Malware Analysis Report

2025-01-02 03:51

Sample ID 231213-bltnqseadj
Target db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148
SHA256 db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148
Tags
djvu lumma privateloader risepro smokeloader up3 backdoor paypal discovery loader persistence phishing ransomware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148

Threat Level: Known bad

The file db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148 was found to be: Known bad.

Malicious Activity Summary

djvu lumma privateloader risepro smokeloader up3 backdoor paypal discovery loader persistence phishing ransomware stealer trojan

Djvu Ransomware

SmokeLoader

Lumma Stealer

Detected Djvu ransomware

PrivateLoader

Detect Lumma Stealer payload V4

RisePro

Downloads MZ/PE file

Checks computer location settings

Deletes itself

Executes dropped EXE

Modifies file permissions

Looks up external IP address via web service

Adds Run key to start application

Detected potential entity reuse from brand paypal.

Suspicious use of SetThreadContext

AutoIT Executable

Program crash

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: MapViewOfSection

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Uses Task Scheduler COM API

Suspicious use of FindShellTrayWindow

Suspicious use of UnmapMainImage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-13 01:14

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-13 01:14

Reported

2023-12-13 01:17

Platform

win10v2004-20231127-en

Max time kernel

151s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148.exe"

Signatures

Detect Lumma Stealer payload V4

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Lumma Stealer

stealer lumma

PrivateLoader

loader privateloader

RisePro

stealer risepro

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\D52F.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A N/A N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\E424.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU4AX32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3635043082-2972811465-3176142135-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\1adc1908-dfaa-4694-832f-9e381d5aa48d\\D52F.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\D52F.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detected potential entity reuse from brand paypal.

phishing paypal

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2592 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148.exe C:\Users\Admin\AppData\Local\Temp\db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148.exe
PID 2592 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148.exe C:\Users\Admin\AppData\Local\Temp\db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148.exe
PID 2592 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148.exe C:\Users\Admin\AppData\Local\Temp\db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148.exe
PID 2592 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148.exe C:\Users\Admin\AppData\Local\Temp\db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148.exe
PID 2592 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148.exe C:\Users\Admin\AppData\Local\Temp\db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148.exe
PID 2592 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148.exe C:\Users\Admin\AppData\Local\Temp\db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148.exe
PID 3340 wrote to memory of 4404 N/A N/A C:\Windows\system32\cmd.exe
PID 3340 wrote to memory of 4404 N/A N/A C:\Windows\system32\cmd.exe
PID 4404 wrote to memory of 2352 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 4404 wrote to memory of 2352 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3340 wrote to memory of 4756 N/A N/A C:\Windows\system32\cmd.exe
PID 3340 wrote to memory of 4756 N/A N/A C:\Windows\system32\cmd.exe
PID 4756 wrote to memory of 1348 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 4756 wrote to memory of 1348 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 3340 wrote to memory of 4552 N/A N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe
PID 3340 wrote to memory of 4552 N/A N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe
PID 3340 wrote to memory of 4552 N/A N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe
PID 4552 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe C:\Users\Admin\AppData\Local\Temp\D52F.exe
PID 4552 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe C:\Users\Admin\AppData\Local\Temp\D52F.exe
PID 4552 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe C:\Users\Admin\AppData\Local\Temp\D52F.exe
PID 4552 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe C:\Users\Admin\AppData\Local\Temp\D52F.exe
PID 4552 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe C:\Users\Admin\AppData\Local\Temp\D52F.exe
PID 4552 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe C:\Users\Admin\AppData\Local\Temp\D52F.exe
PID 4552 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe C:\Users\Admin\AppData\Local\Temp\D52F.exe
PID 4552 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe C:\Users\Admin\AppData\Local\Temp\D52F.exe
PID 4552 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe C:\Users\Admin\AppData\Local\Temp\D52F.exe
PID 4552 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe C:\Users\Admin\AppData\Local\Temp\D52F.exe
PID 3012 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe C:\Windows\SysWOW64\icacls.exe
PID 3012 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe C:\Windows\SysWOW64\icacls.exe
PID 3012 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe C:\Windows\SysWOW64\icacls.exe
PID 3012 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe C:\Users\Admin\AppData\Local\Temp\D52F.exe
PID 3012 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe C:\Users\Admin\AppData\Local\Temp\D52F.exe
PID 3012 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe C:\Users\Admin\AppData\Local\Temp\D52F.exe
PID 3340 wrote to memory of 656 N/A N/A C:\Users\Admin\AppData\Local\Temp\E424.exe
PID 3340 wrote to memory of 656 N/A N/A C:\Users\Admin\AppData\Local\Temp\E424.exe
PID 3340 wrote to memory of 656 N/A N/A C:\Users\Admin\AppData\Local\Temp\E424.exe
PID 656 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\E424.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU4AX32.exe
PID 656 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\E424.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU4AX32.exe
PID 656 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\E424.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU4AX32.exe
PID 3432 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe C:\Users\Admin\AppData\Local\Temp\D52F.exe
PID 3432 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe C:\Users\Admin\AppData\Local\Temp\D52F.exe
PID 3432 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe C:\Users\Admin\AppData\Local\Temp\D52F.exe
PID 3432 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe C:\Users\Admin\AppData\Local\Temp\D52F.exe
PID 3432 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe C:\Users\Admin\AppData\Local\Temp\D52F.exe
PID 3432 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe C:\Users\Admin\AppData\Local\Temp\D52F.exe
PID 3432 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe C:\Users\Admin\AppData\Local\Temp\D52F.exe
PID 3432 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe C:\Users\Admin\AppData\Local\Temp\D52F.exe
PID 3432 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe C:\Users\Admin\AppData\Local\Temp\D52F.exe
PID 3432 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\D52F.exe C:\Users\Admin\AppData\Local\Temp\D52F.exe
PID 2196 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU4AX32.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe
PID 2196 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU4AX32.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe
PID 2196 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU4AX32.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe
PID 3572 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3572 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1360 wrote to memory of 924 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1360 wrote to memory of 924 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5084 wrote to memory of 2328 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5084 wrote to memory of 2328 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4120 wrote to memory of 4300 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4120 wrote to memory of 4300 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148.exe

