Malware Analysis Report

2024-11-13 19:09

Sample ID 231111-xqyzxabb3x
Target 8d7ad4081ab12759da00302d3cdce17cf0929b68465525e5f9ac9dbd1a36a167
SHA256 8d7ad4081ab12759da00302d3cdce17cf0929b68465525e5f9ac9dbd1a36a167
Tags
glupteba mystic redline smokeloader zgrat taiga up3 backdoor dropper evasion infostealer loader persistence rat stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8d7ad4081ab12759da00302d3cdce17cf0929b68465525e5f9ac9dbd1a36a167

Threat Level: Known bad

The file 8d7ad4081ab12759da00302d3cdce17cf0929b68465525e5f9ac9dbd1a36a167 was found to be: Known bad.

Malicious Activity Summary

glupteba mystic redline smokeloader zgrat taiga up3 backdoor dropper evasion infostealer loader persistence rat stealer trojan

Detect ZGRat V1

ZGRat

SmokeLoader

RedLine payload

RedLine

Detect Mystic stealer payload

Glupteba

Glupteba payload

Mystic

Stops running service(s)

Downloads MZ/PE file

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

AutoIT Executable

Drops file in Windows directory

Launches sc.exe

Unsigned PE

Program crash

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Modifies registry class

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-11-11 19:04

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-11-11 19:04

Reported

2023-11-11 19:06

Platform

win10-20231023-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8d7ad4081ab12759da00302d3cdce17cf0929b68465525e5f9ac9dbd1a36a167.exe"

Signatures

Detect Mystic stealer payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Mystic

stealer mystic

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

ZGRat

rat zgrat

Downloads MZ/PE file

Stops running service(s)

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\8d7ad4081ab12759da00302d3cdce17cf0929b68465525e5f9ac9dbd1a36a167.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nL0Fz87.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Xg9Dk17.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bQ5MF76.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rescache\_merged\3720402701\2219095117.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
File opened for modification C:\Windows\Debug\ESE.TXT C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
File created C:\Windows\rescache\_merged\3720402701\2219095117.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
File created C:\Windows\rescache\_merged\3720402701\2219095117.pri C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\system32\browser_broker.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164C = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = c33177e1d114da01 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 5f7cc3e1d114da01 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 6b3539e1d114da01 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0" C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4528 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\8d7ad4081ab12759da00302d3cdce17cf0929b68465525e5f9ac9dbd1a36a167.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nL0Fz87.exe
PID 4528 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\8d7ad4081ab12759da00302d3cdce17cf0929b68465525e5f9ac9dbd1a36a167.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nL0Fz87.exe
PID 4528 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\8d7ad4081ab12759da00302d3cdce17cf0929b68465525e5f9ac9dbd1a36a167.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nL0Fz87.exe
PID 1300 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nL0Fz87.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Xg9Dk17.exe
PID 1300 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nL0Fz87.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Xg9Dk17.exe
PID 1300 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nL0Fz87.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Xg9Dk17.exe
PID 4764 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Xg9Dk17.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bQ5MF76.exe
PID 4764 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Xg9Dk17.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bQ5MF76.exe
PID 4764 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Xg9Dk17.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bQ5MF76.exe
PID 3924 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bQ5MF76.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe
PID 3924 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bQ5MF76.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe
PID 3924 wrote to memory of 632 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bQ5MF76.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe

Processes

C:\Users\Admin\AppData\Local\Temp\8d7ad4081ab12759da00302d3cdce17cf0929b68465525e5f9ac9dbd1a36a167.exe

"C:\Users\Admin\AppData\Local\Temp\8d7ad4081ab12759da00302d3cdce17cf0929b68465525e5f9ac9dbd1a36a167.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nL0Fz87.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nL0Fz87.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Xg9Dk17.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Xg9Dk17.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bQ5MF76.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bQ5MF76.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca

C:\Windows\system32\browser_broker.exe

C:\Windows\system32\browser_broker.exe -Embedding

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2zn4693.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2zn4693.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7uj73DE.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7uj73DE.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 568

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\8LZ502ln.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\8LZ502ln.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\9uV1te5.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\9uV1te5.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Users\Admin\AppData\Local\Temp\CD7C.exe

C:\Users\Admin\AppData\Local\Temp\CD7C.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5876 -s 760

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Users\Admin\AppData\Local\Temp\2012.exe

C:\Users\Admin\AppData\Local\Temp\2012.exe

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

"C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"

C:\Users\Admin\AppData\Local\Temp\2785.exe

C:\Users\Admin\AppData\Local\Temp\2785.exe

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\Broom.exe

C:\Users\Admin\AppData\Local\Temp\Broom.exe

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\latestX.exe

"C:\Users\Admin\AppData\Local\Temp\latestX.exe"

C:\Users\Admin\AppData\Local\Temp\2785.exe

C:\Users\Admin\AppData\Local\Temp\2785.exe

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Users\Admin\AppData\Local\Temp\4.exe

