Malware Analysis Report

2025-01-02 03:49

Sample ID 231212-1nw93scabm
Target 36dbf1695e0af12f007e71b9ab81863abbdc26794f25c96207f90527d2df596f
SHA256 36dbf1695e0af12f007e71b9ab81863abbdc26794f25c96207f90527d2df596f
Tags
privateloader risepro smokeloader backdoor paypal loader persistence phishing stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

36dbf1695e0af12f007e71b9ab81863abbdc26794f25c96207f90527d2df596f

Threat Level: Known bad

The file 36dbf1695e0af12f007e71b9ab81863abbdc26794f25c96207f90527d2df596f was found to be: Known bad.

Malicious Activity Summary

privateloader risepro smokeloader backdoor paypal loader persistence phishing stealer trojan

RisePro

PrivateLoader

SmokeLoader

Downloads MZ/PE file

Executes dropped EXE

Adds Run key to start application

Detected potential entity reuse from brand paypal.

AutoIT Executable

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Suspicious use of UnmapMainImage

Suspicious behavior: MapViewOfSection

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Checks SCSI registry key(s)

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-12 21:48

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-12 21:48

Reported

2023-12-12 21:51

Platform

win10v2004-20231127-en

Max time kernel

152s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\36dbf1695e0af12f007e71b9ab81863abbdc26794f25c96207f90527d2df596f.exe"

Signatures

PrivateLoader

loader privateloader

RisePro

stealer risepro

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\36dbf1695e0af12f007e71b9ab81863abbdc26794f25c96207f90527d2df596f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KE8Ea47.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Detected potential entity reuse from brand paypal.

phishing paypal

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1940 set thread context of 4484 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ks51Yk2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4cc421Yo.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4cc421Yo.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4cc421Yo.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4cc421Yo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4cc421Yo.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4cc421Yo.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ks51Yk2.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1724 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\36dbf1695e0af12f007e71b9ab81863abbdc26794f25c96207f90527d2df596f.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KE8Ea47.exe
PID 1724 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\36dbf1695e0af12f007e71b9ab81863abbdc26794f25c96207f90527d2df596f.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KE8Ea47.exe
PID 1724 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\36dbf1695e0af12f007e71b9ab81863abbdc26794f25c96207f90527d2df596f.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KE8Ea47.exe
PID 944 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KE8Ea47.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ks51Yk2.exe
PID 944 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KE8Ea47.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ks51Yk2.exe
PID 944 wrote to memory of 1940 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KE8Ea47.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ks51Yk2.exe
PID 1940 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ks51Yk2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1940 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ks51Yk2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1940 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ks51Yk2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1940 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ks51Yk2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1940 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ks51Yk2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1940 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ks51Yk2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1940 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ks51Yk2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1940 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ks51Yk2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1940 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ks51Yk2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1940 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ks51Yk2.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 944 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KE8Ea47.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4cc421Yo.exe
PID 944 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KE8Ea47.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4cc421Yo.exe
PID 944 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KE8Ea47.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4cc421Yo.exe
PID 1724 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\36dbf1695e0af12f007e71b9ab81863abbdc26794f25c96207f90527d2df596f.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe
PID 1724 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\36dbf1695e0af12f007e71b9ab81863abbdc26794f25c96207f90527d2df596f.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe
PID 1724 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\36dbf1695e0af12f007e71b9ab81863abbdc26794f25c96207f90527d2df596f.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe
PID 4956 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4956 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4956 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4956 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1000 wrote to memory of 1364 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1000 wrote to memory of 1364 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4956 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4956 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3820 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3820 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1096 wrote to memory of 1060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1096 wrote to memory of 1060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4956 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4956 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2896 wrote to memory of 3692 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2896 wrote to memory of 3692 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4956 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4956 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 3156 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 3156 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4956 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4956 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3044 wrote to memory of 1952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3044 wrote to memory of 1952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4956 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4956 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 892 wrote to memory of 3064 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 892 wrote to memory of 3064 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4956 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4956 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3396 wrote to memory of 4668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3396 wrote to memory of 4668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4956 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4956 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 424 wrote to memory of 5192 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 424 wrote to memory of 5192 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 5680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 5680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 5680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 5680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 5680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4232 wrote to memory of 5680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\36dbf1695e0af12f007e71b9ab81863abbdc26794f25c96207f90527d2df596f.exe

"C:\Users\Admin\AppData\Local\Temp\36dbf1695e0af12f007e71b9ab81863abbdc26794f25c96207f90527d2df596f.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KE8Ea47.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KE8Ea47.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ks51Yk2.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ks51Yk2.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4484 -ip 4484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 604