"C:\Users\Admin\AppData\Local\Temp\db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148.exe"

C:\Users\Admin\AppData\Local\Temp\db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148.exe

"C:\Users\Admin\AppData\Local\Temp\db5c93ed059bee3d21672050dacb2dd9c01c50f47075cf364ecc29a19ae4b148.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BFF0.bat" "

C:\Windows\system32\reg.exe

reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\C242.bat" "

C:\Windows\system32\reg.exe

reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1

C:\Users\Admin\AppData\Local\Temp\D52F.exe

C:\Users\Admin\AppData\Local\Temp\D52F.exe

C:\Users\Admin\AppData\Local\Temp\D52F.exe

C:\Users\Admin\AppData\Local\Temp\D52F.exe

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\1adc1908-dfaa-4694-832f-9e381d5aa48d" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\D52F.exe

"C:\Users\Admin\AppData\Local\Temp\D52F.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\E424.exe

C:\Users\Admin\AppData\Local\Temp\E424.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU4AX32.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU4AX32.exe

C:\Users\Admin\AppData\Local\Temp\D52F.exe

"C:\Users\Admin\AppData\Local\Temp\D52F.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2536 -ip 2536

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x7ffe0dbe46f8,0x7ffe0dbe4708,0x7ffe0dbe4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffe0dbe46f8,0x7ffe0dbe4708,0x7ffe0dbe4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffe0dbe46f8,0x7ffe0dbe4708,0x7ffe0dbe4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffe0dbe46f8,0x7ffe0dbe4708,0x7ffe0dbe4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffe0dbe46f8,0x7ffe0dbe4708,0x7ffe0dbe4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffe0dbe46f8,0x7ffe0dbe4708,0x7ffe0dbe4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffe0dbe46f8,0x7ffe0dbe4708,0x7ffe0dbe4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffe0dbe46f8,0x7ffe0dbe4708,0x7ffe0dbe4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffe0dbe46f8,0x7ffe0dbe4708,0x7ffe0dbe4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x180,0x184,0x188,0x15c,0x18c,0x7ffe0dbe46f8,0x7ffe0dbe4708,0x7ffe0dbe4718

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Ga0901.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Ga0901.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2592 -ip 2592

