3b19f1ffbb84de104ba96a2a1199384f609a1c5a9b1a426db1330f4c60dcad9a7cdc5f1860f8ee3a7ef323

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WUBCGJ0A\1A3AZ4[1].png

MD5 ec6aae2bb7d8781226ea61adca8f0586
SHA1 d82b3bad240f263c1b887c7c0cc4c2ff0e86dfe3
SHA256 b02fffaba9e664ff7840c82b102d6851ec0bb148cec462cef40999545309e599
SHA512 aa62a8cd02a03e4f462f76ae6ff2e43849052ce77cca3a2ccf593f6669425830d0910afac3cf2c46dd385454a6fb3b4bd604ae13b9586087d6f22de644f9dfc7

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ZXOTLQ8N.txt

MD5 eef1b2153e4ddd7f6f50e49f05e5f9de
SHA1 2116b054e4da66c14c7d735d7a6474fb096c360b
SHA256 d04aadcbbe9b92b82bf53ed695c355e870628132e90da6d6039c6f24f1216e23
SHA512 de41cc059a84b409a084573e7a536552a67c4d742ff83930b30a46565b552f0a63618e829c0b79223329bc2cc79350b1679759df12fdd3afa4d4c4a0fa1b3c45

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\UJWCT89F.txt

MD5 16a36ddea7aa5f17dabbbdef66484304
SHA1 7ed8bfabbec077d742e27704a0818f76eb2f24d7
SHA256 321f3a7710a79c32290d90a6c6feff9381fe9759dde4f4a93cbf19596ab872c8
SHA512 fb43a8e6cc650e36dbf43f9f730f049eed689d45e4eb24ed2c849fb41aa01b12375d647a244b84f23c7143a02bfe3176739cfe7bcb5744a400b43f9be6866be5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 83142242e97b8953c386f988aa694e4a
SHA1 833ed12fc15b356136dcdd27c61a50f59c5c7d50
SHA256 d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755
SHA512 bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

C:\Users\Admin\AppData\Local\Temp\TarFF02.tmp

MD5 109cab5505f5e065b63d01361467a83b
SHA1 4ed78955b9272a9ed689b51bf2bf4a86a25e53fc
SHA256 ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673
SHA512 753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c75ea3def5ee83d74f6307172277038e
SHA1 cb093b233ae976803694d7bc0fab0053485ad026
SHA256 a45f0dfa67652d929089ed675de61b6f98786cfeb5ad3f5aac7823af3460bc7f
SHA512 1910a91051e93e1f72d8a5cbbeea8c4b6a95d914486fff536fe150fef72129684e5e3f5824236d903b02703cc013d447316f5baeaab01faa4947118b9cffa221

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 24b6ca882bbf0f3c2beca77e7760a2e8
SHA1 594d7199214ff22421e8520a1cc92617430c42f6
SHA256 58133f82bdee488bd12d9535967abba06ca1b9e1cfee7eddf75b2f9e0f7600f9
SHA512 5d23ca4f90f2d9c3feb1c1e8bb80fd3ddf62104e981364ee7be07c4c71b66f51d415d42c33ef3b027984d4fa3ae43cf4e6ebfaa7df376bb185e2a1251f7532c4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 178eb7403962bb0771d204652a182195
SHA1 00efc30ca5b992382d31af0fe78f55891da62307
SHA256 cff6bef636972f0f45da81eb0faa14bddb9414366d6677105e49bde36b0996ab
SHA512 ffb807042d63c35d348297c43f084569f125151989de6a9f0ae26759151ebd18dc2d27b4db9cb2c2033e56f77542771503dab667ed589e7817b6be500d3ae9d8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a0af3def83bb2b922f6a3b95e5ab1ea9
SHA1 47edc19d3226b14eedcce37af67131bd7c058158
SHA256 ef8cbfaa3bdaceba5a40d9c15bdca64567b7cb1f8c945b0704d3a066dc92d223
SHA512 da148c35dcbad9360f56c32395a16d6c966e37085ea6b3ccda84829bf58e5344d3bc26c1afabe5ad540c105d103d1cf27c57819d9c41eaa9edf6900d00d0df3f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 606dc942a7992ec8bc4d6129e1a78a84
SHA1 ce1353735d46de2f507145c19ad6f9ef240ee0f8
SHA256 6078669920138445daa95924cabad55457f6f7c5a93301f85bdb2327f4dd602c
SHA512 8c0a49a1792326e5100367e498d08b62ab2337a5f86df8f7e8930b768cc6cd531de23ad818a08f9c500159ce4f7647efbdbeaad1c473408db178d758e56dd184