C:\Users\Admin\AppData\Local\Temp\4.exe

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

Network

Country Destination Domain Proto
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 48.101.122.92.in-addr.arpa udp
US 8.8.8.8:53 www.facebook.com udp
NL 157.240.247.35:443 www.facebook.com tcp
NL 157.240.247.35:443 www.facebook.com tcp
US 8.8.8.8:53 35.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 35.247.240.157.in-addr.arpa udp
NL 142.250.179.141:443 accounts.google.com tcp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 store.steampowered.com udp
NL 104.85.0.101:443 store.steampowered.com tcp
NL 104.85.0.101:443 store.steampowered.com tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 157.240.5.10:443 static.xx.fbcdn.net tcp
US 157.240.5.10:443 static.xx.fbcdn.net tcp
US 157.240.5.10:443 static.xx.fbcdn.net tcp
US 157.240.5.10:443 static.xx.fbcdn.net tcp
US 157.240.5.10:443 static.xx.fbcdn.net tcp
US 157.240.5.10:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 facebook.com udp
US 157.240.5.35:443 facebook.com tcp
US 157.240.5.35:443 facebook.com tcp
US 8.8.8.8:53 fbcdn.net udp
US 8.8.8.8:53 35.5.240.157.in-addr.arpa udp
US 157.240.5.35:443 fbcdn.net tcp
US 157.240.5.35:443 fbcdn.net tcp
US 8.8.8.8:53 10.5.240.157.in-addr.arpa udp
US 8.8.8.8:53 101.0.85.104.in-addr.arpa udp
US 8.8.8.8:53 steamcommunity.com udp
US 8.8.8.8:53 twitter.com udp
US 8.8.8.8:53 25.101.122.92.in-addr.arpa udp
US 8.8.8.8:53 www.epicgames.com udp
US 8.8.8.8:53 fbsbx.com udp
US 157.240.5.35:443 fbsbx.com tcp
US 157.240.5.35:443 fbsbx.com tcp
US 8.8.8.8:53 www.paypal.com udp
US 8.8.8.8:53 store.cloudflare.steamstatic.com udp
US 104.18.42.105:443 store.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 store.cloudflare.steamstatic.com tcp
US 104.244.42.193:443 twitter.com tcp
US 104.244.42.193:443 twitter.com tcp
US 8.8.8.8:53 105.42.18.104.in-addr.arpa udp
US 8.8.8.8:53 193.42.244.104.in-addr.arpa udp
JP 23.207.106.113:443 steamcommunity.com tcp
JP 23.207.106.113:443 steamcommunity.com tcp
US 8.8.8.8:53 113.106.207.23.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 abs.twimg.com udp
US 8.8.8.8:53 watson.telemetry.microsoft.com udp
US 104.208.16.94:443 watson.telemetry.microsoft.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 8.8.8.8:53 141.21.199.152.in-addr.arpa udp
US 8.8.8.8:53 94.16.208.104.in-addr.arpa udp
US 104.208.16.94:443 watson.telemetry.microsoft.com tcp
US 8.8.8.8:53 killredls.pw udp
US 104.21.53.57:80 killredls.pw tcp
US 18.210.178.3:443 www.epicgames.com tcp
US 18.210.178.3:443 www.epicgames.com tcp
US 8.8.8.8:53 community.cloudflare.steamstatic.com udp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 community.cloudflare.steamstatic.com tcp
RU 5.42.92.51:19057 tcp
US 151.101.1.21:443 www.paypal.com tcp
US 151.101.1.21:443 www.paypal.com tcp
US 8.8.8.8:53 57.53.21.104.in-addr.arpa udp
US 8.8.8.8:53 3.178.210.18.in-addr.arpa udp
US 8.8.8.8:53 21.1.101.151.in-addr.arpa udp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 ocsp.r2m02.amazontrust.com udp
US 104.244.42.193:443 twitter.com tcp
US 104.244.42.193:443 twitter.com tcp
US 18.238.246.206:80 ocsp.r2m02.amazontrust.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 192.15.239.18.in-addr.arpa udp
US 8.8.8.8:53 80.41.65.18.in-addr.arpa udp
US 8.8.8.8:53 206.246.238.18.in-addr.arpa udp
US 8.8.8.8:53 206.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 www.paypalobjects.com udp
US 151.101.2.133:443 www.paypalobjects.com tcp
US 151.101.2.133:443 www.paypalobjects.com tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 static-assets-prod.unrealengine.com udp
US 18.239.36.22:443 static-assets-prod.unrealengine.com tcp
US 18.239.36.22:443 static-assets-prod.unrealengine.com tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 tracking.epicgames.com udp
US 44.214.245.214:443 tracking.epicgames.com tcp
US 44.214.245.214:443 tracking.epicgames.com tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 133.2.101.151.in-addr.arpa udp
US 8.8.8.8:53 22.36.239.18.in-addr.arpa udp
US 8.8.8.8:53 214.245.214.44.in-addr.arpa udp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 i.ytimg.com udp
NL 172.217.168.214:443 i.ytimg.com tcp
NL 172.217.168.214:443 i.ytimg.com tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 214.168.217.172.in-addr.arpa udp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 157.240.5.10:443 static.xx.fbcdn.net tcp
US 157.240.5.10:443 static.xx.fbcdn.net tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 t.paypal.com udp
US 151.101.1.35:443 t.paypal.com tcp
US 151.101.1.35:443 t.paypal.com tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 106.208.58.216.in-addr.arpa udp
US 8.8.8.8:53 35.1.101.151.in-addr.arpa udp
US 104.21.53.57:80 killredls.pw tcp
US 151.101.2.133:443 www.paypalobjects.com tcp
US 151.101.2.133:443 www.paypalobjects.com tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 c.paypal.com udp
US 151.101.1.21:443 c.paypal.com tcp
US 151.101.1.21:443 c.paypal.com tcp
US 18.239.36.22:443 static-assets-prod.unrealengine.com tcp
US 18.239.36.22:443 static-assets-prod.unrealengine.com tcp
US 192.55.233.1:443 tcp
US 192.55.233.1:443 tcp
US 8.8.8.8:53 131.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 www.recaptcha.net udp
NL 172.217.168.227:443 www.recaptcha.net tcp
NL 172.217.168.227:443 www.recaptcha.net tcp
US 8.8.8.8:53 227.168.217.172.in-addr.arpa udp
US 8.8.8.8:53 49.101.122.92.in-addr.arpa udp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 watson.telemetry.microsoft.com udp
US 13.89.179.12:443 watson.telemetry.microsoft.com tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 12.179.89.13.in-addr.arpa udp
US 104.21.53.57:80 killredls.pw tcp
US 13.89.179.12:443 watson.telemetry.microsoft.com tcp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 b.stats.paypal.com udp
US 64.4.245.84:443 b.stats.paypal.com tcp
US 64.4.245.84:443 b.stats.paypal.com tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 84.245.4.64.in-addr.arpa udp
US 104.21.53.57:80 killredls.pw tcp
US 104.21.53.57:80 killredls.pw tcp
US 192.55.233.1:443 tcp
US 192.55.233.1:443 tcp
US 104.21.53.57:80 killredls.pw tcp
US 8.8.8.8:53 dub.stats.paypal.com udp
US 64.4.245.84:443 dub.stats.paypal.com tcp
US 64.4.245.84:443 dub.stats.paypal.com tcp
US 8.8.8.8:53 c6.paypal.com udp
US 8.8.8.8:53 talon-website-prod.ecosec.on.epicgames.com udp
US 192.229.221.25:443 c6.paypal.com tcp
US 192.229.221.25:443 c6.paypal.com tcp
US 172.64.146.120:443 talon-website-prod.ecosec.on.epicgames.com tcp
US 172.64.146.120:443 talon-website-prod.ecosec.on.epicgames.com tcp
US 8.8.8.8:53 steamcommunity.com udp
US 8.8.8.8:53 25.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 120.146.64.172.in-addr.arpa udp
JP 23.207.106.113:443 steamcommunity.com tcp
JP 23.207.106.113:443 steamcommunity.com tcp
US 8.8.8.8:53 store.steampowered.com udp
NL 104.85.0.101:443 store.steampowered.com tcp
NL 104.85.0.101:443 store.steampowered.com tcp
RU 5.42.92.51:19057 tcp
US 8.8.8.8:53 161.19.199.152.in-addr.arpa udp
US 8.8.8.8:53 watson.telemetry.microsoft.com udp
US 52.168.117.173:443 watson.telemetry.microsoft.com tcp
US 52.168.117.173:443 watson.telemetry.microsoft.com tcp
US 8.8.8.8:53 173.117.168.52.in-addr.arpa udp
US 8.8.8.8:53 talon-service-prod.ecosec.on.epicgames.com udp
US 172.64.146.120:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 172.64.146.120:443 talon-service-prod.ecosec.on.epicgames.com tcp
RU 5.42.92.190:80 5.42.92.190 tcp
NL 194.169.175.118:80 194.169.175.118 tcp
US 8.8.8.8:53 190.92.42.5.in-addr.arpa udp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 118.175.169.194.in-addr.arpa udp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
US 8.8.8.8:53 api.steampowered.com udp
JP 23.207.106.113:443 api.steampowered.com tcp
JP 23.207.106.113:443 api.steampowered.com tcp
JP 23.207.106.113:443 api.steampowered.com tcp
JP 23.207.106.113:443 api.steampowered.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
US 8.8.8.8:53 js.hcaptcha.com udp
US 104.19.218.90:443 js.hcaptcha.com tcp
US 104.19.218.90:443 js.hcaptcha.com tcp
US 8.8.8.8:53 90.218.19.104.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
US 8.8.8.8:53 newassets.hcaptcha.com udp
US 104.19.218.90:443 newassets.hcaptcha.com tcp
US 104.19.218.90:443 newassets.hcaptcha.com tcp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 watson.telemetry.microsoft.com udp
US 52.168.117.173:443 watson.telemetry.microsoft.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
RU 5.42.92.51:19057 tcp
NL 172.217.168.214:443 i.ytimg.com tcp
NL 172.217.168.214:443 i.ytimg.com tcp
US 8.8.8.8:53 watson.telemetry.microsoft.com udp
US 20.42.73.29:443 watson.telemetry.microsoft.com tcp
US 8.8.8.8:53 29.73.42.20.in-addr.arpa udp
US 20.42.73.29:443 watson.telemetry.microsoft.com tcp
US 8.8.8.8:53 api.hcaptcha.com udp
US 104.19.219.90:443 api.hcaptcha.com tcp
US 104.19.219.90:443 api.hcaptcha.com tcp
US 8.8.8.8:53 90.219.19.104.in-addr.arpa udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
RU 5.42.92.190:80 5.42.92.190 tcp
IT 185.196.9.161:80 185.196.9.161 tcp
US 8.8.8.8:53 161.9.196.185.in-addr.arpa udp
RU 5.42.64.16:443 tcp
US 8.8.8.8:53 16.64.42.5.in-addr.arpa udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
RU 5.42.92.51:19057 tcp
US 8.8.8.8:53 watson.telemetry.microsoft.com udp
US 52.168.117.173:443 watson.telemetry.microsoft.com tcp
US 52.168.117.173:443 watson.telemetry.microsoft.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 172.217.168.214:443 i.ytimg.com tcp
NL 172.217.168.214:443 i.ytimg.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
US 8.8.8.8:53 watson.telemetry.microsoft.com udp
US 20.189.173.21:443 watson.telemetry.microsoft.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
US 8.8.8.8:53 21.173.189.20.in-addr.arpa udp
US 20.189.173.21:443 watson.telemetry.microsoft.com tcp
US 8.8.8.8:53 4.173.189.20.in-addr.arpa udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
RU 5.42.92.51:19057 tcp
US 8.8.8.8:53 watson.telemetry.microsoft.com udp
US 20.189.173.21:443 watson.telemetry.microsoft.com tcp
NL 172.217.168.214:443 i.ytimg.com tcp
NL 172.217.168.214:443 i.ytimg.com tcp
NL 157.240.247.35:443 www.facebook.com tcp
NL 157.240.247.35:443 www.facebook.com tcp
US 8.8.8.8:53 217.14.97.104.in-addr.arpa udp
US 8.8.8.8:53 watson.telemetry.microsoft.com udp
US 20.42.65.92:443 watson.telemetry.microsoft.com tcp
US 20.42.65.92:443 watson.telemetry.microsoft.com tcp
US 8.8.8.8:53 92.65.42.20.in-addr.arpa udp
RU 5.42.92.190:80 5.42.92.190 tcp
RU 5.42.64.16:443 tcp
US 8.8.8.8:53 watson.telemetry.microsoft.com udp
US 13.89.179.12:443 watson.telemetry.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nL0Fz87.exe