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,11624166372574735499,7076446370466255792,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,11624166372574735499,7076446370466255792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,16559690019274166760,10266010578112894613,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,8756338472564928755,6983694575763660521,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,8756338472564928755,6983694575763660521,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,7495320794300093872,8346514913882443755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,16559690019274166760,10266010578112894613,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,7495320794300093872,8346514913882443755,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,823665117156320138,12668731002648344030,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,823665117156320138,12668731002648344030,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,1966316698609476405,16192396376035558985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16559690019274166760,10266010578112894613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16559690019274166760,10266010578112894613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,1966316698609476405,16192396376035558985,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16559690019274166760,10266010578112894613,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,2596384486287871863,8376111038663645602,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,2596384486287871863,8376111038663645602,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,12646320493087693899,10016159252503375796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,12646320493087693899,10016159252503375796,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1468,3030759858798603273,17718946998521886286,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1468,3030759858798603273,17718946998521886286,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,3713472008207793916,3264379462735499698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,3713472008207793916,3264379462735499698,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16559690019274166760,10266010578112894613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16559690019274166760,10266010578112894613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7sB5WS80.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7sB5WS80.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16559690019274166760,10266010578112894613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16559690019274166760,10266010578112894613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4380 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16559690019274166760,10266010578112894613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2656 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16559690019274166760,10266010578112894613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16559690019274166760,10266010578112894613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16559690019274166760,10266010578112894613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16559690019274166760,10266010578112894613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16559690019274166760,10266010578112894613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16559690019274166760,10266010578112894613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 7412 -ip 7412