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e36621aff290dce97aa7dc18840733b6
SHA1 44052358a01ed2c6b5883c7cfd16b8fdd936a3bc
SHA256 a7e754224a39d14bc21cbf3bdca08ae93ccdf2522524490fc6f656ced3eb555c
SHA512 01997f637015c7677d830e373abbe82b4e29289a104677ed730e36cea7e840738e338bbd139b2c07626a766d9679399542e94f1769e441396a9a76aee23930fb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f10d3d59df6b03bf4354229a16d7ccdc
SHA1 add260322f952eb89bf101f8499b9e4379fd734a
SHA256 5646c44988c7449441db5cedbf46da63668cfb0e3b5c1329311ce42955421253
SHA512 8edbe48d39e6b5e016c816f821b71ec6a41be64520966f629011598421e5978b56c106cb5b57c4c5a48e3ee16e601ad93f61b97806e59a21b7ca6afb4c07f21b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 064bb278e1e1459320093abbddefa872
SHA1 7e768ae6f9d3849af222f2712f57fefae5cb3eca
SHA256 fe011ce3d37e6e7b9803ef6636efdb20d36505e284336d4a3d14fbe96fe71dbe
SHA512 47d93b7d4ce26809eebec78f07d839f7b9cd3f758636ddb732a808a517989372f0848685c20e99676ddcace4192fc10b18cb7eb71e0eb8e6b10d69e69ee19696

memory/2844-679-0x0000000000400000-0x000000000046E000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 08b57fadb249c663e32e79f54cc47dca
SHA1 35271b70dc47527fb138e5822312d61a5de4e9c8
SHA256 8ee7a4491054aa2c32055ad4894a727dfd4248951cf4684b8459dae261a1a93a
SHA512 811e20d706771a9bf5c53abe572c7adeb91d87ecdfc8fbf828ba3ca16dd34fb3e4ce2f592147bfb3d37f1ec11e9c26cce728c1e345684f5c27897e7e91eb0cca

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 284fd5edddd91250e76873067da2a311
SHA1 ea763fbbf8cdcd695e0453250c13754b1cced914
SHA256 8711f598637eec3d777f4c84d5587e42a96516d8c57d2632f383b5cb919b429a
SHA512 dced51aff5199672a9a6350c912f2144cd81c01295799c75890fa165176e9016f00638907e00a6dda039376c077b4537e8ff213a629dace94c85daf2c05a00b7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2352363bf46babaa9d651fce9f29306a
SHA1 203901c1f0b7e0ecc57428fde89a25faae4c4036
SHA256 4d81a2788d95b4ee4e1754452595f534721fa74e5c8171b7b65f5eede6b96062
SHA512 aa9b3bf70e0eb98ce99d99f0c06beeb3181d1af37324868d272dab0ed068157f386c406dca91fc315b9e4deeec2b33f999ba3b2a4482772cedae70d397982332

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9288616e180d15014f1ae38080bbdb0b
SHA1 28a11af17708b43eec9b6e354ad86da70ebbcf7a
SHA256 ed802bbfca3ea907a1cdd272f7e63d46f86484391db52a6e0fa943fa8c782b6b
SHA512 fd5e3362d840e897db40bdb8ea2937a15fbc8b7a1bf26cb9f1e9a9587fd574b2a8a164b88952f89aa695469800e60af7922293f794e1d17740a9111a75da6d57

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b3a7b4543172260374b3620e7ea535ed
SHA1 aa19529b8982ce48f3d05f30047a4312f66c2a63
SHA256 5c2941ac45ef0b24f30dd3fab6b80bd4b7a8ee5234924d31db1e3b07186b57d4
SHA512 0afb0dbe041e3fc42caab4d62062cbb2a2f209f632268e2e7aefc48e36fe01b4424131b158d1912aa3f4ad14d66a208cbe150381f108f24eceb99a81a9866f83

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b13c0540d75fe217052f9a5f939e0148
SHA1 ba5e41dd343f9f2181f9fc1a89b2fbf77c86879e
SHA256 8d48e53f5675b23d178baa939cd4961ef61f82104b2127b9d315cfd1643aaa52
SHA512 4d26853d732b98f2e51d08854fd8d54c005a36d8f8cf4e0aec26bb651b2b4ed5d1eeebc78414c12b1e0ec20f0fc2dc82c283d27b9f63bb75594d9ef1f84f43c2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3f37e196a3bf0121e34781d37f885966
SHA1 70dd8ac83179c7cb0a7df61657443abfb7ae3837
SHA256 4ebb95ac72e6136b36efef9f2d4b3bc55bba72b561753834343c2cf8f88b9b4e
SHA512 7211551b2ec4cefd1b1a1d12e271c7c2e7aa3b34706ec64e6880c00b10df14d937d104757e98527f244e1389f9129d0e3814736fb497ad62a4aab18d3f24bbfa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2b6065d50944fed66eb4b718ca1788c4
SHA1 6cdcd999118cba41bf202adb3785881d07d4e366
SHA256 3f172ff9db39669f959885e485af2962a02c56cc0a9e366a5ff010bf72c6e6f5
SHA512 523319a48240f3f92e59f2387ce1ba3b7f4728571d9c458c0d83a3c53102b561e51e04bd61b5cc565b5b24f250ae9415a389a7f4a7c5305945d1f54b0eeb8480