MD5 4d956945b58907c48923448f7a3f0d43
SHA1 419089ea09fa7da0645cab4ee5b72c6a1eccbf39
SHA256 39c057111d03bcc14a3ef49307d0efa3affd584f960a120b06fe3be16eb9f1c6
SHA512 c9af2639290966a62cc404028691d6df8d0b2e8a118571d9327236daab94f4440d3a8426cb5d5ac191721b4f6ab30dfe60dc5e7b8b85cb1aeecbaca0056c501d

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nL0Fz87.exe

MD5 4d956945b58907c48923448f7a3f0d43
SHA1 419089ea09fa7da0645cab4ee5b72c6a1eccbf39
SHA256 39c057111d03bcc14a3ef49307d0efa3affd584f960a120b06fe3be16eb9f1c6
SHA512 c9af2639290966a62cc404028691d6df8d0b2e8a118571d9327236daab94f4440d3a8426cb5d5ac191721b4f6ab30dfe60dc5e7b8b85cb1aeecbaca0056c501d

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Xg9Dk17.exe

MD5 0a2b681c25fa18704ab71b1f54cbcb9d
SHA1 ec3e9cde1ac14da8a164dfb08508e5d28940d2dc
SHA256 cf751b0fa311c5e886a38bb07a0c881d9af08574ed5214007190848ed7f90c00
SHA512 264c8fc86c0355b5c1d44487abe62c15cc295cc25dd86bd4552e8a874e5ded3967b314a056a43358d116ac36581044143709e302fabf7e002e4b95de42bd7ad0

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Xg9Dk17.exe

MD5 0a2b681c25fa18704ab71b1f54cbcb9d
SHA1 ec3e9cde1ac14da8a164dfb08508e5d28940d2dc
SHA256 cf751b0fa311c5e886a38bb07a0c881d9af08574ed5214007190848ed7f90c00
SHA512 264c8fc86c0355b5c1d44487abe62c15cc295cc25dd86bd4552e8a874e5ded3967b314a056a43358d116ac36581044143709e302fabf7e002e4b95de42bd7ad0

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bQ5MF76.exe

MD5 23982bb70cfc4c1368171bfb87470198
SHA1 f8f757765f0e9ebc0e5c4a8168bcd88cebf8b287
SHA256 1840188d477e186ec1fa826aa3bd4052b1e7e804dfec986560c78b49e0a3ae7d
SHA512 f7fdbe66677eea6cdcbd52a4280bf7ec0e1c1ce0a7f01fd3480af4a2f4ff458f2a4795a662ae2394b36022d733496cae24157161271e708b57dbd5c2f8230634

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bQ5MF76.exe

MD5 23982bb70cfc4c1368171bfb87470198
SHA1 f8f757765f0e9ebc0e5c4a8168bcd88cebf8b287
SHA256 1840188d477e186ec1fa826aa3bd4052b1e7e804dfec986560c78b49e0a3ae7d
SHA512 f7fdbe66677eea6cdcbd52a4280bf7ec0e1c1ce0a7f01fd3480af4a2f4ff458f2a4795a662ae2394b36022d733496cae24157161271e708b57dbd5c2f8230634

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe

MD5 68a7e426179e5d11154207bb8bdea400
SHA1 d4ecbe3e96c5f18674d1b57ce74e40187bc5c901
SHA256 4afa7110cdfab20651490c1e999e10882f7e7441abe42eec28202deb3bc6c9e9
SHA512 0afc7aa7c662ff3e1cf830fe68230e83a93fd4ad3dbed8d7f54ab0d701d5a94b2351bcb412173bcbee9c07ee002c70ae7b7d37fd0098f0cc44171ae482cbbf3e

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1PF21oh0.exe

MD5 68a7e426179e5d11154207bb8bdea400
SHA1 d4ecbe3e96c5f18674d1b57ce74e40187bc5c901
SHA256 4afa7110cdfab20651490c1e999e10882f7e7441abe42eec28202deb3bc6c9e9
SHA512 0afc7aa7c662ff3e1cf830fe68230e83a93fd4ad3dbed8d7f54ab0d701d5a94b2351bcb412173bcbee9c07ee002c70ae7b7d37fd0098f0cc44171ae482cbbf3e

memory/4012-28-0x000001BA5A120000-0x000001BA5A130000-memory.dmp

memory/4012-44-0x000001BA5A600000-0x000001BA5A610000-memory.dmp

memory/4012-63-0x000001BA5A2E0000-0x000001BA5A2E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2zn4693.exe

MD5 8d5ab27dfdaac2faa797b46f3dc98aa6
SHA1 62685ae96436ae82571b371973910c7e74212239
SHA256 833ce925b01c1b38998828715f2cf267e1c099b45a3b2a45b2cccea92e826d49
SHA512 98f6c5e4bd23e7fd17e3cca0fea98b22daef49ca2a0d98f0bc03e9052e6f1c2f80a754699ba0fb8b626bf259e44559a7a5eb148e455107ca4d27ede715a3d6a7

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2zn4693.exe

MD5 8d5ab27dfdaac2faa797b46f3dc98aa6
SHA1 62685ae96436ae82571b371973910c7e74212239
SHA256 833ce925b01c1b38998828715f2cf267e1c099b45a3b2a45b2cccea92e826d49
SHA512 98f6c5e4bd23e7fd17e3cca0fea98b22daef49ca2a0d98f0bc03e9052e6f1c2f80a754699ba0fb8b626bf259e44559a7a5eb148e455107ca4d27ede715a3d6a7

memory/4944-86-0x0000000000400000-0x0000000000433000-memory.dmp

memory/4944-92-0x0000000000400000-0x0000000000433000-memory.dmp

memory/4944-94-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7uj73DE.exe

MD5 b938034561ab089d7047093d46deea8f
SHA1 d778c32cc46be09b107fa47cf3505ba5b748853d
SHA256 260784b1afd8b819cb6ccb91f01090942375e527abdc060dd835992d88c04161
SHA512 4909585c112fba3575e07428679fd7add07453e11169f33922faca2012d8e8fa6dfb763d991c68d3b4bbc6e78b6f37d2380c502daada325d73c7fff6c647769b

memory/4944-98-0x0000000000400000-0x0000000000433000-memory.dmp

memory/5060-99-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7uj73DE.exe

MD5 b938034561ab089d7047093d46deea8f
SHA1 d778c32cc46be09b107fa47cf3505ba5b748853d
SHA256 260784b1afd8b819cb6ccb91f01090942375e527abdc060dd835992d88c04161
SHA512 4909585c112fba3575e07428679fd7add07453e11169f33922faca2012d8e8fa6dfb763d991c68d3b4bbc6e78b6f37d2380c502daada325d73c7fff6c647769b

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\ZE14USG1.cookie

MD5 b1038269c62182ce42c9a91bd1d6c162
SHA1 3360550a1c89c683a2b5ce0fb5a377b63b90eee2
SHA256 ed15971de739305c2c99e4a7cf6d7f78e87d1ed369a3edc7b6d6167392a5b913
SHA512 e42c70733118bd7b7cb782830423548c4ffd701d4eb4f61df57b7dd1dd248d3d2fc3788691d2076efba0736c836f1a33bd9ef9d377b56ecb32fa792cab1c2279

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC

MD5 df26803bd741cd8337ebbee4c99100c7
SHA1 0c773c5482f47ed25356739cfae0e0d1f1655d73
SHA256 fd20571a9005f781b6452d345b8ea3e90c9cc88156795a3521cc16fae542355e
SHA512 6648aa7a8c307467e3174b50928aa19aa133f42a87b6332ef02aad85fe1b48b848145daba50ef220eb075699268547eb7a731874cdb197d89cd229f4cc962886