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4cc421Yo.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4cc421Yo.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffe083646f8,0x7ffe08364708,0x7ffe08364718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffe083646f8,0x7ffe08364708,0x7ffe08364718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffe083646f8,0x7ffe08364708,0x7ffe08364718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffe083646f8,0x7ffe08364708,0x7ffe08364718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffe083646f8,0x7ffe08364708,0x7ffe08364718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffe083646f8,0x7ffe08364708,0x7ffe08364718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffe083646f8,0x7ffe08364708,0x7ffe08364718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffe083646f8,0x7ffe08364708,0x7ffe08364718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffe083646f8,0x7ffe08364708,0x7ffe08364718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,10085528573088409744,15478738842403529604,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,12854733625288401075,17243034596493465368,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,7590227103378992448,12879093418481023140,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffe083646f8,0x7ffe08364708,0x7ffe08364718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,6009719073938388855,4135798161371407574,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,7590227103378992448,12879093418481023140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,16527024465745729591,14206678039020260108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,12854733625288401075,17243034596493465368,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,189879532112300810,13935181752632804082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,6009719073938388855,4135798161371407574,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,189879532112300810,13935181752632804082,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,14406585025970907123,15388482679087991071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,14406585025970907123,15388482679087991071,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,12854733625288401075,17243034596493465368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,12854733625288401075,17243034596493465368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16527024465745729591,14206678039020260108,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,12854733625288401075,17243034596493465368,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,10085528573088409744,15478738842403529604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,12854733625288401075,17243034596493465368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,7145879273026416742,854768678932982612,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,12854733625288401075,17243034596493465368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,12854733625288401075,17243034596493465368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,12854733625288401075,17243034596493465368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,12854733625288401075,17243034596493465368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,12854733625288401075,17243034596493465368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,12854733625288401075,17243034596493465368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,12854733625288401075,17243034596493465368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,12854733625288401075,17243034596493465368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,12854733625288401075,17243034596493465368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,12854733625288401075,17243034596493465368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,12854733625288401075,17243034596493465368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,12854733625288401075,17243034596493465368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,12854733625288401075,17243034596493465368,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7184 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,12854733625288401075,17243034596493465368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7224 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,12854733625288401075,17243034596493465368,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7740 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,12854733625288401075,17243034596493465368,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7740 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,12854733625288401075,17243034596493465368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7764 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,12854733625288401075,17243034596493465368,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2232,12854733625288401075,17243034596493465368,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6992 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,12854733625288401075,17243034596493465368,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7992 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 84.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 204.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
RU 77.91.124.172:3350 77.91.124.172 tcp
US 8.8.8.8:53 172.124.91.77.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 store.steampowered.com udp
US 92.123.241.50:443 store.steampowered.com tcp
US 8.8.8.8:53 twitter.com udp
US 8.8.8.8:53 accounts.google.com udp
US 104.244.42.193:443 twitter.com tcp
US 8.8.8.8:53 steamcommunity.com udp
BE 64.233.166.84:443 accounts.google.com tcp
GB 104.103.202.103:443 steamcommunity.com tcp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 www.youtube.com udp
IE 163.70.151.35:443 www.facebook.com tcp
US 8.8.8.8:53 50.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 193.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 84.166.233.64.in-addr.arpa udp
US 8.8.8.8:53 103.202.103.104.in-addr.arpa udp
US 8.8.8.8:53 www.epicgames.com udp
GB 142.250.180.14:443 www.youtube.com tcp