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 dc65ae37ffb95a9fb8262efb0bc612b1
SHA1 8cd4a7afd583cdb5a9d579169d2c1da1ff91b632
SHA256 25198a629e91c4a0af6559059b0bed810c53ad05a9d1aa0bf0743316b0872a52
SHA512 79cd3394f0cd6d9a7543e184be805dfa909fe6e09f4f9aaa7ac4f0a0824165ee3da920fde25699a519129de5740b2f07eed21a2c7d3449f36f1a6cf67b561dc7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4d78611011c435fef192207cdc0add17
SHA1 2b4ed8b83ae5195b5cec4463c908f3038a0e7276
SHA256 f2453dcc0ba80a17c27202a63ac05f0f0bbd5e8e2021c74eb6d9f085aec1c03c
SHA512 a63706df68bb64e650b59c366815e4800ee72a2271f99990b38b4b52b15e2b3bd92611269f2b4039b841fe374169ca695b14b75f7c9ea81ebe4a1996d8c9de59

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0243029f12770d28064d3970f5e0ecc6
SHA1 1a66b6d39c891249a9f87b56f9ff3f85d343d43f
SHA256 8059cb24bc9d7a52e5fb0b5f3a90c6e3dcb531379d57e79111643f3b5f416bf0
SHA512 5b4f52667a4bb8798838450a2b28955c7a3089764043afb98714b7979c133d6915727cff2e8667bb833a02ced570bb69d472e5fe3349171800897220d9e679f7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 21b8dd16e99387bb020bd2414113c718
SHA1 a429fb0038ef2e7214b1c86ab99b583fe6ade91f
SHA256 da4d136950ef10c65605fac5b36918f15e8de7e95b51329627239ca811a8cc39
SHA512 3a599f3c6b7a5b321e9a08c6e6ca76c46e45681ab577c9d59eb250a37eff4972adc995e3104e83631a59783424441229a8dfbee2394c710c160fc050b0a65f2d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a598d85aaf7b296070e026053aeff214
SHA1 8050f9f9e1ff1e36d70cd1b32ac4d85db043b617
SHA256 5c2ffd00119dbd980710d0492fda661a6320e0da3a1ed5a5d2fe1fe78c362734
SHA512 986b624121dbc8c001d81efee8fade3f57529b8abaed0caed3fcecc85b479dc97edca0d605a7a17cff420f77cc725cf5682781eb9751bbc0545430ecda0da48a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 98bb29cff3d6fcffeebab440b7a1004e
SHA1 4d1d3190ba4610dab6dc737253fb9806c8e16abc
SHA256 a799ebfc616fe2417d23636bc290af4823bcad526dd771f77d68402210ce597a
SHA512 95d3fcc994ae7cb7a735d73cc00c561bc2c1b6c8930f0b874227f427573fdb1df88beaf7201608bf94f5e2d8496053ff64e336482cce15de0700a9ec57181c07

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e07d46fd45b162913d523f8e0c2ae3be
SHA1 3846a565b628635cb4181c8608bbc0d5fdf49b4f
SHA256 bb864c91c1d1674ca8c87125c90f77f162c1c8dcd233ca72607c41eb21724920
SHA512 d89cebe3b3e165d490ad38add9b05cdaf884e6c3c1998babb09cfd0ec6345579c2cacc2eb1ff17454d57b80766b33213c2750f6d674e167dd3329eafa2376dc2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2a68153d42ef45ea9f578a382856c705
SHA1 56e78b6ef37c1e00a3b3b38a16724df3dc4be579
SHA256 39b8a25f35fead19b2dacb6c11d775445780eddfa986b21d319e859559068f6e
SHA512 b2b01839c7177c0c7eeb58192f4a495f941dccbc0f08e958994b75649f84adc827bd239d67c7df769b9132e1f102f0b5b38e645df752c3b7f5a2cd5220f4eaa7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f5da4d926f16298de1679e368219b005
SHA1 758ce56ad1c364ef085c253bfe79a3c598b88e60
SHA256 a964ee3f9446ae77505eac97d3b4d2bf962ed340cbd4324b8b8a569914844da1
SHA512 12917f78030921dc138d3d87fab61c84ca6eb96227d071036900e4aa9f2213b62cb24cb6dc1459a07ebb5d15b2e38ad35a16b0abc6bafa9f15efceb3aa681c72