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC

MD5 a424524e2c25f8817094d4ae03d85437
SHA1 be31638d0e15de09123fb51cd4deda7c6eed149d
SHA256 5831c023d04b693ee97a5ee8a48e7fbf26390f92e60a482288a3bf91dd4e7bd7
SHA512 9642e6a387dd08572512411d9f61340092aad46291eedbe883aee07dc1b8a514d2cd4e01ad3945d407f26fb2e68de0168236649a3dd4dd6b255db9539d6c5252

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 ac89a852c2aaa3d389b2d2dd312ad367
SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

MD5 225a7d84021e3246dc81fac0a89e8531
SHA1 402f69a2293178105002dc73b02630e404962097
SHA256 d2a805cf288596bcf6f38f64566d5ec03ad18badd0855a15d50f64f5911f4d5f
SHA512 5a08fbefe0fbff014afde01f9d93f83d16fc52a50a6dc38ae2cf79fd40db80518b5617c7f23a74cdaafccb104a0bc1dfd8748d34321b07f070cc7047f3b371d8

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 202c6d08618821679870b09397b327d4
SHA1 95825d16b996f7ecd314ac66d68a7e166eb79b1e
SHA256 6cf0733f28bcebd3e25d33cc117773633a70241665ef8774fa42201161091bb9
SHA512 2eec22005e9d9fd31374ee153b4adb3b47cdac1c08fae3a28b127fbcb2060b708392fa4e9326a80126c3633392dcd6f048d067787d6e2d792d08a3c745c01318

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 177e0bf55138549fdae3e62f8c6d5ef3
SHA1 19d78a29cc3266555f1f51a2fa3718c545d522ee
SHA256 7ea88f6e03fa7e7e072028ed16e6dcfbf6b73670af81320b641b646e9fb82247
SHA512 2c108d6b3e221399b4ebd8a4d49d48de4622e04c6a8fc1938abeb5e8ead7ca73f7b88f4daa520f39dd86e1adff30186d42605b32ae0371d1638dfaaa6b0c32b1

memory/4208-125-0x000001D2F9560000-0x000001D2F9580000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\0X0FD3ZC.cookie

MD5 25efe144966a2308bebf0d7d0f452b74
SHA1 d0376e5fc77304f190020e3198f0ab0f507d8dea
SHA256 98faa0824641806538a3dacbfe310515542a9f995f15588e3a9496aad3f37544
SHA512 5aff2b5375dd2c7c5406e7da621a95e63064bac02bdc97f5264e63205304061c888221ae275dd479fcfabaa3cbe08d8549e608c880a1883c81a8abd778ca9f32

memory/2840-241-0x0000000000DE0000-0x0000000000DF6000-memory.dmp

memory/5060-244-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\8LZ502ln.exe

MD5 6c48bad9513b4947a240db2a32d3063a
SHA1 a5b9b870ce2d3451572d88ff078f7527bd3a954a
SHA256 984ae46ad062442c543fcdb20b1a763001e7df08eb0ab24fc490cbf1ab4e54c8
SHA512 7ae5c7bce222cfeb9e0fae2524fd634fa323282811e97a61c6d1e9680d025e49b968e72ca8ce2a2ceca650fa73bc05b7cf578277944305ed5fae2322ef7d496f

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\8LZ502ln.exe

MD5 6c48bad9513b4947a240db2a32d3063a
SHA1 a5b9b870ce2d3451572d88ff078f7527bd3a954a
SHA256 984ae46ad062442c543fcdb20b1a763001e7df08eb0ab24fc490cbf1ab4e54c8
SHA512 7ae5c7bce222cfeb9e0fae2524fd634fa323282811e97a61c6d1e9680d025e49b968e72ca8ce2a2ceca650fa73bc05b7cf578277944305ed5fae2322ef7d496f

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

MD5 80144ac74f3b6f6d6a75269bdc5d5a60
SHA1 6707bb0c8a3e92d1fd4765e10781535433036196
SHA256 d746128fdb817742cb812c74fb8aa543191116feda6dfcfc59d74becf482a285
SHA512 c61d3847bdc0c4a4b8cd94b2d9a3a474b985b974776ca2ef4caf78e5fb82e4d4f65c477dec1cdf080f9d397f3d0dfe035adc267f9b4fe9b75c82e399f20bc6b3

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

MD5 c930a5334bdfaba68d849bde5c16bb6f
SHA1 cf56647bb55ecb93fb30be707d18227b31b5ae93
SHA256 fd057bd2c459b82e0ec7df55f8b1751a4c96d25ec44da7af2a71538be4e7a23c
SHA512 04817d4eb05b27123d1171e977b2277e9ae8b8233f5ec348912e9ebb4d5deee2cc13a1421f28077d555a037a095c75d0623f71964ffcb0d5400e464c8f760c5e

memory/6120-261-0x0000000000400000-0x000000000043C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\9uV1te5.exe

MD5 e5ee7dbfec6433859f0f737b2e2056e6
SHA1 6bfda79b666acf86014f9af8a9bbd9de9b126b1c
SHA256 e81216b5f783b3373dec0a91aa95afc427f7e77c1365e222064b1392abfda80b
SHA512 c8326c1f3732cc3babc649d84684e52d5ce998eb28d618db98de84a64af945ef0e96d47be95305ad9fd606e8336cc26b277b14f295ffa05501b56ab53c8a038b

memory/6120-268-0x0000000072360000-0x0000000072A4E000-memory.dmp

memory/6120-270-0x000000000C1E0000-0x000000000C6DE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\9uV1te5.exe

MD5 e5ee7dbfec6433859f0f737b2e2056e6
SHA1 6bfda79b666acf86014f9af8a9bbd9de9b126b1c
SHA256 e81216b5f783b3373dec0a91aa95afc427f7e77c1365e222064b1392abfda80b
SHA512 c8326c1f3732cc3babc649d84684e52d5ce998eb28d618db98de84a64af945ef0e96d47be95305ad9fd606e8336cc26b277b14f295ffa05501b56ab53c8a038b

memory/6120-272-0x000000000BD80000-0x000000000BE12000-memory.dmp

memory/6120-274-0x000000000BD50000-0x000000000BD5A000-memory.dmp

memory/6120-275-0x000000000CCF0000-0x000000000D2F6000-memory.dmp

memory/6120-276-0x000000000C0B0000-0x000000000C1BA000-memory.dmp

memory/6120-277-0x000000000BFA0000-0x000000000BFB2000-memory.dmp

memory/6120-278-0x000000000C000000-0x000000000C03E000-memory.dmp

memory/5416-279-0x0000000000400000-0x0000000000488000-memory.dmp

memory/6120-280-0x000000000C040000-0x000000000C08B000-memory.dmp

memory/5416-283-0x0000000000400000-0x0000000000488000-memory.dmp

memory/5416-284-0x0000000000400000-0x0000000000488000-memory.dmp

memory/5416-288-0x0000000000400000-0x0000000000488000-memory.dmp

memory/912-290-0x000002C3CCA00000-0x000002C3CCA02000-memory.dmp

memory/912-293-0x000002C3CCA30000-0x000002C3CCA32000-memory.dmp

memory/912-296-0x000002C3CCA60000-0x000002C3CCA62000-memory.dmp

memory/912-298-0x000002C3CCAB0000-0x000002C3CCAB2000-memory.dmp

memory/912-300-0x000002C3CCAD0000-0x000002C3CCAD2000-memory.dmp

memory/912-303-0x000002C3CCDA0000-0x000002C3CCDA2000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5 bbf0e29268ddfd99bde03e58039df96a
SHA1 3ba0542fed7734b1fcb484d73df8583d4c1cb11d
SHA256 ccb67510824670f69ce2ed17ba72455f2be26d053ab13b2d04e8c4bbc2a456a4
SHA512 4eac0c845359016b7045100c146d83b3c5e94ca7d319e4bcde9c19f880b89d33630aadbfbeb21c85295388826e046857aafba5b55fd22397537761586af0df35

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5 cd84e50b4aea19f594c1413ebef80c7f
SHA1 bb8c99dbca810476b997b66e9b97ca78a155ead1
SHA256 93a1ac8552f079a85f6e8f48f083a100026ee84977ab87207e69ee8f1fdb2a48
SHA512 5893dd644816ae52966f236ef0a2db8a2e9759ebe0883b39c5dac41a8b3eb956f73fe83085e7ed00f502b8c794b30bc9b6cb0da8bb9296934050174c381e0e45