US 52.70.73.124:443 www.epicgames.com tcp
US 8.8.8.8:53 www.paypal.com udp
US 151.101.1.21:443 www.paypal.com tcp
US 8.8.8.8:53 35.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 14.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 124.73.70.52.in-addr.arpa udp
US 8.8.8.8:53 21.1.101.151.in-addr.arpa udp
BE 64.233.166.84:443 accounts.google.com udp
US 8.8.8.8:53 www.paypalobjects.com udp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 8.8.8.8:53 36.171.66.18.in-addr.arpa udp
US 8.8.8.8:53 25.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp
US 192.229.221.25:443 www.paypalobjects.com tcp
GB 142.250.180.14:443 www.youtube.com udp
US 8.8.8.8:53 i.ytimg.com udp
GB 142.250.200.22:443 i.ytimg.com tcp
US 8.8.8.8:53 22.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 c.paypal.com udp
US 192.55.233.1:443 tcp
US 8.8.8.8:53 b.stats.paypal.com udp
US 64.4.245.84:443 b.stats.paypal.com tcp
US 192.55.233.1:443 tcp
US 8.8.8.8:53 t.paypal.com udp
US 151.101.1.35:443 t.paypal.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 42.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 84.245.4.64.in-addr.arpa udp
US 8.8.8.8:53 35.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 www.recaptcha.net udp
US 8.8.8.8:53 dub.stats.paypal.com udp
GB 142.250.200.3:443 www.recaptcha.net tcp
US 64.4.245.84:443 dub.stats.paypal.com tcp
US 8.8.8.8:53 c6.paypal.com udp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 151.101.1.35:443 c6.paypal.com tcp
US 8.8.8.8:53 abs.twimg.com udp
US 8.8.8.8:53 api.twitter.com udp
US 8.8.8.8:53 api.x.com udp
US 152.199.21.141:443 abs.twimg.com tcp
US 104.244.42.194:443 api.twitter.com tcp
US 104.18.37.14:443 api.x.com tcp
US 8.8.8.8:53 pbs.twimg.com udp
US 8.8.8.8:53 t.co udp
US 8.8.8.8:53 video.twimg.com udp
GB 199.232.56.159:443 pbs.twimg.com tcp
US 104.244.42.133:443 t.co tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 192.229.220.133:443 video.twimg.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 8.8.8.8:53 141.21.199.152.in-addr.arpa udp
US 8.8.8.8:53 194.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 14.37.18.104.in-addr.arpa udp
US 8.8.8.8:53 159.56.232.199.in-addr.arpa udp
US 8.8.8.8:53 133.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 133.220.229.192.in-addr.arpa udp
US 8.8.8.8:53 tracking.epicgames.com udp
US 52.203.233.59:443 tracking.epicgames.com tcp
US 8.8.8.8:53 59.233.203.52.in-addr.arpa udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
GB 142.250.200.3:443 www.recaptcha.net udp
US 8.8.8.8:53 23.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 static-assets-prod.unrealengine.com udp
IE 13.224.68.106:443 static-assets-prod.unrealengine.com tcp
IE 13.224.68.106:443 static-assets-prod.unrealengine.com tcp
US 8.8.8.8:53 community.akamai.steamstatic.com udp
GB 104.77.160.221:443 community.akamai.steamstatic.com tcp
GB 104.77.160.221:443 community.akamai.steamstatic.com tcp
GB 104.77.160.221:443 community.akamai.steamstatic.com tcp
US 8.8.8.8:53 apps.identrust.com udp
GB 96.17.179.205:80 apps.identrust.com tcp
US 8.8.8.8:53 106.68.224.13.in-addr.arpa udp
US 8.8.8.8:53 221.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 205.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 store.akamai.steamstatic.com udp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
US 8.8.8.8:53 200.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 facebook.com udp
IE 163.70.147.35:443 facebook.com tcp
US 8.8.8.8:53 fbcdn.net udp
IE 163.70.147.35:443 fbcdn.net tcp
US 8.8.8.8:53 35.147.70.163.in-addr.arpa udp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
RU 81.19.131.34:80 tcp
US 8.8.8.8:53 www.google.com udp
FR 216.58.204.68:443 www.google.com tcp
GB 142.250.200.3:443 www.recaptcha.net udp
US 8.8.8.8:53 68.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 193.178.17.96.in-addr.arpa udp
GB 104.77.160.221:443 community.akamai.steamstatic.com tcp
GB 104.77.160.221:443 community.akamai.steamstatic.com tcp
GB 104.77.160.221:443 community.akamai.steamstatic.com tcp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
US 8.8.8.8:53 login.steampowered.com udp
GB 104.84.79.63:443 login.steampowered.com tcp
US 8.8.8.8:53 63.79.84.104.in-addr.arpa udp
RU 81.19.131.34:80 tcp
US 8.8.8.8:53 sentry.io udp
US 35.186.247.156:443 sentry.io tcp
US 8.8.8.8:53 156.247.186.35.in-addr.arpa udp
US 8.8.8.8:53 api.steampowered.com udp
GB 104.84.79.63:443 api.steampowered.com tcp
US 8.8.8.8:53 play.google.com udp
GB 142.250.179.238:443 play.google.com tcp
GB 142.250.179.238:443 play.google.com udp
FR 216.58.204.68:443 www.google.com udp
US 8.8.8.8:53 238.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
IE 13.224.68.106:443 static-assets-prod.unrealengine.com tcp
US 8.8.8.8:53 talon-website-prod.ecosec.on.epicgames.com udp
US 104.18.41.136:443 talon-website-prod.ecosec.on.epicgames.com tcp
US 35.186.247.156:443 sentry.io udp
US 104.244.42.194:443 api.twitter.com tcp
US 104.244.42.194:443 api.twitter.com tcp
US 8.8.8.8:53 136.41.18.104.in-addr.arpa udp
BE 64.233.166.84:443 accounts.google.com udp
US 8.8.8.8:53 talon-service-prod.ecosec.on.epicgames.com udp
US 104.18.41.136:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 104.18.41.136:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 104.18.41.136:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 8.8.8.8:53 js.hcaptcha.com udp
US 104.19.219.90:443 js.hcaptcha.com tcp
US 8.8.8.8:53 90.219.19.104.in-addr.arpa udp
US 8.8.8.8:53 newassets.hcaptcha.com udp
US 8.8.8.8:53 rr5---sn-q4fl6nz6.googlevideo.com udp
US 173.194.57.42:443 rr5---sn-q4fl6nz6.googlevideo.com tcp
US 173.194.57.42:443 rr5---sn-q4fl6nz6.googlevideo.com tcp
US 173.194.57.42:443 rr5---sn-q4fl6nz6.googlevideo.com tcp
US 173.194.57.42:443 rr5---sn-q4fl6nz6.googlevideo.com tcp
US 8.8.8.8:53 42.57.194.173.in-addr.arpa udp
US 8.8.8.8:53 api.hcaptcha.com udp
US 173.194.57.42:443 rr5---sn-q4fl6nz6.googlevideo.com tcp
US 173.194.57.42:443 rr5---sn-q4fl6nz6.googlevideo.com tcp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 14.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 youtube.com udp
GB 142.250.178.14:443 youtube.com tcp
US 8.8.8.8:53 14.178.250.142.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KE8Ea47.exe