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9a00bc658211266ac60867f6a5996c89
SHA1 f25cf59a18996064a132fb05e351042d6422a2b3
SHA256 eefd1227ef40dfeefde63ae65a39fcc52c40d0f6a25ba01fb6628930cd3d25e9
SHA512 ad170c2fabd54df11e21b97fc0a4d1d4c1b973f7316fe873adc5357645a55c68bc0f17dc768099f1a14a69ea79d68db94ee230955663ad4602367b7548f7a010

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a0e222d59dbd9003ddd71968a7c83e1d
SHA1 c884605c72e098b07fa1c13272e408fa56ea6f6d
SHA256 e495b0deadce635c63ea9328d5c3f46a0662a505ee4048ed9630e0eeba8fcc4e
SHA512 a8ac0a8da2fda4d38ba428cb6b77d82595abb671f7c42f081b87e3d507811062d907c4a078b4c3330425417a6f34fc41c805a28f38adc67a66f22ffb425767c0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a6591f7552c023cffecbfb86baf80a87
SHA1 68752c6a8d100a3ba53191c841c39c35d3d31030
SHA256 89bfe24c90ea1c4ee2a35618d2425c7f155c759cbc207bc8210c05887b382760
SHA512 f31efb609278347e01632918abbbb0c54cf4996962d8092cc0ce5439d8b411294bf21aa1242f1fb96a86d48b43e99e10558f4a60570367f90e3712dbd489963a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c94c7710288ea24020c2bee9cfa9cd79
SHA1 acc2910dbc4c0585c1dc132f2babda808e6d5ead
SHA256 0b96590552acdd58058ceea7560354a88a2e6eb48891347cdb330ac89418cf7c
SHA512 7ef6bfbb1c63470782d5892cd8dcb36cd1e5c9316bfa39b5b2d23650ff2d549486c801d09fbe4be19b26aa1447352758420f200ffe42fc8cb04e16b6f650ce1a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 738a69087857895d38ff431edbf37a33
SHA1 083f9e7ec39784933384ccf33ea6659876549a35
SHA256 8cff2bc8d8d4d4fe1efcfad250c1c8e3a9755e1106bb6f9261f130fe42353660
SHA512 78cbf4107cd8594167cf25478161708a8b9abaafc1d6b9fd1fadcf05c460646bf9fe69fe19f5090e2c70b115dbab65dbea4a146ecd03a53c4e6797add2509985

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 207e345546b7e675536ad58d6b750091
SHA1 0f5d87cbe6b1d07e9336b58dcc4f9e3053d6a596
SHA256 e29637da881431bf45db4b5d3fbcd69003420ab9ff24199e586451b37b2cfa07
SHA512 5783ccff257dac972aa6a48e6c930fdf9ddb2a35d3c5ff72c1b7c6d2a5a5e43b1349ccc9c710953dec535e8a55eb8c7021c178dc5283471f10b46b4d63ec5f04

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7319140c24829332e53188b363528d7f
SHA1 59da6b27fc085312c40ed75f114222d9d1b20080
SHA256 f92c4e544eaec1c111d2796b41fbbf76e9365165a7f3f2e965f5702e586e7d8f
SHA512 d46f86d7af8ea795707bf9bdafc0ba62bdc79473eaa4bc53a72e5a5eefa016ad71fe860d4013ec51b403ad67c7aa97a74e61b0e59691e978c3c19fb5bfb9cce9

Analysis: behavioral2

Detonation Overview

Submitted

2025-03-10 05:28

Reported

2025-03-10 05:29

Platform

win10v2004-20250217-en

Max time kernel

48s

Max time network

47s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe"

Signatures

Raccoon

stealer raccoon

Raccoon family

raccoon

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Company\NewProduct\F0geI.exe C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe N/A
File opened for modification C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe N/A
File opened for modification C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe N/A
File opened for modification C:\Program Files (x86)\Company\NewProduct\real.exe C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe N/A
File opened for modification C:\Program Files (x86)\Company\NewProduct\safert44.exe C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe N/A
File opened for modification C:\Program Files (x86)\Company\NewProduct\tag.exe C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe N/A
File opened for modification C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe N/A
File opened for modification C:\Program Files (x86)\Company\NewProduct\rawxdev.exe C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe N/A
File opened for modification C:\Program Files (x86)\Company\NewProduct\nuplat.exe C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe N/A
File opened for modification C:\Program Files (x86)\Company\NewProduct\jshainx.exe C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe N/A
File opened for modification C:\Program Files (x86)\Company\NewProduct\EU1.exe C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Company\NewProduct\F0geI.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Company\NewProduct\nuplat.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Company\NewProduct\safert44.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Company\NewProduct\jshainx.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Company\NewProduct\real.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Company\NewProduct\tag.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Company\NewProduct\rawxdev.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Company\NewProduct\EU1.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1988 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 3080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1772 wrote to memory of 2492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1772 wrote to memory of 2492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 3740 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3740 wrote to memory of 4080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3740 wrote to memory of 4080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1920 wrote to memory of 5048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1920 wrote to memory of 5048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 5216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3712 wrote to memory of 5216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1988 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2780 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2780 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 492 wrote to memory of 1144 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe