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\49RCVIKK.cookie

MD5 5582a52d6ae4dfec6aaac81712a368cd
SHA1 c4a0d3bf798724c4dead6d1f3d7d6419736f6968
SHA256 e110baea1f29dc366fba7a0492e8647fa7fe09708a70daa4e1251287a592ffef
SHA512 310c3f81a3c1e743db7ca48e0b303f7f4ec0d9d17dbb2ade9a532cde2975bd696455d14d52120f2082603850d02572e74570492330908033c6ca3b8b73079f37

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\M0MQ25AP.cookie

MD5 39b73d43ad79b8124a98359a306b33fc
SHA1 6331c3a5bec482b363d617f5fddbe14734b802fd
SHA256 195548d482857190aded06836d3ad04eda4ad2e1ebc477c96a95156327ac605a
SHA512 9f70ec3b3f691b57b1bd97b2d2b7cc0785515e09db3e7c73fc11ebbd685a5978fe927e9474549312c65087f77137581859528b4c5721ed55674ea4943ecfceb8

memory/4680-374-0x000001D3714D0000-0x000001D3714F0000-memory.dmp

memory/4012-390-0x000001BA61390000-0x000001BA61391000-memory.dmp

memory/4012-392-0x000001BA613A0000-0x000001BA613A1000-memory.dmp

memory/1612-407-0x00000236BB020000-0x00000236BB022000-memory.dmp

memory/1612-417-0x00000236BB0D0000-0x00000236BB0D2000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\0FXXIVGZ\favicon[1].ico

MD5 630d203cdeba06df4c0e289c8c8094f6
SHA1 eee14e8a36b0512c12ba26c0516b4553618dea36
SHA256 bbce71345828a27c5572637dbe88a3dd1e065266066600c8a841985588bf2902
SHA512 09f4e204960f4717848bf970ac4305f10201115e45dd5fe0196a6346628f0011e7bc17d73ec946b68731a5e179108fd39958cecf41125f44094f63fe5f2aeb2c

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\DIW6N833.cookie

MD5 04acaab526c99b0147511ae6779001f3
SHA1 279dbcd15c04273ba63c427932e593673a7c5ab9
SHA256 bd95b1201565e9288a03a109e23c496cad4c5d096fb1fbefd0e482d2532a6067
SHA512 4d2eaf6a9560ef4f6b59ec971a3a34c74cd0e995fab902fbe97b8945c394f83d01f20b3a567b5077845b16571f6ccd6ca822f241c997df78ab354571ffa0b77e

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\JGNPM53S\www.epicgames[1].xml

MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\80TC1JSK\buttons[2].css

MD5 b91ff88510ff1d496714c07ea3f1ea20
SHA1 9c4b0ad541328d67a8cde137df3875d824891e41
SHA256 0be99fd30134de50d457729cebd0e08342777af747caf503108178cb4c375085
SHA512 e82438186bfc3e9ca690af8e099aafbfbc71c9310f9d1c8cb87ffa9e7f0f11f33982c63a2dac95c9b83fef1aaa59178b73212fc76e895d13a1ffbbe3c1adfa4c

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\8V7CGE0O\shared_global[1].css

MD5 cfe7fa6a2ad194f507186543399b1e39
SHA1 48668b5c4656127dbd62b8b16aa763029128a90c
SHA256 723131aba2cf0edd34a29d63af1d7b4ff515b9a3a3e164b2493026132dd37909
SHA512 5c85bb6404d5be1871b0b2e2d2c9053716354acd69c7acca73d8ce8bf8f21645ae11f788f78ef624444016cb722ecbd6213e771bda36717725f2b60f53688c6b

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\8V7CGE0O\shared_responsive[1].css

MD5 2ab2918d06c27cd874de4857d3558626
SHA1 363be3b96ec2d4430f6d578168c68286cb54b465
SHA256 4afb3e37bfdd549cc16ef5321faf3f0a3bf6e84c79fc4408bc6f157280636453
SHA512 3af59e0b16ef9d39c2f1c5ccdbd5c9ea35bd78571fde1b5bf01e51a675d5554e03225a2d7c04ed67e22569e9f43b16788105a0bf591ebba28ef917c961cc59e2

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\0FXXIVGZ\B8BxsscfVBr[1].ico

MD5 e508eca3eafcc1fc2d7f19bafb29e06b
SHA1 a62fc3c2a027870d99aedc241e7d5babba9a891f
SHA256 e6d1d77403cd9f14fd2377d07e84350cfe768e3353e402bf42ebdc8593a58c9a
SHA512 49e3f31fd73e52ba274db9c7d306cc188e09c3ae683827f420fbb17534d197a503460e7ec2f1af46065f8d0b33f37400659bfa2ae165e502f97a8150e184a38c

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\8V7CGE0O\tooltip[1].js

MD5 72938851e7c2ef7b63299eba0c6752cb
SHA1 b75196bd3a6f9f4dfc1bbf5e43e96874bcd9ce4e
SHA256 e2d4e0e1d3e162fdc815f16dfff9ae9b0a967949f0f3ae371f947d730a3f0661
SHA512 2bb6c03a1335ef9514d0d172a4284d82a29d1783a72306bdcb8af3185d5cd2ff16303355aa4b05086d2fa0b5b7c7159cfa67de4a6175095ff0e68adec2a56ac1

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\SNEP41VF\shared_global[1].js

MD5 f94199f679db999550a5771140bfad4b
SHA1 10e3647f07ef0b90e64e1863dd8e45976ba160c0
SHA256 26c013d87a0650ece1f28cdc42d7995ad1a57e5681e30c4fd1c3010d995b7548
SHA512 66aef2dda0d8b76b68fd4a90c0c8332d98fe6d23590954a20317b0129a39feb9cd3bd44e0c57e6b309227d912c6c07b399302a5e680615e05269769b7e750036

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\SNEP41VF\shared_responsive_adapter[1].js

MD5 a52bc800ab6e9df5a05a5153eea29ffb
SHA1 8661643fcbc7498dd7317d100ec62d1c1c6886ff
SHA256 57cfaf9b92c98541f769090cd0229a30013cea7cfafc18519ca654bfae29e14e
SHA512 1bcacd0ec7c3d633d6296fff3325802d6352805f0d2cf1eea39237424229ecffad6cb2aee4248e28b1eca02ff0646b58240851a246bbcf0aa1083830d5d9081e

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\EPTEM17M.cookie

MD5 e5b1eec05d710cd3f8f6487c5e885634
SHA1 df593e547c632aa91ac300c26716166fb641d238
SHA256 5d5245b804081b2e92c0cce4eaa6bc9f5dee9952c4e5cd9f503b388fbf2864ac
SHA512 ab9f9e4be0160cdd41f0fb4b906a11bf1f393d36a37366a5231d0d781f042e29185fc7da8699b877f8ec674c6954242386ab4941d0cd2bd3f21e1776f332295b

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\JGNPM53S\www.epicgames[1].xml

MD5 06222da91010404e6aca887a9b80e303
SHA1 029b285f539611bc5a39179db65940b2f345f35b
SHA256 273e633e36f3ef33d1464acf350241e095baf7c269708520d6cd821ebffb4d46
SHA512 cdf0dc3f8888798c1bd9ade87609785d03cbc1f0442687a5ac4bc03a95c9837057ca357fc52d9c4681a0367be2d93ae57b194c04042a725f4e59cf373b4ab010

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\UYKQRG1Q\pp_favicon_x[1].ico

MD5 e1528b5176081f0ed963ec8397bc8fd3
SHA1 ff60afd001e924511e9b6f12c57b6bf26821fc1e
SHA256 1690c4e20869c3763b7fc111e2f94035b0a7ee830311dd680ac91421daad3667
SHA512 acf71864e2844907752901eeeaf5c5648d9f6acf3b73a2fb91e580bee67a04ffe83bc2c984a9464732123bc43a3594007691653271ba94f95f7e1179f4146212

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\ZFRXUBKI.cookie

MD5 36824db7c5018a6d7dbeae39ba70b54b
SHA1 0d20c9723b21fefd0e14a6351729f8fc6f9a76fc
SHA256 e1554ad9c464628c06bbe19e77b632e97ccbf81df436dee70f7e7ec0d0203264
SHA512 0eb43ce9188dcde53547f2ebc5a657aa0069f89cf68d11ad97ba7540f57ac3435e75a2144b703732764785081017e201f773951cb60710fe269f3c6dc31d5e61