MD5 c83b4728b17b29eb54c5607e7a97a91e
SHA1 228d5d0e2447bf2f3a59e14b57cf1b26182aa4b4
SHA256 6cc0f0b91906a06ba672202b4316d38b8a987ea5855da45448d3c10141ceb666
SHA512 40fe3f7ec13069537a83e6c1f11c608e441c42029b7fd94eda58c79516e34f763eed93fd0f9ecc671673558eb8fbafa8853b4ccfc05c37b03b7a0599284125b8

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ks51Yk2.exe

MD5 8d3aef05a9641463b67927a6482501a3
SHA1 8e3c2861f04e9e8f5ff772240ea491e0dc564fcd
SHA256 1bc56a10353a19af7d27c7f5176a1ff7607c6c385f9f0150ce2f636c9a76e2e3
SHA512 f2ac747d7a65eceb696287508d8d5187357fe1a14bda215479cd3c7208a6b564536d8355005f87394e6452819ca02cd74e34dc77055e1369363d4b499cb11fab

memory/1940-14-0x0000000074280000-0x0000000074A30000-memory.dmp

memory/1940-15-0x0000000000A50000-0x000000000111E000-memory.dmp

memory/1940-16-0x0000000005FE0000-0x0000000006584000-memory.dmp

memory/1940-17-0x0000000005A30000-0x0000000005AC2000-memory.dmp

memory/1940-18-0x0000000005980000-0x0000000005990000-memory.dmp

memory/1940-19-0x0000000005BE0000-0x0000000005BEA000-memory.dmp

memory/1940-20-0x0000000006E60000-0x0000000006EC2000-memory.dmp

memory/4484-21-0x0000000000400000-0x000000000059E000-memory.dmp

memory/4484-22-0x0000000000400000-0x000000000059E000-memory.dmp

memory/4484-23-0x0000000000400000-0x000000000059E000-memory.dmp

memory/4484-25-0x0000000000400000-0x000000000059E000-memory.dmp

memory/1940-27-0x0000000074280000-0x0000000074A30000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4cc421Yo.exe

MD5 3e0c7890026a5e3675a6548fb0244664
SHA1 445b6a2cd1a796a8c49feccb50b76e568f9b5785
SHA256 92546c8c07bca81c3bfe00c399f04e6477900676da999f7e9d1a8a7134d0e3bd
SHA512 91060bf481d066b51a15b1b89a523e290712c6b94f6946df40772ceeb672f4385f73eb847ed286b30083387f0aa68f95c225cc0f96959b889d0d070df40224af

memory/2056-31-0x0000000000400000-0x000000000040B000-memory.dmp

memory/3408-32-0x0000000002730000-0x0000000002746000-memory.dmp

memory/2056-34-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7uH6zK22.exe

MD5 170db879382c61a998f194abe5ea50b9
SHA1 db66c9ef5442a08348138201ef0fc8f8580e4104
SHA256 fa0aa8e14d96bd995dbcba1d1981ef5d2beaf99cda5c0aae2a6d09c40137db15
SHA512 1fa3a876d1b1da8947d69cc9d71269b4b9b5fc92749940b198e3289493a5473dd32c7d79c911f49ae1b6727b2ef0bed3a8b4f54c82f6b383c9f8e67ab5093118

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 5990c020b2d5158c9e2f12f42d296465
SHA1 dcb52612d301824d3a7fdfd0ea20c3fcfbb7a1b4
SHA256 2f33956ce5a0bb01abb3c0fee9a321c8f8f7abcf1d7535800bf25f1dc44b1643
SHA512 9efb70c4922365967c5fa7e89967e21eede96979a149e027099da786cd8b198d4e81bb3bf2b39c8d65a8796c5d72ca79241e66fc69e2502fdec8a0c5f230412c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 208a234643c411e1b919e904ee20115e
SHA1 400b6e6860953f981bfe4716c345b797ed5b2b5b
SHA256 af80020ae43388bbd3db31c75aade369d489a30a933574dea19163e094d5f458
SHA512 2779b96325234c836cbb91820ee332ed56c15b534ec0c7770b322a5c03849ec3ee67b0ec7978e1fab563eeed1cea96f5155d7b942702555d9352ff6711a548d2