"C:\Users\Admin\AppData\Local\Temp\0b4df70b068c231a06bb8fcc5a256e34.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1AbtZ4

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9cc7946f8,0x7ff9cc794708,0x7ff9cc794718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RyjC4

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9cc7946f8,0x7ff9cc794708,0x7ff9cc794718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1A4aK4

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9cc7946f8,0x7ff9cc794708,0x7ff9cc794718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RLtX4

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9cc7946f8,0x7ff9cc794708,0x7ff9cc794718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1naEL4

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9cc7946f8,0x7ff9cc794708,0x7ff9cc794718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1RCgX4

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9cc7946f8,0x7ff9cc794708,0x7ff9cc794718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13363000846321005949,9835260543836557975,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,13363000846321005949,9835260543836557975,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,13363000846321005949,9835260543836557975,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13363000846321005949,9835260543836557975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13363000846321005949,9835260543836557975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,10450622782865810660,1364111380689877056,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,10450622782865810660,1364111380689877056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1nhGL4

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9cc7946f8,0x7ff9cc794708,0x7ff9cc794718

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1524,2469086029311251369,16726401438136036082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13363000846321005949,9835260543836557975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13363000846321005949,9835260543836557975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,4760392452462083419,945276618543976586,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13363000846321005949,9835260543836557975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4316 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1A3AZ4

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13363000846321005949,9835260543836557975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4516 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9cc7946f8,0x7ff9cc794708,0x7ff9cc794718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13363000846321005949,9835260543836557975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,11361490975799842560,2639700688579362241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1AUSZ4

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9cc7946f8,0x7ff9cc794708,0x7ff9cc794718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13363000846321005949,9835260543836557975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1

C:\Program Files (x86)\Company\NewProduct\F0geI.exe

"C:\Program Files (x86)\Company\NewProduct\F0geI.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13363000846321005949,9835260543836557975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1

C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe

"C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe"

C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe

"C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13363000846321005949,9835260543836557975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1

C:\Program Files (x86)\Company\NewProduct\nuplat.exe

"C:\Program Files (x86)\Company\NewProduct\nuplat.exe"

C:\Program Files (x86)\Company\NewProduct\real.exe

"C:\Program Files (x86)\Company\NewProduct\real.exe"

C:\Program Files (x86)\Company\NewProduct\safert44.exe

"C:\Program Files (x86)\Company\NewProduct\safert44.exe"

C:\Program Files (x86)\Company\NewProduct\tag.exe

"C:\Program Files (x86)\Company\NewProduct\tag.exe"

C:\Program Files (x86)\Company\NewProduct\jshainx.exe

"C:\Program Files (x86)\Company\NewProduct\jshainx.exe"

C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe

"C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe"

C:\Program Files (x86)\Company\NewProduct\rawxdev.exe

"C:\Program Files (x86)\Company\NewProduct\rawxdev.exe"

C:\Program Files (x86)\Company\NewProduct\EU1.exe

"C:\Program Files (x86)\Company\NewProduct\EU1.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 6504 -ip 6504

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6504 -s 1320

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,13363000846321005949,9835260543836557975,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,13363000846321005949,9835260543836557975,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13363000846321005949,9835260543836557975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13363000846321005949,9835260543836557975,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6980 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13363000846321005949,9835260543836557975,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4436 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13363000846321005949,9835260543836557975,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 6020 -ip 6020