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\UFILYM62.cookie

MD5 54f5f50b8e8567be164043fa7d013650
SHA1 db353f77b559ffcf65a3d70a965209c2cccb75f7
SHA256 071913fa7a4737d5c7ef1a37b7958bebbc016c3ca9248cc7251688d4f6d84d0a
SHA512 e51ab0787277a8e1bf7ec8dd8095fb0ac813252cab693d8e7bc95bf9af32a3923ef499abdbd127589ce0e6d43b565ebb025ac2a4c232861b9b08235be4880f4d

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\NQP3FH5P\epic-favicon-96x96[1].png

MD5 c94a0e93b5daa0eec052b89000774086
SHA1 cb4acc8cfedd95353aa8defde0a82b100ab27f72
SHA256 3f51f3fb508f0d0361b722345974969576daef2c7d3db8f97c4ca8e1ff1a1775
SHA512 f676705e63f89d76520637b788f3bac96d177d1be7f9762aeb8d5d1554afd7666cbd6ef22ce08f581eb59bd383dd1971896231264bc3eaabf21135c967930240

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\6s59bvu\imagestore.dat

MD5 ef77e793463f09d4016f5b0ab09ea23b
SHA1 cd8e8fb970ddc2f0283dcb118cdcc174f07199fc
SHA256 910df8a7fe4c579942b3b813d16db2857e7ff09bdbab040909c53256cf887d19
SHA512 a7d950e6888d49b69619b268d04db0b60ce5b2d48e01c4b6f163f48e7a102bca24e035ad6ac6ae8dceb95bd0c86495795be8e0ccf4f538cda7e1a6c59972d058

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_57DB0353F73BFEAADC2A8A5ECA70ACE8

MD5 42543f480eb00f895387212a369b1075
SHA1 aa04603bbd708a4727befd7b8f354f23d5953f4a
SHA256 f0872218ff6e9878a0d0772d60c56638f7c5932a717598e239494f597561b95d
SHA512 197c197044c0446c0e7e21aeae8daad060ad24f2f879b6227e4b90449b73968a41cb7f724387c11345bf11758c5194dc6b6a889367873bc2c915f391c856744d

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_57DB0353F73BFEAADC2A8A5ECA70ACE8

MD5 263aaa5dd83f111bb0ac2d30aac30e50
SHA1 d99b60a5dd85beea1f5595b8f45791a1258af799
SHA256 90db36acabb4102c565dae5b885ccd3a0dab9eb0a529cf2a4f0df744a46368cb
SHA512 b4f7b9b0bc9432257d9bb7a8bc4afbf162531d485637ba04948574b2b9c3ccdb7435eaf6a1bfc1079e84abe755446292606aa5c36a93bc3b91b1a950ba6b8848

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\BK8J73GX.cookie

MD5 f2294170aef0c135931b57792dab8021
SHA1 e966570610484f486721c07feeb31573ad3afada
SHA256 787a48def8e23a976f39444548f546d296d1ab66e5f7ce2255c4e2c18907f589
SHA512 06f37a7ce4f29f3654dd385a430e8e827324d8264a8eef6dfda61a2cf2947662ef10e2e12d97f9e384518db9a29e51d35e7d9604c8b11f0c998ecf97693eb20e

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\KBKYY0U0.cookie

MD5 a0c055062d60ec7a77482c350b54f0c3
SHA1 5d0f579119bef5d602167eb54553fc30c7fab6d7
SHA256 d58b8cf1a853194ab52599c5bd21aeda876cd8e73b9b38849fd39360d31fcaff
SHA512 a553c4b138dfebff8ca31decc37a94c6b4460e6d06cab19ed1220a64c8858304db1174ced3607fada30442b785def3194c46c9119c745d6a9be86c87e802f59c

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\HNUVRD4R.cookie

MD5 57e2584e021ddb8403e2b5b10e60e4d1
SHA1 161328bae1464cb5e618f25d8edafd354701a8b1
SHA256 cf57ea22797a3c443eb16cf7289e2c9bafb324e64e7879cb4e668e6ffde704c5
SHA512 64344aeb88e12e5daf7b511721f92fb5c2c014f47683b043c927e48fac6e309fe5295f533456774708d68731d38f8f42b5f4fbbe63cd485236be032fbda80f22

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\JIAPNFAC.cookie

MD5 d51eef8fe69a77c0f1d1e3d3e3aed45e
SHA1 6bd082322f922817ab734333cff3d8d0dc05548c
SHA256 a7b83676a90f5172ec775ddc5fdbb059f7f4fd21b94181bfddec8ca2f5c697d6
SHA512 412f3934f9d1c8bbb348cc74ce0db2bb73f4eec3b928a708fd7d021c38c8906a6aabf93ce0bf6021fc7b86be8773fcd03b43e3c45bfcc28753f0a8389f6471ce

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\DIOFV5AJ.cookie

MD5 748eae6fc6eb874d827d9f495c0e0370
SHA1 574ce2176d4298bc6f6f093962d6ecbfec1e05e3
SHA256 0b125f7cb1fd5ed303a029d84783ce3efc0fe36a447b0f01ae6dc905cd129e8a
SHA512 2066b084134eadb751b062a8b0febd3867e8086fc787ceec73761fea4202e86b8510470299ef32d83f7ab5f8da8276fc42d50deea4621695c1c600c2771b6a9f

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\A1KIXIV7.cookie

MD5 dfa0e333a66fe1348ab186ebe3be99ea
SHA1 621f0593d541ff40055c297c37dbd0c33b27cee2
SHA256 6ba3ec073dacc5a7226577a319a3ad7f5bf4013efad3b8037661e0070659e09e
SHA512 d4234e7f3c28e693a32be73ceb48de3d038f3b8d9b0b5a524878dddde1d3ba4e5afbe26205734e66f9283cbc558fc8472332f8bfcf595215d887954af436df9e

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\0FXXIVGZ\favicon[2].ico

MD5 231913fdebabcbe65f4b0052372bde56
SHA1 553909d080e4f210b64dc73292f3a111d5a0781f
SHA256 9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad
SHA512 7b11b709968c5a52b9b60189fb534f5df56912417243820e9d1c00c97f4bd6d0835f2cdf574d0c36ecb32dbbf5fc397324df54f7fdf9e1b062b5dbda2c02e919

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\80TC1JSK\recaptcha__en[1].js

MD5 fbeedf13eeb71cbe02bc458db14b7539
SHA1 38ce3a321b003e0c89f8b2e00972caa26485a6e0
SHA256 09ed391c987b3b27df5080114e00377ff1a748793cb417a809b33f22d737fe55
SHA512 124b9f53a53ef596a54c6c04ab3be2b25d33d1ce915978ec03da8f9f294db91d41ee9091b722e462722f51f9d9455ce480e1a0cb57c2f3248c7a3a9e3b9dac58

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\SNEP41VF\chunk~9229560c0[1].css

MD5 19a9c503e4f9eabd0eafd6773ab082c0
SHA1 d9b0ca3905ab9a0f9ea976d32a00abb7935d9913
SHA256 7ba0cc7d66172829eef8ff773c1e9c6e2fde3cfd82d9a89e1a71751957e47b0a
SHA512 0145582e8eb3adb98ad2dbc0b8e7a29c1d0525f0fd515fcf82eda7b4ce2f7f7f6aa0e81912aa98927e6d420ed110eb497c287a0ad483f8af067332920d4bde83

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\OOWN79G4.cookie

MD5 89f86f1367dd717b42e27173d8d86e8c
SHA1 92b5600e6ba3b62871e37976f6eca02bfb8c3596
SHA256 c70c8eb2730ed20ca2ac98d3a3227c8649a3c763752c23c73c1996f21c3fc6ff
SHA512 f1c6ec6cbbd73060f2c2289cd7f07f502d57417beeb35402db22ffb991e55f72f7714925fa21fdaf5dcbb654c705860632c5537b8ea963527c181dcc739fc066

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\45O5AJ8D.cookie

MD5 71a5cdfc47e6b8e56ba06767354f45c1
SHA1 eb0c207597be8368c10f9dc69264ef46b13cf19e
SHA256 706fe3a485e019bec6a5a481833b50e191367d3dd55c12f7ba445831799953a0
SHA512 0d07afd617991e9b1a568c3f920c7aa10eeed491b18c3a0f3940a6936b5abaf8268ee81e14d9386ae73c91bfc3b7e817c11ee802643191f4f0c64ca950083768

C:\Users\Admin\AppData\Local\MicrosoftEdge\SharedCacheContainers\MicrosoftEdge_iecompat\IECompatData.xml

MD5 d4fc49dc14f63895d997fa4940f24378
SHA1 3efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256 853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512 cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