\??\pipe\LOCAL\crashpad_2896_JAZALSGAXZBKVLXW

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 b7df6e48b297cdb63d9b94a536748106
SHA1 eb891854323ece589df2d5f9f0a3c733b4ef4bd2
SHA256 d5737b08ddb5ce39490b29a59d9ef3e99699e7dc756e3ee5d872f8f859b372f6
SHA512 5c2f53b3dac4ca5170c0f7cc68f0dca98df9c599a9f6b51f5cf52b9595bf5421d0817e52c6832a6a1758da602f4d5c48c3e7fcf1ad57303cf57b1492f5b1e656

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c86c9617-4732-439f-8236-e6705d87fee7.tmp

MD5 8cf4ddc796f6a44ba64b1fc289982954
SHA1 9474fc2161744cef9667ad940f3ceaa8141fc5d3
SHA256 a31018517628c37ea78a6b2c55de17531574e35182686f7d43985309e6c517e4
SHA512 08954058d6168cfbb6c604aa4edc622579365219dd6106a8f38b6aebd32768b196f98590bb05c8dd5c7158492d3a41cd2ba7d13bde88e59257dead43836f03e9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6c378e0f19f4cef28a3344bef18177f9
SHA1 ad1dac32a7583fbd9ecf199493e9a3a871fb198d
SHA256 78740fc3604732f582e540638e2d7a5940171d423a7a1450ccaecf4c553228d6
SHA512 2b03b6f2115406b42a0e2cf524194fd48ddb094173ddd74acdc89513d2c83a7495e1b6c4ac62aa67ade07fb4615ce9c47c4bd4a2e620eab9bffd682110fab4fe

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 193f7872d9ed3473f2d24411ec0fbbcf
SHA1 2b218618829bbcfcd9f434a3d1e825381261031d
SHA256 839621534bc49f88ca9c4b259392b32504dfff27b1b844190247da6d2e4fc912
SHA512 5c278320db030bde404787eff44fc875b0a06f2e9b0a6d9d2564d3ea218df64033ea05001bb320aea78bf98bf5a37ddb2c404f291665eb0190664f39e3884dbd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4e46284a-5ad3-405c-b61b-36a3af72e53a.tmp

MD5 4b9be13b2ea23a95de46c9a2f52c583f
SHA1 59b82ddb171172c313bf6ab8602f5e68c6b14785
SHA256 0e4de198b44c4d6842782a735d44b09ed1356dff8f6bd58fa2a1cc5c3c1219df
SHA512 9c822592feb2ebf644d0837fa6d16900d20182f1df6ac491f39ab0a296b692293a0a76728f88fab229f8d551cbeae1c1b72d2b40223c4dcf6e4e629d619ce61c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 b31de9cafdc30780d1107dbdb54f1ea2
SHA1 db93115cd0f942bf89aac0b5715c25618a205394
SHA256 5470b9da63416e346bc3b9da0484d6261fce6dca072783e463853dc1cb8b4c0a
SHA512 a4b3381732ca46bbfc3cb0a52caeb8ec99f177b0b83d217876bb1df8c081e5d4ec91801a5b7014dba6a111b963dd59727d5da808eab05fb794b62b2ef5a4713a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 a5886e6eacd2f484e4db5d612de3b7b2
SHA1 fcb194c9d2461a046a9c69c6b0f803088d89602f
SHA256 76e5694c24497cc5cb61bd8add09b57ccff44ae32d76514cc8b8c2f04f2a700b
SHA512 736cd97d2f6a6ecc21891bba71cb3545492bb47c9b19178f4e9dc994de3a34cb1e9e79ccd1812c6eb75ad8f2c1bed89ff5d77f4b2e5845b039ab2b205d9ba5df

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 aa5435837800b28a20f2f385eb67f9a5
SHA1 dacfe062973ca1033b422e1c47507c0be942dc2a
SHA256 4d3fc396e3ff139d66ef9f50f4b4ad02ee0a7522946ea4f11485a185f5525363
SHA512 888dec6d7fe567548c14d03f6f0094fd3635e5b32e7df3c57585474a15ec05027cc2f131e23373b089af5503b4b7932e73219b1ef531185c4c3222a9af9a6d1d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 eb84e94330d902288e6a4f1431fb3b79
SHA1 dd40474e4a8ff316015b5f66537cf184490ac7d9
SHA256 a6d603893618868f3ecf5c7833b3065ab400dbd077233c32ed9715f05428fb57
SHA512 02a7b59a40635c0ec38f933cd5124f4cf27f72ef01572f35855064e1b3f8a6dcfd6f5a3f3d53afd7bcb70c99aeeb3753caa9f269a07b82230a1910bda55c65b9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 77e48ea6e47647dfb7284ee45ee38e04
SHA1 01fcf6f286bc60d153795e89225bb236c55d3874
SHA256 681daa4d31a035f93987057494b3593971d7b36d80575c49771eadf202e4d4ff
SHA512 e9afe2576967cdf14e041c360b2c346f648b90787b21601dddc49b84bca341978d86ae73541b0b9d25f1c53736bfda5f689342e15b0da774541b9ef94bb85539