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7412 -s 872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16559690019274166760,10266010578112894613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6952 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16559690019274166760,10266010578112894613,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6956 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,16559690019274166760,10266010578112894613,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7252 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,16559690019274166760,10266010578112894613,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7252 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16559690019274166760,10266010578112894613,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7612 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16559690019274166760,10266010578112894613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7584 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16559690019274166760,10266010578112894613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16559690019274166760,10266010578112894613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2132,16559690019274166760,10266010578112894613,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2408 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,16559690019274166760,10266010578112894613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2408 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 host-host-file8.com udp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 24.52.193.212.in-addr.arpa udp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 brusuax.com udp
BA 109.175.29.39:80 brusuax.com tcp
US 8.8.8.8:53 39.29.175.109.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 transfer.sh udp
DE 144.76.136.153:443 transfer.sh tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 api.2ip.ua udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 153.136.76.144.in-addr.arpa udp
RU 212.193.52.24:80 host-host-file8.com tcp
US 104.21.65.24:443 api.2ip.ua tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 24.65.21.104.in-addr.arpa udp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
RU 212.193.52.24:80 host-host-file8.com tcp
RU 109.107.182.45:80 109.107.182.45 tcp
US 8.8.8.8:53 45.182.107.109.in-addr.arpa udp
RU 212.193.52.24:80 host-host-file8.com tcp
US 8.8.8.8:53 steamcommunity.com udp
US 8.8.8.8:53 www.epicgames.com udp
US 8.8.8.8:53 www.youtube.com udp
GB 104.103.202.103:443 steamcommunity.com tcp
US 3.230.179.48:443 www.epicgames.com tcp
US 8.8.8.8:53 store.steampowered.com udp
GB 172.217.16.238:443 www.youtube.com tcp
US 8.8.8.8:53 www.paypal.com udp
US 92.123.241.50:443 store.steampowered.com tcp
US 8.8.8.8:53 www.facebook.com udp
US 151.101.1.21:443 www.paypal.com tcp
US 8.8.8.8:53 48.179.230.3.in-addr.arpa udp
US 8.8.8.8:53 103.202.103.104.in-addr.arpa udp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 50.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
GB 157.240.221.35:443 www.facebook.com tcp
BE 74.125.71.84:443 accounts.google.com tcp
US 8.8.8.8:53 twitter.com udp
US 104.244.42.65:443 twitter.com tcp
US 8.8.8.8:53 21.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 soupinterestoe.fun udp
US 172.67.221.65:80 soupinterestoe.fun tcp
BE 74.125.71.84:443 accounts.google.com udp
US 8.8.8.8:53 35.221.240.157.in-addr.arpa udp
US 8.8.8.8:53 84.71.125.74.in-addr.arpa udp
US 8.8.8.8:53 65.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 13.95.9.65.in-addr.arpa udp
US 8.8.8.8:53 65.221.67.172.in-addr.arpa udp
US 8.8.8.8:53 dayfarrichjwclik.fun udp
US 104.21.80.57:80 dayfarrichjwclik.fun tcp
US 8.8.8.8:53 neighborhoodfeelsa.fun udp
US 172.67.143.130:80 neighborhoodfeelsa.fun tcp
US 8.8.8.8:53 diagramfiremonkeyowwa.fun udp
US 172.67.183.217:80 diagramfiremonkeyowwa.fun tcp
US 8.8.8.8:53 57.80.21.104.in-addr.arpa udp
US 8.8.8.8:53 130.143.67.172.in-addr.arpa udp
US 8.8.8.8:53 217.183.67.172.in-addr.arpa udp
US 8.8.8.8:53 ratefacilityframw.fun udp
US 104.21.74.182:80 ratefacilityframw.fun tcp
US 8.8.8.8:53 reviveincapablewew.pw udp
US 8.8.8.8:53 cakecoldsplurgrewe.pw udp
US 8.8.8.8:53 opposesicknessopw.pw udp
US 8.8.8.8:53 politefrightenpowoa.pw udp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 182.74.21.104.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 www.google.com udp
FR 216.58.204.68:443 www.google.com tcp
US 8.8.8.8:53 68.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 www.paypalobjects.com udp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 8.8.8.8:53 25.221.229.192.in-addr.arpa udp
US 192.229.221.25:443 www.paypalobjects.com tcp
GB 172.217.16.238:443 www.youtube.com udp
US 8.8.8.8:53 i.ytimg.com udp
US 8.8.8.8:53 abs.twimg.com udp
US 8.8.8.8:53 api.twitter.com udp
US 8.8.8.8:53 api.x.com udp
GB 216.58.213.22:443 i.ytimg.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 104.244.42.130:443 api.twitter.com tcp
US 8.8.8.8:53 video.twimg.com udp
US 8.8.8.8:53 t.co udp
US 172.64.150.242:443 api.x.com tcp
US 8.8.8.8:53 pbs.twimg.com udp
US 68.232.34.217:443 video.twimg.com tcp
US 104.244.42.5:443 t.co tcp
US 192.229.233.50:443 pbs.twimg.com tcp
US 8.8.8.8:53 22.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 141.21.199.152.in-addr.arpa udp
US 8.8.8.8:53 242.150.64.172.in-addr.arpa udp
US 8.8.8.8:53 130.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 217.34.232.68.in-addr.arpa udp
US 8.8.8.8:53 5.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 50.233.229.192.in-addr.arpa udp
US 152.199.21.141:443 abs.twimg.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 8.8.8.8:53 42.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 store.akamai.steamstatic.com udp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
US 8.8.8.8:53 200.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.179.238:443 play.google.com tcp
GB 142.250.179.238:443 play.google.com udp
US 8.8.8.8:53 community.akamai.steamstatic.com udp
GB 104.77.160.220:443 community.akamai.steamstatic.com tcp
GB 104.77.160.220:443 community.akamai.steamstatic.com tcp
GB 104.77.160.220:443 community.akamai.steamstatic.com tcp
US 8.8.8.8:53 238.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 220.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 static-assets-prod.unrealengine.com udp
US 8.8.8.8:53 tracking.epicgames.com udp
CZ 65.9.95.27:443 static-assets-prod.unrealengine.com tcp
CZ 65.9.95.27:443 static-assets-prod.unrealengine.com tcp
US 54.87.226.161:443 tracking.epicgames.com tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 23.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 27.95.9.65.in-addr.arpa udp
US 8.8.8.8:53 161.226.87.54.in-addr.arpa udp
US 8.8.8.8:53 facebook.com udp
IE 163.70.147.35:443 facebook.com tcp
US 8.8.8.8:53 fbcdn.net udp
IE 163.70.147.35:443 fbcdn.net tcp
US 8.8.8.8:53 35.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 www.recaptcha.net udp
GB 142.250.200.3:443 www.recaptcha.net tcp
US 8.8.8.8:53 c.paypal.com udp
US 8.8.8.8:53 3.200.250.142.in-addr.arpa udp
GB 142.250.200.3:443 www.recaptcha.net udp
US 192.55.233.1:443 tcp
US 192.55.233.1:443 tcp
US 8.8.8.8:53 t.paypal.com udp
US 151.101.1.35:443 t.paypal.com tcp
US 8.8.8.8:53 35.1.101.151.in-addr.arpa udp
FR 216.58.204.68:443 www.google.com udp
US 8.8.8.8:53 b.stats.paypal.com udp
US 64.4.245.84:443 b.stats.paypal.com tcp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
US 8.8.8.8:53 84.245.4.64.in-addr.arpa udp
US 8.8.8.8:53 dub.stats.paypal.com udp
US 64.4.245.84:443 dub.stats.paypal.com tcp
US 8.8.8.8:53 c6.paypal.com udp
US 151.101.1.35:443 c6.paypal.com tcp
GB 104.77.160.220:443 community.akamai.steamstatic.com tcp
GB 104.77.160.220:443 community.akamai.steamstatic.com tcp
US 8.8.8.8:53 login.steampowered.com udp
GB 104.103.202.103:443 login.steampowered.com tcp
GB 104.103.202.103:443 login.steampowered.com tcp
US 8.8.8.8:53 api.steampowered.com udp
GB 104.103.202.103:443 api.steampowered.com tcp
US 8.8.8.8:53 sentry.io udp
US 35.186.247.156:443 sentry.io tcp
US 8.8.8.8:53 156.247.186.35.in-addr.arpa udp
CZ 65.9.95.27:443 static-assets-prod.unrealengine.com tcp
US 104.244.42.130:443 api.twitter.com tcp
US 104.244.42.130:443 api.twitter.com tcp
US 8.8.8.8:53 talon-website-prod.ecosec.on.epicgames.com udp
US 104.18.41.136:443 talon-website-prod.ecosec.on.epicgames.com tcp
US 35.186.247.156:443 sentry.io udp
US 8.8.8.8:53 136.41.18.104.in-addr.arpa udp
US 8.8.8.8:53 talon-service-prod.ecosec.on.epicgames.com udp
US 104.18.41.136:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 104.18.41.136:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 104.18.41.136:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 8.8.8.8:53 js.hcaptcha.com udp
US 104.19.219.90:443 js.hcaptcha.com tcp
US 8.8.8.8:53 newassets.hcaptcha.com udp
US 8.8.8.8:53 90.219.19.104.in-addr.arpa udp
US 8.8.8.8:53 api.hcaptcha.com udp
US 8.8.8.8:53 rr1---sn-5hne6nsr.googlevideo.com udp
NL 172.217.132.70:443 rr1---sn-5hne6nsr.googlevideo.com tcp
NL 172.217.132.70:443 rr1---sn-5hne6nsr.googlevideo.com tcp
NL 172.217.132.70:443 rr1---sn-5hne6nsr.googlevideo.com tcp
NL 172.217.132.70:443 rr1---sn-5hne6nsr.googlevideo.com tcp
NL 172.217.132.70:443 rr1---sn-5hne6nsr.googlevideo.com tcp
NL 172.217.132.70:443 rr1---sn-5hne6nsr.googlevideo.com tcp
US 8.8.8.8:53 70.132.217.172.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 youtube.com udp
GB 142.250.178.14:443 youtube.com tcp
US 8.8.8.8:53 14.178.250.142.in-addr.arpa udp