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 764

Network

Country Destination Domain Proto
US 8.8.8.8:53 iplogger.org udp
US 172.67.74.161:443 iplogger.org tcp
VN 103.89.90.61:34589 tcp
RU 62.204.41.144:14096 tcp
DE 146.19.247.187:80 146.19.247.187 tcp
US 8.8.8.8:53 insttaller.com udp
RU 31.41.244.134:11643 tcp
SK 45.95.11.158:80 tcp
NO 195.54.170.157:16525 tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
GB 92.123.128.181:443 www.bing.com tcp
US 8.8.8.8:53 c.im udp
US 104.26.7.33:443 c.im tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 c.pki.goog udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
GB 142.250.179.227:80 c.pki.goog tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 insttaller.com udp
US 8.8.8.8:53 insttaller.com udp
US 8.8.8.8:53 insttaller.com udp
US 8.8.8.8:53 insttaller.com udp
US 8.8.8.8:53 insttaller.com udp
VN 103.89.90.61:34589 tcp
RU 62.204.41.144:14096 tcp
NO 195.54.170.157:16525 tcp
RU 31.41.244.134:11643 tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a4852fc46a00b2fbd09817fcd179715d
SHA1 b5233a493ea793f7e810e578fe415a96e8298a3c
SHA256 6cbb88dea372a5b15d661e78a983b0c46f7ae4d72416978814a17aa65a73079f
SHA512 38972cf90f5ca9286761280fcf8aa375f316eb59733466375f8ba055ce84b6c54e2297bad9a4212374c860898517e5a0c69343190fc4753aafc904557c1ea6dc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0d6b4373e059c5b1fc25b68e6d990827
SHA1 b924e33d05263bffdff75d218043eed370108161
SHA256 fafcaeb410690fcf64fd35de54150c2f9f45b96de55812309c762e0a336b4aa2
SHA512 9bffd6911c9071dd70bc4366655f2370e754274f11c2e92a9ac2f760f316174a0af4e01ddb6f071816fdcad4bb00ff49915fb18fde7ee2dabb953a29e87d29e4

\??\pipe\LOCAL\crashpad_492_XXSOCWQKOHSRTODJ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 46a111958501789aae0d93552b027504
SHA1 09edc5f6493ca5effce7958ebba5a5689e691cb1
SHA256 e50ba88e15c6fa296c1f02fbedb41062a011c5ee3071c5fc1660585e21d596eb
SHA512 2d1f6f70dd14edad6546228ae7c8ee59631524f6abc21bf9c1cd24760bb52abc1500901b4c27566336ce217a07eb51c2f865a184065bd74659e12448660fae30

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 f977ac0d1f905370b94d37d572f4eb93
SHA1 b401efe9d4048b913ddb26e730b5dcd3cfeaeaa9
SHA256 724c57df53f819437d8b850e00b8978e91ca55a20f59fbed363d07eb250ee237
SHA512 c8caa29357b910ef5ae635f6fe3399e38c8ae510ebcd04bbe60fb23b153ba52c78f7ba8a54510db471eea8234cf101af8cfd225c630860c248c716ee5e68e9e4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a2b32e1c5605e4b4176bdc4c75d1ebdb
SHA1 9b4923fc5ca3f66505f80359bec43565e47f2499
SHA256 995e6a236854f2afcd1119ab88f5094901f24b4a19cd614ae2dfc4e48f2ffffe
SHA512 dbc28a6ff556d3c7a135bff84caf7a11664c3807f6dd970fa9ed64807a1c3f2ccb729c941536d0c6f27d4cf434caac3d225a55cbf5dbbc5fea7f6fd0037ac431

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 33108bfdb1fb85bcad4f5e3488e1454f
SHA1 5abc7c3e816d169ea9b0184906ff0170fc149e8b
SHA256 a2207bdfd0f9661e583e11fd5debe0416ed2b92086507c38560818e71223fcaf
SHA512 bbf140946d0c54a4893980e7bbfcb3b8f73eedfc83f310c8d4b79d3ef426f480fe2f251b740a74dc17672b2d945e7876a965fdb56bc37fc03621a28096ea24e5

C:\Program Files (x86)\Company\NewProduct\F0geI.exe

MD5 501e0f6fa90340e3d7ff26f276cd582e
SHA1 1bce4a6153f71719e786f8f612fbfcd23d3e130a
SHA256 f07d918c6571f11abf9ab7268ac6e2ecbcd931c3d9d878895c777d15052aae2b
SHA512 dee3aabfca7912f15b628253222cfe8d8e13cd64f0438e8d705b68b0a14b4c9523b7a207583be7b424e444d6b05f237484a0c38bf2e075d347ef937d409a3a69

C:\Program Files (x86)\Company\NewProduct\kukurzka9000.exe

MD5 681d98300c552b8c470466d9e8328c8a
SHA1 d15f4a432a2abce96ba9ba74443e566c1ffb933f
SHA256 8bbc892aedc1424ca5c66677b465c826f867515a3fea28821d015edcee71c912
SHA512 b909975d0212d5a5a0cb2e2809ee02224aac729cb761be97a8e3be4ee0a1d7470946da8cf725953c1b2d71fb5fc9dc3c26fd74bce5db5cc0e91a106f8bded887

C:\Program Files (x86)\Company\NewProduct\nuplat.exe

MD5 17c42a0dad379448ee1e6b21c85e5ac9
SHA1 2fec7fbb4a47092f9c17cd5ebb509a6403cb6d69
SHA256 e080161f57d4eaaad9173b63219ba5a9c2c595324a6b3ffe96783db40839807b
SHA512 5ddfe9af625c54e417452fe582041cdd373b52d4ededbcba71a88050fd834bc8af822257f7ad606e89db3fde15be98f58c1d8ff139dac71d81a23f669617a189