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 5a6206a3489650bf4a9c3ce44a428126
SHA1 3137a909ef8b098687ec536c57caa1bacc77224b
SHA256 0a9e623c6df237c02a585539bffb8249de48949c6d074fe0aaf43063731a3e28
SHA512 980da83c3142bf08433ec1770a2ec5f5560daf3ee680466f89beae8290e921c0db677489daad055fbc1f196388f8bc4f60e050600381f860b06d330062440a78

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 67b70176442fa9f7c558370d282db46a
SHA1 c3f906db9fec9bdd29949cc676d0b89d996add4e
SHA256 0abbc1dcfc443926af7fa73b00d8866552d12e4f528cd5b6035690b938266618
SHA512 bc16a844207f2d50ba9ad760e030fe2b771c2591ac38e0f62c139fb582c6df94b698f07410318bfb5a99137d28a109313e7c7f528f4751cde03c85e5e09a007e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

MD5 b3ba9decc3bb52ed5cca8158e05928a9
SHA1 19d045a3fbccbf788a29a4dba443d9ccf5a12fb0
SHA256 8bd1b2afcbe2fa046b0937197f1b2f393ef821ff89331f99754b9006f0114df4
SHA512 86a86d370e96fa29c0c1d12991c2287936b400830869ff7b5abe4de6f32db2df782b626d724496cd6de27f8cbd32101ba34cbcd4c650ef11afa26bc048d68529

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

MD5 923a543cc619ea568f91b723d9fb1ef0
SHA1 6f4ade25559645c741d7327c6e16521e43d7e1f9
SHA256 bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd
SHA512 a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

MD5 7d75a9eb3b38b5dd04b8a7ce4f1b87cc
SHA1 68f598c84936c9720c5ffd6685294f5c94000dff
SHA256 6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7
SHA512 cf0488c34a1af36b1bb854dea2decfc8394f47831b1670cab3eed8291b61188484cc8ab0a726a524ecdd20b71d291bcccbc2ce999fd91662aca63d2d22ed0d9f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 889c9744eaa17bf5ab1b63da4dc01672
SHA1 2e11dbdf0a561906565fa867ef1b77016f91ff2f
SHA256 c4287c4e7f9c420463f89688b10f78906718267e9a6b071c795c2044bc285fb0
SHA512 36052415cb3bf93bbb995321815b740d641275e0b743c62ea6c33cfa102816a35558291a441bcd65f15bb40a9d30fb8f3a5cbe0dfa4df4ab14a8327779461312

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe590313.TMP

MD5 1f7a8c1c66b6d58f317b97d2e9adbdf1
SHA1 6ca46c8196cc560fec2b4fb5bd7575dd6798c8d3
SHA256 f1e1dd4ba58d0889d6f6fc6670bb80bdfac6e6920f3da277156b1e08cbe718c9
SHA512 54dd79f2ae6e8e8397583c50d2962e0ebc9627e9bafa8d3025eee6e25e619cb8f0906f5eb959e84daa39cf396b3ec0ed5c29aa71af4a25247365fe127d8f0ada

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

MD5 909324d9c20060e3e73a7b5ff1f19dd8
SHA1 feea7790740db1e87419c8f5920859ea0234b76b
SHA256 dfc749d2afefe484d9aa9f8f06d461ad104a0ca9b75b46abfaaddda64a5e9278
SHA512 b64d2dce1f9a185fbb8a32adc1ff402d8045d379600bf3f9154bbde18303610f18af9fce258442db1e621ecf10b77aafe99cffedfcbe2a1490056c50cc42d0f9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

MD5 d55250dc737ef207ba326220fff903d1
SHA1 cbdc4af13a2ca8219d5c0b13d2c091a4234347c6
SHA256 d3e913618a52fe57ab4320e62a5ace58a699d6bce8187164e198abe3279726fd
SHA512 13adff61e2cfa25dc535eba9d63209b7e7e9bd29fc4d6c868b057df7f680aa66ef5783a0e82a8367185debf7f6fe5bae89adc0770daff5317d2e16db5ad3ab39