C:\Users\Admin\AppData\Local\Temp\CD7C.exe

MD5 557fef65be6a41dae25cc30e05cbbcf5
SHA1 1f2d15725911e8fb97556bde6ed98a883be559df
SHA256 c43ba1b96be77608af07fa060f47f99604610ea712bf71f19c2d32f70b35beb1
SHA512 e513106d493c6ca18ea5be85a8ab198f19d97edd8dd5b21fc4daafc7f27b647116efaf3366d686e158f79ad9011ca1013fac00620d366085cc04ada8ac8dc5a0

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\KEALQWRU.cookie

MD5 ede89da04f90521e46228d1eb66e38ad
SHA1 297cf73a2d2bd87bc119f04319be241d012ff16f
SHA256 08a57f136e32f8e7191b60008e39fd6a38e53cbf7c7a347a47100d5e2331a8b3
SHA512 76e4e8bf996b3c20418105921f44d68577d03350fec02a0dc5198cbb4093ea7cb916e237d2e096e3f07cb2bc8572193a6c634c9583788bb937d0a7c21906b675

C:\Users\Admin\AppData\Local\Temp\CD7C.exe

MD5 557fef65be6a41dae25cc30e05cbbcf5
SHA1 1f2d15725911e8fb97556bde6ed98a883be559df
SHA256 c43ba1b96be77608af07fa060f47f99604610ea712bf71f19c2d32f70b35beb1
SHA512 e513106d493c6ca18ea5be85a8ab198f19d97edd8dd5b21fc4daafc7f27b647116efaf3366d686e158f79ad9011ca1013fac00620d366085cc04ada8ac8dc5a0

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\2HEI2I2J.cookie

MD5 e4e5cad7d109f61e6f2700718e9ac0e6
SHA1 0e3e5cc6068de1fc5caf70f84c1c29724426faa4
SHA256 e47b7b23ef0273376e2de036b46ff2169da5235314737887fdcf171392ff151f
SHA512 038418bbebadc3dc433f3384649072eaa4358175a8ddebb1a0aba2b22daf4aa21fbfac4747f621e2780c3da6a0f5ed55bb948a94ae86116db43fdd1a2a837c06

memory/5876-2493-0x0000000000400000-0x000000000046F000-memory.dmp

memory/5876-2505-0x0000000072360000-0x0000000072A4E000-memory.dmp

\Users\Admin\AppData\Local\Temp\CD7C.exe

MD5 557fef65be6a41dae25cc30e05cbbcf5
SHA1 1f2d15725911e8fb97556bde6ed98a883be559df
SHA256 c43ba1b96be77608af07fa060f47f99604610ea712bf71f19c2d32f70b35beb1
SHA512 e513106d493c6ca18ea5be85a8ab198f19d97edd8dd5b21fc4daafc7f27b647116efaf3366d686e158f79ad9011ca1013fac00620d366085cc04ada8ac8dc5a0

\Users\Admin\AppData\Local\Temp\CD7C.exe

MD5 557fef65be6a41dae25cc30e05cbbcf5
SHA1 1f2d15725911e8fb97556bde6ed98a883be559df
SHA256 c43ba1b96be77608af07fa060f47f99604610ea712bf71f19c2d32f70b35beb1
SHA512 e513106d493c6ca18ea5be85a8ab198f19d97edd8dd5b21fc4daafc7f27b647116efaf3366d686e158f79ad9011ca1013fac00620d366085cc04ada8ac8dc5a0

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\JWRTL39S.cookie

MD5 d33240f1172f7eaa6b6b4df6a080eece
SHA1 58ea7b62cb59915c389baf9f8b471d06d2791d25
SHA256 9276e61cbbe31e5f67f65a5c51da1d8b2d55bc02a896f19b94b433576a26cb8d
SHA512 0aa1ae67902432ed7cdedb56877900f3cd66c28f1edc19bf1aa5d2a6854d98886e0d6fa82adc2b9cb955641842d11d510b9d343cfcef27240e273fe9bb7513e6

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\CS3SZODK\www.recaptcha[1].xml

MD5 67ba028bcbef449b0a03c672ffb7e02e
SHA1 261dc5727d563224697a4f0c323704eb9e29d069
SHA256 3f7eb471a3cb78a0e1504a92b6d395f75ee71684657f04843334876a0e06a775
SHA512 4ba3df2b3ba03628b9795ec959b87ad7383afa0524c2f9514c0dacaa03a482ed31783441288efe86082c2e5a24d15a63719a35f38b8047147f459ebc04c6c54b

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\Q3OXHYOM.cookie

MD5 480ea675420e32c13c3005f367ff7efe
SHA1 5b58110e7384bb1032ddd34cc6ceef6a99644c00
SHA256 a64a0a1e8b810bdeb376aa34576e852345beb8e249681f5a97c80e09f8a7c5e9
SHA512 53e7f175371ea1868db08c872de41ac83f6e26f4cf592bce62707ce7ca4123120965f2bbd11cc926cd73b17c15993c9a6ef5eb2a2f090b94d1222c871bda7bcf

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\LPADNC5R.cookie

MD5 1872e79d0846a8039cd7da8fab99eaf8
SHA1 5923ca03e695b34dbe11cb5017286fbe57614ec6
SHA256 3a9db37addee881e5929ef4ffed1edbf0b08f849ba0a0cbbf5a4e5d1b6474669
SHA512 810a32f01ef66e96aa13b0ce368012710816928218fe7331312f6e5393d4ef448fec777cbd2a0990be7b1a9bbfac07c51f3f00412be244801a18f56a2332e9d4

memory/6120-2753-0x0000000072360000-0x0000000072A4E000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_11314361DFE3E655E02EC2E7F9346EC1

MD5 ba3d7074866d3e720f90789bc60b02ab
SHA1 50276b2e72a411ac8587a7113657f1b3e7a02bef
SHA256 e353e197b88e44c0841a510d8239058a357d6d35a14f3ead7e7a5f189e9cb4fc
SHA512 bd0c6816dc2d0de098604cc7873715ff856149f47583098e9d081b2d02a219047579f4249bc99b0ab403b4b61217497e0402600ea737c50366c6b434dbfbeebd

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_11314361DFE3E655E02EC2E7F9346EC1

MD5 1654a084e151f728e0b88fb30183a8b1
SHA1 a4f186116c92d3379b0458b1b2e122f8d402f2de
SHA256 9941c30b86702be5bbe17bad52d4a92e399ca3c72c4bbf86ce93d20a96b585ea
SHA512 ff919a34135d886832f964c6c8586439dce68013922160dba6dbfe241f30978c448a4a6e2c5ffcbfa8c53b127bf452d142bb969c3783c0413bf05bfc1ad56f4e

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\2AFZV8EX.cookie

MD5 bd10ce8cc1d04ca896981f474a1686be
SHA1 d03b61534aac59b9c8dad3923efa3c82e8639f09
SHA256 afbac195c55c41ce4115ec07e2753dc75a5239a05f7b4a6c07716ee9767a1b33
SHA512 6ac45efb0d264fcfd373a86888615e5b3a7d573357474f8ef37b142223ef79de2c1ca88a334259f36c3cf156e5698848542e36da78706aeb5905f5b7d139b730

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\80TC1JSK\web-animations-next-lite.min[1].js

MD5 cb9360b813c598bdde51e35d8e5081ea
SHA1 d2949a20b3e1bc3e113bd31ccac99a81d5fa353d
SHA256 e0cbfda7bfd7be1dcb66bbb507a74111fc4b2becbc742cd879751c3b4cbfa2f0
SHA512 a51e7374994b6c4adc116bc9dea60e174032f7759c0a4ff8eef0ce1a053054660d205c9bb05224ae67a64e2b232719ef82339a9cad44138b612006975578783c

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\SNEP41VF\webcomponents-ce-sd[1].js

MD5 58b49536b02d705342669f683877a1c7
SHA1 1dab2e925ab42232c343c2cd193125b5f9c142fa
SHA256 dea31a0a884a91f8f34710a646d832bc0edc9fc151ffd9811f89c47a3f4a6d7c
SHA512 c7a70bdefd02b89732e12605ad6322d651ffa554e959dc2c731d817f7bf3e6722b2c5d479eb84bd61b6ee174669440a5fa6ac4083a173b6cf5b30d14388483d4

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\SNEP41VF\intersection-observer.min[1].js