C:\Program Files (x86)\Company\NewProduct\namdoitntn.exe

MD5 bbd8ea73b7626e0ca5b91d355df39b7f
SHA1 66e298653beb7f652eb44922010910ced6242879
SHA256 1aa3fdc24e789b01a39944b85c99e4ac08864d2eae7530164cea2821acbf184e
SHA512 625cc9c108b4660030be1282493700e5f0ccfb973f466f61254ed1e1a96f5f042cdeaa94607825a2f694647468e2f525a6451542fe3aac785ebac1ccfe39864f

memory/6308-179-0x0000000000620000-0x0000000000640000-memory.dmp

C:\Program Files (x86)\Company\NewProduct\real.exe

MD5 8a370815d8a47020150efa559ffdf736
SHA1 ba9d8df8f484b8da51161a0e29fd29e5001cff5d
SHA256 975457ed5ae0174f06cc093d4f9edcf75d88118cbbac5a1e76ad7bc7c679cd58
SHA512 d2eb60e220f64e76ebed2b051cc14f3a2da29707d8b2eb52fb41760800f11eafeb8bb3f1f8edcfca693a791aa60e56e263063f2b72abe4ad8784061feee6f7bf

C:\Program Files (x86)\Company\NewProduct\safert44.exe

MD5 dbe947674ea388b565ae135a09cc6638
SHA1 ae8e1c69bd1035a92b7e06baad5e387de3a70572
SHA256 86aeac2a4ee8e62265ee570718bbd41a4e643e0bad69e7b4fa6c24baeb220709
SHA512 67441aebbf7ce4d53fbb665124f309faed7842b3e424e018454ff6d6f790219633ce6a9b370aeaf77c5092e84f4391df13e964ca6a28597810dee41c3c833893

C:\Program Files (x86)\Company\NewProduct\tag.exe

MD5 2ebc22860c7d9d308c018f0ffb5116ff
SHA1 78791a83f7161e58f9b7df45f9be618e9daea4cd
SHA256 8e2c9fd68fc850fa610d1edfd46fc4a66adbef24e42a1841290b0e0c08597e89
SHA512 d4842627f6fab09f9472ed0b09b5e012524bf6b821d90a753275f68de65b7ba084a9e15daca58a183f89b166cc9d2d2f2d6a81e1110e66c5822b548279c8c05e

memory/6572-209-0x00000000001E0000-0x0000000000224000-memory.dmp

C:\Program Files (x86)\Company\NewProduct\jshainx.exe

MD5 2647a5be31a41a39bf2497125018dbce
SHA1 a1ac856b9d6556f5bb3370f0342914eb7cbb8840
SHA256 84c7458316adf09943e459b4fb1aa79bd359ec1516e0ad947f44bdc6c0931665
SHA512 68f70140af2ad71a40b6c884627047cdcbc92b4c6f851131e61dc9db3658bde99c1a09cad88c7c922aa5873ab6829cf4100dc12b75f237b2465e22770657ae26

memory/6668-220-0x00000000003B0000-0x00000000003D0000-memory.dmp

memory/6308-238-0x0000000005A20000-0x0000000006038000-memory.dmp

C:\Program Files (x86)\Company\NewProduct\ffnameedit.exe

MD5 4bf892a854af9af2802f526837819f6e
SHA1 09f2e9938466e74a67368ecd613efdc57f80c30b
SHA256 713eeb4e9271fe4b15160d900ad78498838bb33f7f97ad544a705ab2a46d97cf
SHA512 7ef9d8cb4daf6be60c5a41439dab4e7384676b34de2341ac52cb33815645fbb51a4b78725ea97479d287a8d7a0a61b4b337b1ad49cce2a23c9192fd9b7678d44

memory/6668-229-0x0000000004C30000-0x0000000004C42000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 49caef93ed9e33d4b51c9e5a66d89eeb
SHA1 cb7b9d089653f270715459ea8039646c1e420858
SHA256 1c09ddd5deabe47474445ac23fa9127d68932ef337e9fc51360cc6d1151220e7
SHA512 71a3da064b8cd1019ff0f2e6c9306cdb572e6e773641b2803fa28b3aead7544f02ae790dfa46ee4b7819ed51c3a65bec7d50858b0a6a659ca9babcb23d3d2707