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 9f7fcb4978e3b44ff7faece4742bc290
SHA1 5acc8e81ef7623449d12caff3bc8712f4455591a
SHA256 499b89960eeae66d9b0cb101a889a9a33470726486d3a7037e3f47b1b8b11c1e
SHA512 4d1bb82c7268ad233da9ec0e8d5bb3e469fac336327591772dfc0474cc13401746bf9866767de4c1bb2bdb087eba236c3633df0bbd01706a6566e74409d3f83e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 736f79d3db81b533854e129573255952
SHA1 55117d3a11673074f329ca990c09b5ce3a9206d3
SHA256 2202687b0851983b46d28e2b6fde45eb8ee580405881b519ed732b67422a1e4a
SHA512 efaf209d6149524ebc388f1628eded1bfe751ac1238cc93c21d60ca4892aa2bbd97eb6215a7ff194dcb1301d338952b439ebc27587d5aef9a002b59afd50b1a5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 873c22b7fd82a1695217baa915bd7278
SHA1 081e2e6f1d1599f94c200d3e4a756858a5eed978
SHA256 81719bb41227c72bc013ec512b032c69b2173ced60994242371d631b6d74054e
SHA512 fdd4ac3f2e8322975761123295d94e61ba98bf9373331f9c9d4cd40050bd61efe417d7db051687ba5ebbae6a5f6e11cbb56c81aac8a84a4b540381dc9bfcebe4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 4e0b6b06d52deaa066c082a6dc38b4aa
SHA1 f3dcf46399313907a69a0165b972546023110b3d
SHA256 8bc022e9312e1db0691dfdec2d5c26cad0d7591b442836793b0e8f0f336c7cf7
SHA512 91df01810499f6f6e6d717498ddea3351fc25ea46b40d23bf0110b13d4d32f83cf4c7028a7bed8eb9665d77bf572ebf511b8140fcd4f28938ed8f3e419a21b1c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

MD5 f5f70ca652246b9c62a17fe293742df7
SHA1 f991530f7cfa2753b7fd40565bd1942469ae4758
SHA256 18c4a2c9262ce9dfa593c1e0bc434a2584a3b656e16aae5d8bcef537f06d7e71
SHA512 e35f72f0aa0b800e0a199864a57dcae26b35d9cc583657bf3e188d547a5d7aeaae29244a08965d370cd9c86fc8b8268e007217ec40301df7699acdeda799c8d6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 8620952002ae63485983e603cd950e68
SHA1 9a2cde32561160f819bb8fe492ef8b280f2728b8
SHA256 dbf5be73ef5e20dd4cecd4fc001401c911f839d0521934e5b4d5daa93f144c1e
SHA512 558626d77e0135beeaf1077e1fbfece9e28997944facaebc5c701b5721f592e2f334e81d136f22f32ed9fb5df1fb7b1536ef87522529706b0f9609cc649e2b22

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 bf3bc57f87bcb73301b4052f727a8fd5
SHA1 5cbf02d0a317546b75320393d33460cbce400e42
SHA256 c52755a8875993f1b09e6d397e7e7fb1669516890c9aa50c42a1540ea6b89080
SHA512 50420e1e1c4d07fc3c4ef40ae841681305935bc2ec4add3e959d1b32b90ad59bb880fc2a91a777f1e5812bb143a9c2169486b202c59c6fe493d78fe58c1c4633

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 e458dc64ac0b3007546b574d284799b0
SHA1 3147b7101bf200290b71ca111980c53df8235af6
SHA256 c001c482ae93c51ec2163b12e3cc431659916fb79809970fd6d21b90ce6fd300
SHA512 1aaf9d49751aef6d4736f95b801e0e31ef335206ce5c8baab797a11fb596ade2984e01d154036381aa92aca229c229370bc0908ea7db39f39d2f3633f1421149

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 549f9a03643775e2e30a9bbd98652b41
SHA1 2d040ea4b9fd040e0b4e2bc5a02ee0e2eb6d93e2
SHA256 94162027e6bbf7f1b0f9acc069949227cd7cc3f99d758955d56f96c0caec541e
SHA512 f57c30a83192d228c9c3af7c986eb4ecefa584ff8d258edebb732031e5628aaf789059554d986f1a30949fdc3e788b724a649ec7475093e48ac4a190f013eda3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 401231dc026d33fe3a03c63e438f65e1
SHA1 13f89c4ec6fa9b42d99e79a90d408dae57ed73e5
SHA256 ce97e35742cc11a5a04508737b691486cbafb624a7f557b4818027c95cb9c98c
SHA512 7c64b845e8a7e6dd9fc8811642736fc063671073753cae27efe0389f54a639ecb3d5930f127e867c5b5fd79003a7f5b3efb6cba6a07d6d232b88874ae9cabeb2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 a3562a5eb76be6735870245da2f4ed35
SHA1 f04c9ce745198344037600f5ea45ade3df6c0843
SHA256 ca41946995a301b8dca0ff3fee2674f2f026e7dcb9f7eed2f6f5e4b1a2eaf29c
SHA512 31d463b93e3181ac752e08bc2d99e211e018ecd6f59b1c1f27453fd2911a1376009f6729e1d5a1b257555fc3ef6d0ad497aba9d2ec3598205aa8645cc6e09dc7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 a4707f54da0e32ce67c87e4652491240
SHA1 ff80bd7c07f74d1ebb335dbfe4c1ba2c64cd8db8
SHA256 395a851057035359c7c74649a33d315cdac6342fbfb3252f26bb1b1d1fa6520f
SHA512 f85d67620b1ba968073612027c7836bfa3cdae444046e5d4690d9d16c18a49a8d91ed8a1648c80a79fe4fc4275738f9f229cfb3a354e76660a2786808af62518