MD5 936a7c8159737df8dce532f9ea4d38b4
SHA1 8834ea22eff1bdfd35d2ef3f76d0e552e75e83c5
SHA256 3ea95af77e18116ed0e8b52bb2c0794d1259150671e02994ac2a8845bd1ad5b9
SHA512 54471260a278d5e740782524392249427366c56b288c302c73d643a24c96d99a487507fbe1c47e050a52144713dfeb64cd37bc6359f443ce5f8feb1a2856a70a

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QRTA9FON\scheduler[1].js

MD5 3403b0079dbb23f9aaad3b6a53b88c95
SHA1 dc8ca7a7c709359b272f4e999765ac4eddf633b3
SHA256 f48cc70897719cf69b692870f2a85e45ecf0601fd672afcd569495faa54f6e48
SHA512 1b7f23639fd56c602a4027f1dd53185e83e3b1fa575dc29310c0590dd196dc59864407495b8cc9df23430a0f2709403d0aa6ec6d234cce09f89c485add45b40e

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_26971925776788617818974D91697792

MD5 245818537103eff3e5f1a84f75a8019f
SHA1 39cfc2d90b5e931c4175c327d0c9cbe245e2844f
SHA256 f8957e9e46b77f054c797e590738c64eccad346821bd2f4b310a649c9f43b41a
SHA512 8d3b5525ee52051918e039d8c4775e3a38c7688f6dfff6e8dec1b19d743bfd79157ba77400c7166dfbaed359135a73c1c47de924790de6587619a8654bba6fe3

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_26971925776788617818974D91697792

MD5 695308f4bf7ce8a97ff889228e55dcec
SHA1 5b529c658d9e39201039a8d83a974717ac1ba64f
SHA256 10af4f722c6d79a857f6d4c8aa5c6cc60bf4ec9c8ca97c7f401cb8484eefaba4
SHA512 6f2b4bc44575303235303355e1189fbac7e7d90ecec74d3f2c5db8b57d6a871b50f2baefc8ca8d4db2ee3b23ff7c26a6c8927007d1d7e813bda6529f37698c88

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\80TC1JSK\www-i18n-constants[1].js

MD5 f3356b556175318cf67ab48f11f2421b
SHA1 ace644324f1ce43e3968401ecf7f6c02ce78f8b7
SHA256 263c24ac72cb26ab60b4b2911da2b45fef9b1fe69bbb7df59191bb4c1e9969cd
SHA512 a2e5b90b1944a9d8096ae767d73db0ec5f12691cf1aebd870ad8e55902ceb81b27a3c099d924c17d3d51f7dbc4c3dd71d1b63eb9d3048e37f71b2f323681b0ad

C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\8V7CGE0O\www-tampering[1].js

MD5 d0a5a9e10eb7c7538c4abf5b82fda158
SHA1 133efd3e7bb86cfb8fa08e6943c4e276e674e3a6
SHA256 a82008d261c47c8ca436773fe8d418c5e32f48fe25a30885656353461e84bbbc
SHA512 a50f80003b377dbc6a22ef6b1d6ad1843ef805d94bafb1fcab8e67c3781ae671027a89c06bf279f3fd81508e18257740165a4fea3b1a7082b38ec0dc3d122c2f

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QRTA9FON\hcaptcha[1].js

MD5 c2a59891981a9fd9c791bbff1344df52
SHA1 1bd69409a50107057b5340656d1ecd6f5726841f
SHA256 6beec8b04234097105f5d7a88af9c27552b27021446c9dbe029d908d1ff8599f
SHA512 f9d556e0f7e95e603881c5196cc2aa736eb24ed62086d09d36a9e1d6b4fec9f4c1dfb125a66bec301f57230a4242108c7c255e6aa3c6f08a3a0d75e0cf288afe

memory/3860-3079-0x0000000072360000-0x0000000072A4E000-memory.dmp

memory/3860-3081-0x0000000000650000-0x00000000012EA000-memory.dmp

memory/1732-3115-0x000001EB25820000-0x000001EB2590E000-memory.dmp

memory/1732-3120-0x00007FF9E1140000-0x00007FF9E1B2C000-memory.dmp

memory/1732-3124-0x000001EB3FE60000-0x000001EB3FE70000-memory.dmp

memory/1732-3128-0x000001EB3FD20000-0x000001EB3FE00000-memory.dmp

memory/1732-3132-0x000001EB3FEE0000-0x000001EB3FFC0000-memory.dmp

memory/1732-3139-0x000001EB3FFC0000-0x000001EB40088000-memory.dmp

memory/4312-3140-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

memory/1732-3143-0x000001EB40190000-0x000001EB40258000-memory.dmp

memory/3860-3148-0x0000000072360000-0x0000000072A4E000-memory.dmp

memory/1732-3150-0x000001EB3FE00000-0x000001EB3FE4C000-memory.dmp

memory/1168-3164-0x0000000000400000-0x00000000004AA000-memory.dmp

memory/1168-3172-0x00007FF9E1140000-0x00007FF9E1B2C000-memory.dmp

memory/1732-3170-0x00007FF9E1140000-0x00007FF9E1B2C000-memory.dmp

memory/1168-3171-0x000001FF5B180000-0x000001FF5B264000-memory.dmp

memory/1168-3174-0x000001FF42900000-0x000001FF42910000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\UYKQRG1Q\suggestions[1].en-US

MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

memory/5984-3306-0x0000000000B50000-0x0000000000B63000-memory.dmp

memory/5984-3309-0x0000000000900000-0x0000000000909000-memory.dmp

memory/5876-3313-0x0000000072360000-0x0000000072A4E000-memory.dmp

memory/4004-3315-0x0000000000400000-0x0000000000409000-memory.dmp

memory/5244-3324-0x0000000002A70000-0x0000000002E77000-memory.dmp

memory/5244-3329-0x0000000002E80000-0x000000000376B000-memory.dmp

memory/5244-3335-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4004-3406-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1168-3753-0x00007FF9E1140000-0x00007FF9E1B2C000-memory.dmp

memory/4312-3755-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

memory/2968-3764-0x00007FF9E1140000-0x00007FF9E1B2C000-memory.dmp

memory/2968-3767-0x0000023CF40B0000-0x0000023CF40C0000-memory.dmp

memory/2968-3770-0x0000023CF40B0000-0x0000023CF40C0000-memory.dmp

memory/2968-3785-0x0000023CF3B10000-0x0000023CF3B32000-memory.dmp

memory/2968-3820-0x0000023CF41C0000-0x0000023CF4236000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qmynw3iy.pxf.ps1

MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

memory/1168-3862-0x000001FF42900000-0x000001FF42910000-memory.dmp

memory/2968-3867-0x0000023CF40B0000-0x0000023CF40C0000-memory.dmp

memory/3480-3933-0x0000000004DE0000-0x0000000004E16000-memory.dmp

memory/3480-3938-0x0000000007460000-0x0000000007A88000-memory.dmp

memory/3480-3941-0x0000000072360000-0x0000000072A4E000-memory.dmp

memory/3480-3945-0x0000000004D90000-0x0000000004DA0000-memory.dmp

memory/3480-3943-0x0000000004D90000-0x0000000004DA0000-memory.dmp

memory/5244-3947-0x0000000002A70000-0x0000000002E77000-memory.dmp

memory/3480-3965-0x0000000007AE0000-0x0000000007B02000-memory.dmp

memory/5244-3969-0x0000000002E80000-0x000000000376B000-memory.dmp

memory/3480-3971-0x0000000007C10000-0x0000000007C76000-memory.dmp

memory/2968-3972-0x0000023CF40B0000-0x0000023CF40C0000-memory.dmp

memory/3480-3967-0x0000000007B80000-0x0000000007BE6000-memory.dmp

memory/3480-3975-0x0000000007C80000-0x0000000007FD0000-memory.dmp

memory/3480-4012-0x0000000008230000-0x000000000824C000-memory.dmp

memory/3480-4117-0x0000000008740000-0x000000000877C000-memory.dmp

memory/3480-4187-0x00000000093F0000-0x0000000009466000-memory.dmp

memory/3480-4272-0x000000000A1C0000-0x000000000A1F3000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFB2AF638CD349F64C.TMP

MD5 074d932621c0f604d6c76b76e758b220
SHA1 37a21e641d0be3297a40680de043162bf0fa8e2e
SHA256 39caa5327fa7dbec09a008bfebe4a2c30726eb85b7579784d9c71553bdd4c5e3
SHA512 d2db28da612a83e54cdedaef945b188ad56a76ebe9d219812c61d8a1e2ea4ebe1459d3391c68547681fc9dcff45a79734206ec5038b356e44e9ec434ce877bd9