memory/6572-227-0x0000000000C60000-0x0000000000C66000-memory.dmp

memory/6788-242-0x0000000000570000-0x0000000000590000-memory.dmp

memory/6308-240-0x0000000007490000-0x000000000759A000-memory.dmp

C:\Program Files (x86)\Company\NewProduct\rawxdev.exe

MD5 3434d57b4ceb54b8c85974e652175294
SHA1 6d0c7e6b7f61b73564b06ac2020a2674d227bac4
SHA256 cdd49958dd7504d9d1753899815a1542056372222687442e5b5c7fbd2993039e
SHA512 f06fa676d10ff4f5f5c20d00e06ad94895e059724fea47cdf727bd278d9a3ba9daec26f5a0695cb74d87967d6d8020e14305e82725d5bc8c421c095e6704d9aa

memory/6884-266-0x00000000006F0000-0x0000000000710000-memory.dmp

C:\Program Files (x86)\Company\NewProduct\EU1.exe

MD5 eaa8eacd3c59ed71b7f68ef7a96602a3
SHA1 9b35e7b6cd147a4a729d3f6b1791e774a754c589
SHA256 2f7a5ab1ce00d00b1196b2cd815457176467928a47a8c652b8af41e6bab8772b
SHA512 c19934e143dcf1242f2f1584baaad4cebbd2e06d048c2ef9d347683ef0d77e2791c364608957e8ea4c1b9613450c3c2e4112bb56280ee12a4b1b1a63c714d83e

memory/6668-250-0x0000000004CD0000-0x0000000004D1C000-memory.dmp

memory/6668-243-0x0000000004C90000-0x0000000004CCC000-memory.dmp

memory/1988-276-0x0000000000400000-0x0000000000433000-memory.dmp

memory/6240-283-0x0000000000400000-0x0000000000482000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 59d483f1a3d927602bd0e44d1a43d3a1
SHA1 13e83feb4a2da1bf77e73a655ea54f8df4fe6fdc
SHA256 bc1134de6ad08f92d871fc58da8640caf1fe3d8fd764821e7814b61c0753e896
SHA512 a809c078c9309378bd0d7deb7e0284f43b076b736e9955acfb843cc707b34567b3e9539f70f5fd576c3dae18aa585f606de170cac50bce016b363daaf5d073cd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 101435dbdc4b346b37a2ad9516fde6ac
SHA1 58eecd7cdb6781a17974c9b97718726baf200551
SHA256 93b33654bfd653df282c98405bde86d3f05fa33d0100813f52b8349c56637800
SHA512 70f9864ff913aa547aa1563f9046b6685984ab97e2dd3cde3c198cae56943b7d353f8aa38a148f2a2b451e1a7459cb5e7acb87fb611aeea8e71f57a6f2de89f4

memory/6020-354-0x0000000000400000-0x000000000046E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 17c68f238099d6cab71aee1f8bdf2584
SHA1 b1e68927c5e13d57734f872218d7297df1557b5a
SHA256 eba5a3f63faa40ba1d73f9d79feac3c9bc92104aca320acf0f77ae1623605c76
SHA512 b8d4c3689af116c291cb9f441f9a677566912d8668d192bd740677cec96e5d6290a75a8551dcccd75dd5a66e72d5f88417cafed5daa5feeb1c6fef5920d627e0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a9d48992358c24a971b1e8e2b6aa5e80
SHA1 859de31cda41a0d222c6f6ccfa0b441fbfef744e
SHA256 d21044114149f1fb9dd655f95a7b5a36522b21c57157c6170e306ca82fc638f8
SHA512 69ccc17f6725a1817bdf7e2628d30b82652507ea574803c9620cb1f16d580a909882aba90b2c002527742fcfbe395efc0b546d47c2e0a372b18678aee4352dcb

memory/7148-374-0x000002646CD30000-0x000002646CD31000-memory.dmp

memory/7148-376-0x000002646CD30000-0x000002646CD31000-memory.dmp

memory/7148-375-0x000002646CD30000-0x000002646CD31000-memory.dmp

memory/7148-386-0x000002646CD30000-0x000002646CD31000-memory.dmp

memory/7148-385-0x000002646CD30000-0x000002646CD31000-memory.dmp

memory/7148-384-0x000002646CD30000-0x000002646CD31000-memory.dmp

memory/7148-383-0x000002646CD30000-0x000002646CD31000-memory.dmp

memory/7148-382-0x000002646CD30000-0x000002646CD31000-memory.dmp

memory/7148-381-0x000002646CD30000-0x000002646CD31000-memory.dmp

memory/7148-380-0x000002646CD30000-0x000002646CD31000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 1b439575a46e38546e5d267569687f4d
SHA1 0f20dab54daf5175b1a2cd6349f969f6629cbdc2
SHA256 e4f10433722ea919b12d8def21e40a6a62edc26f1f5556fd0076984160a50981
SHA512 642ac27955656d3aba62cdd11e468a2a28f3bb5d59a42c2a3ca2e9a011eef3912b09d1ad37ae57f400aed6665befc0e770b40e1a84636424b9ea139cdc1c725e