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 7ff94e5531401d6fb9b07388ca77b3b1
SHA1 9ca70b7b8f8363715420c405751eb24a62d52c6a
SHA256 24613c3399076d10e41b0ef198e08011106a8f5dd7f1f2e0f4026c398130adcb
SHA512 3b250f17b0e2fbe79f817108dc926619a17f6ee1140bec02fca3ebfcd73c8ba57e4ab8859a862a36cc032a46570410fbe95a43e3d5ff354b704165644e338049

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59e565.TMP

MD5 d3535ce1acf3c479f3c631715a6c1543
SHA1 e0314bab70983042a7453a4922bcb90da60c6222
SHA256 6660744f7c2fadfcc99fee900a17a89e42fe984f49d9c64fa55e024caa77e073
SHA512 cd76ac971212b9d2609c66d7dcc5df7bb034e98733a39805a9365a1c4682e95097ad2131f78a5f9da421b24d9cc8b63b5e9682f776da120c689661ef6f5819bf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 dae5919c6e832ba14ebe158881efd938
SHA1 f32bf4b9288db4cfab3882a98a39f9f3dade6e13
SHA256 3d30b3c0ce824c69fc3597dfd9b752280fac4666a64cea41437205af548f3c46
SHA512 730b3a8ad1780b0a15ce265dc5766f80bb75d8459987182036da45976ec08bd24def2fa7a6ee194cbd29d184b31e9f04265524e474c6a210ad46073e5a23bd2a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 d59dbfde329b3f58bbb632de9376fed0
SHA1 f573cee95eb17543131cb44e64b1c5aeac757395
SHA256 463cb013880f2a1b1f0955d8215ba099f876093998ecd719ef959570fc5b06e5
SHA512 802f91f003eb3a9fffb6bed2fdc34de69be4d92c614ca1e015b2ad3d1b71656d1805f2897276e9a7701c2e3ece7a397769830236ffe92a743932d2eace2ef721

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\2ff0e604-56d6-4349-83cb-591783c747ff\index-dir\the-real-index~RFe5a2a0f.TMP

MD5 8068713aeacdae1188ab5ab69a618168
SHA1 464d4a262a0f194b07c770018fde6d47813a5c29
SHA256 b2bf9db1f173ad9d9baea02d5b6d8c1d9a5d834b51c906c8cb242e796ec1096c
SHA512 3107069666ab2835ba7936b92b279f1aa81df6b1110c4f3e0ad9f691a0127a94a79d3ecd8e0c5fe1983681831bffb9983ff12e794f74ac3c7c315439b579f58d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\2ff0e604-56d6-4349-83cb-591783c747ff\index-dir\the-real-index

MD5 8594068c528c2ff7d29e7af672458f9d
SHA1 4ac09d783ad7d228b092b460316aa4fc93e2245e
SHA256 77178531f7311aebcf6749e54c07f1c07b21195000ce2151cb6449f2e3f3b349
SHA512 dfb1f22c476aeb66df6c598c3f3e15c0a0a1f84e35dc734149249c2353ebb68ab93a5c0332438551df2e614594d0a1cbd957e5a4c0adf91c8de0c617f947376e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

MD5 69d68cd536135e82c4ad5c050149d1eb
SHA1 8a79eee0d22ab5198e5d147fcfe0c5b454cd4699
SHA256 024e8475904182343c551e95839b92a02e03370d9c5e5fd6f9ea546c563c1a35
SHA512 6ab860ac59ec4c5e6debfa1269b6824dce4ab5e380f6075e062e74950c570c9017ff8a886125159fd7815808ec861b716bbf7975eab257be637d5813ab91dc89

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 f022ca370cfe3d12ee6fc30f509d5a34
SHA1 cdd4be00d7016ed79ed4af6bd7ad01e0c69c3a79
SHA256 b6c599ecfb822e2d7d4b5f0bfaceef796f6827c452cdd4a9865ed634eb7e4f5c
SHA512 2407dc2a8e6c0bebccb56a2669a418abd809d4d4a852b8b43ad11849367757c21a1494ebe4f3b8ae2c27e60ccd971e0db70ad01d9156cbbce77d63fd9b0e1533

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 2b2121a2aeb15d7d56fe13cd4c7d2e29
SHA1 90e780f48a80959b727e1ede5f302e139c68d5aa
SHA256 75677e8036bea14f3c6b164113defba10f89f005f075185df555665ab1484837
SHA512 b3ad99561006818074da6fae9bbb7816bdf0d0b26df4373f9cfb1c4bc03ae6a1cc2e19f061efe1825754fbaa8b92ead3d02cab08b93016f0c5e6cf197617d4a4