Files

memory/2592-1-0x00000000008A0000-0x00000000009A0000-memory.dmp

memory/2592-2-0x00000000009F0000-0x00000000009F9000-memory.dmp

memory/2368-3-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2368-4-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2368-6-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3340-5-0x0000000001060000-0x0000000001076000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BFF0.bat

MD5 55cc761bf3429324e5a0095cab002113
SHA1 2cc1ef4542a4e92d4158ab3978425d517fafd16d
SHA256 d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a
SHA512 33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

C:\Users\Admin\AppData\Local\Temp\D52F.exe

MD5 d6709cc2adb09d6ff003d52ece25c894
SHA1 1f5b110ab3549efac240ff309bbcb934c26a072a
SHA256 fb5c249e2a353691a022f786fabcdc80037824e1f018ddb01d2a5f68c62e2167
SHA512 9501a3818f7e478f546438582a654592bc2c541cdb7d1b54dfb931672a6da74b5e0c3b6a9ee5080dd604762bdb7be3222c931223acc7c79c51b3b06ea72e002d

memory/4552-26-0x0000000000A00000-0x0000000000A93000-memory.dmp

memory/4552-27-0x00000000026B0000-0x00000000027CB000-memory.dmp

memory/3012-28-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3012-30-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3012-31-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3012-32-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3012-44-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\E424.exe

MD5 c030532b197d1906c08809504f02dd35
SHA1 8f292a01b3ef5a78b05434ddf19469008821dfd4
SHA256 0af8602626c6e3de664b466ff0e05899aa5178c4b3bc18c3b31f0b7624225015
SHA512 947aeb3d567b59c070759eb19a017c72f59ca67fe8ada69c1900955c8ef7ac8aa84a93ac402cbe5d128386456f279b7ed12bb2a3ad5e6b7c08de4fe09721d458

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\KU4AX32.exe

MD5 2ece6fb1ecf9158df53a36898295b916
SHA1 8168455f9b84aeaee3e95c97dc6602cdb609f580
SHA256 49d3eff95edc3a0d171c7c256847e5eb27dc8273abd9d0ffae434845df55249e
SHA512 204f8af2ad481467477303dca183c012c79825b4e5f35ea30bda41f11359ae432ff939cfc12b0c3bc5ad6b3e080ab2255330b821e2c0bfd389f8792e2836297b

memory/3432-62-0x00000000023E0000-0x0000000002479000-memory.dmp

memory/2536-68-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe

MD5 9208872e2b8aaad57c2b56da6d48654c
SHA1 6baeddbd36220f0761d522ce6b044b0f6c2cad5d
SHA256 6f0ed098d5a0cdb0e513d9d4bca62dd1e4e827959519d0da537989b6c7cc3be9
SHA512 693a2c6764195184687c42bcb6743950dad7f443063eaa284d8941876916761bf9e3df34da5a8445987d7b6e531004b0f12cd60fa3cc4d28d4a544f6217e5d8d

memory/2536-69-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D52F.exe

MD5 d2a454698dc87fac02c97117371d76cc
SHA1 dbe6b1f074aaee68837685b992f24a5011e00d7b
SHA256 560593de30ae0202c36e21499343fb538e0745429702ea03a56423121e087149
SHA512 0a77aef06fa2f6d9527c0b54ba87e452e4d53e124ab4a30c3400edd0c2867604c70ccd06b9d3c4ec981b116d55e5604da1011e69c90d63ca9e64277385395141

memory/2536-71-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1BA23xB0.exe

MD5 ef34af244ed2403e53b2e9feea5dea17
SHA1 25fe1640e9f15a6bc900e9f9f7d44952ec0d4c9b
SHA256 a6548c525ef1007376ba36ee1b9632e9b864ed11cb9ff249aa2f3088b364ca02
SHA512 aa90280d41e71d02b10b83a659fa25021b05a999ba0d1d09b2dad0d6a0a0fe391de29c9fce7998c79c94fd6fc16992a9eb319861e2aa26521840c0ac083c469d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 5990c020b2d5158c9e2f12f42d296465
SHA1 dcb52612d301824d3a7fdfd0ea20c3fcfbb7a1b4
SHA256 2f33956ce5a0bb01abb3c0fee9a321c8f8f7abcf1d7535800bf25f1dc44b1643
SHA512 9efb70c4922365967c5fa7e89967e21eede96979a149e027099da786cd8b198d4e81bb3bf2b39c8d65a8796c5d72ca79241e66fc69e2502fdec8a0c5f230412c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 208a234643c411e1b919e904ee20115e
SHA1 400b6e6860953f981bfe4716c345b797ed5b2b5b
SHA256 af80020ae43388bbd3db31c75aade369d489a30a933574dea19163e094d5f458
SHA512 2779b96325234c836cbb91820ee332ed56c15b534ec0c7770b322a5c03849ec3ee67b0ec7978e1fab563eeed1cea96f5155d7b942702555d9352ff6711a548d2

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Ga0901.exe

MD5 f8e7488fd4ced59d6eb387447bc37430
SHA1 560ed0a592273875ae66a93efd611f76a9da7ee7
SHA256 30d11b5bd1ed2f376bb2c6dd47299a54702bf9cfdfc0d32e5f50c1adf83ae347
SHA512 0e7445eb71a24e10c13a706189cc972d9d590bbd456f27b4008243161868fc6b0e86fd8fadf42f61502aa913f39e2a3fedb7de236b80a2bff05378b7ade6cdb2

\??\pipe\LOCAL\crashpad_2096_BJOKLGFJTUSSBENP

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 63f3c52ad0b2354de9b5ece6f3c47df7
SHA1 d60bdb7c3da5a583753feb0fe0c887219d0233e8
SHA256 42ccc217edcc930e46511622c71f06e0f66f098178bd33e6216b8e70ee1df535
SHA512 6cd827f076176291b6fd60c7451f27ea53ef0c779287ab490dce452251b5b69ed23ec0a5fc902ab8fa65ad4c205fab31d3c574b6c3dc8dbd0529f7422161d2b7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 7ba986ae24885a5905c7e157e171d7f6
SHA1 989c601f22dbae07695fb9e2bd179db31d7bf636
SHA256 b2a9892ba8d9192c882b0b2b9ed141576768e6b4913ec6a7d6860a4e4826bee2
SHA512 a652c627a9672d17ad467ced86b425e1ab543faf712f2bc492ca5155e94716133683b6c64225e1843caf10dc8ca1fa8363f880bba782640010164eec8c5c3381

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\593bf7c2-b983-42a8-801e-99cd1184a85f.tmp

MD5 667566791f317d489b93a9dd30d94ac8
SHA1 a4ce37817b52452b8e09ab2a6a3d37c0f246e4b4
SHA256 e4176c72a354c9a29dceb7d39f9dc732f4e3ede47a1dbb1d9fe12d3819106d7b
SHA512 00290f08388d17bc302e9cc4dc701fdf15d7b12d9ca0f630151955cfaec08fa3725243e3ee49e4694114565339980a24d0aa5ed15e45769f60b2501b6b85714c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 7237e94864f06df725d602e6eaae46a4
SHA1 42b33ed9510ffec3e0f700c65e8ff682bd9ec51c
SHA256 adcb1276c934acb414e538a23d2a7bddd0451443ccc67af8f44e1e2860956835
SHA512 a35e6382bc53ebfb5a851e3ea41d64397a8559bbff249aee471d6e865873a0294e585c890801556e8e400e617238041a4c1bba167fc1ab41bddc6f29d775d846

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4c518693-a446-4074-b19d-46192252db9b.tmp

MD5 c9db0320ce45740f6e32bf61bef3ccf9
SHA1 369d02b90c88c86af3eb8821ae3c57ea3a435d94
SHA256 ae9a3416404e2e97654c8199dc22d2b24d99a9ebb22bbedead45bae9a247e3ed
SHA512 1f4ec87762d1627f2124d412f0e6a31c3c4c1b5c885d31823b5c4879f8fe838ff3cc6c871bb553d2b4d9faa3c7a5b5deab59022454ab80f42846e95214bf86e6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 cf97832182a9fa9c4b3d46e58ef6d7a0
SHA1 4906769288d3c360e1df3e6edcaf6a9696becb38
SHA256 98d3c0160b46a789b903b6c5364c2d967e1f8dc0218de184e6e3119dbca4843c
SHA512 0c3713d730108566482ff0a173781bc930f482eeb2e3774c19596530b4bda5fe8b1f747866eb5c08f13164c7079cf18ddae2c47d1895d446a61a30d6587d01da

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9bdfa675-d059-4242-afae-200230a3a427.tmp

MD5 a604a24ec9c76595e04dab2558c74dbb
SHA1 8febe4db29daa8a750192cb3da6ab9347205fe81
SHA256 9bd648a044516c84bc49c3786c79a24ed45639e73ce5d2d44929389bd94bf1c9
SHA512 596f563bb4099d81e47da95f67bbdd73f87c43aa3000e4f082f63d3f7ac7341ed48139f167910f3a06d44da600cbe3bf521094927803a2708df114ac5642d48c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 1e162919abc07f089e232ed7fee89f7d
SHA1 7b2adce18ceb14e74e8b6d86e8b7968a0b5d5e37
SHA256 ee8a074147aa4d97ebeea1036c446067f1d7741dfd1dd361f44a0c3345f9a2ba
SHA512 3866f2d3631eaef9ad04cd3eca0fd06896f815e80d21137c8d237f8331a5ebc4fcdbcec1e01c09beb3838cc3febf49aee64a88618e3ec10d45e7bf00fe44e98b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\011700de-5f7f-4c46-9a0c-91665dd828d7.tmp

MD5 90a349cec8b54dc6de1a94d7e135901a
SHA1 419d2c0831aeebcbaa9bf8c448847cfb9c4e633f
SHA256 5123d7b296a809f6ce85211fc729ce98c58ae45a144658862c64f0ee358adfb5
SHA512 6a11c0d9dbc3e6160a6a327a847a9f347dd900561287ecae6e90c8a036d5f90fdd8fcdc1a7726d7d66af43c82f8b4f5ba6792b0cbefdc37c825a82a21450e15b

memory/7412-382-0x0000000000C20000-0x0000000000D20000-memory.dmp

memory/7412-383-0x0000000000E20000-0x0000000000E9C000-memory.dmp

memory/7412-384-0x0000000000400000-0x0000000000892000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 cb465725e7914fe79318e0094f8f6962
SHA1 0e6dd213db85557a0157fa298f01559f5d92df2f
SHA256 83ab5091b7921fbc0d9a48a4b753451d6495407b803653624a1ba642a19b8064
SHA512 f8bc4fc94e930b11c81d2f245648c3d1031544412dc27a84d590833008475f6d824908b20c8ce74c78dbfb2c26cd32053c6603fc2bd76c05216d309cc0cbdb4e

memory/7412-431-0x0000000000400000-0x0000000000892000-memory.dmp

memory/7412-432-0x0000000000E20000-0x0000000000E9C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 8c205d8d9aa5afab9df91450772e5d00
SHA1 0b89520b3bf8165367435918c2de710806733049
SHA256 aa467f04bd617e75becc28524a2197558b521ade13d3b8511c9e749564c89615
SHA512 96a49cb53783c09bdae298157569e42a6579934dfc6fcace0888e8f25fc5509eed09fbbe8558a0dc5594d9b35b91215d3307a0c02a67c4973098c32d709af59c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f53d14fd-b961-4740-a0d6-c4a5f7e4a533.tmp

MD5 5ac8b2ad3cda4daee36458e01e2bcb25
SHA1 b8705d2a09cb4c3f0a2e94d174dafa83f067a846
SHA256 3847d10b9d5f40837289ab1b3bca6da6c62ff09b19a3d03c020cbed3339bb836
SHA512 848753d9cb5818a7d89bb20df1a50273331e5dbb029512e7c207d2dfea46a6e23248644206d370b7737916644b7698ab4f49e7b3b7790a1ce055f09755a516bf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 5a6206a3489650bf4a9c3ce44a428126
SHA1 3137a909ef8b098687ec536c57caa1bacc77224b
SHA256 0a9e623c6df237c02a585539bffb8249de48949c6d074fe0aaf43063731a3e28
SHA512 980da83c3142bf08433ec1770a2ec5f5560daf3ee680466f89beae8290e921c0db677489daad055fbc1f196388f8bc4f60e050600381f860b06d330062440a78

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 e66232c62f62f83bbb742413ac9fda71
SHA1 0834536730b437ba5dde4e35a371a37e32e3fa04
SHA256 12629b2e87391bc12fc2e95e22b07f2094c31c2ad3f05e68d97721c3ee980194
SHA512 a62e9f45937273626123bab0c5d2df4b6fd5068242f9b1b6b3becb55f89c3c61bf8cece3ae02353fafbce84865af48691ceef920648cc34052122b9fcd2e7658

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

MD5 f035cb410e0d0db605ade433d006833f
SHA1 725f34845c9d1a1f903fc0097f01fbf1d5fb01e7
SHA256 6c412194112335e60d063ca8d084e27a3081295a70e9bc8e499956b2a7620483
SHA512 ae466c7ff3c2748076e828ec5176303cd6e4104b767c3ec70f17fa0318a66cda248699b252571856d6f69a5ead27badf37c940c92e988c6d5e8426130640bece

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 4b219253e89bc86efb9571cdf47e0850
SHA1 05a4ad21596fedab16e01a41d0c37333d4a80c8a
SHA256 725f205c9019f64f5b88a2c549d34b71e65636809920c182129a719d71157df9
SHA512 adfc3c6e0b6bbc63c1b082e17cbd3d1e3a2177c2241c3c526ad3ce23ff639a3c1b067967758ea48183d928a946871205a464753e27a44da333e152693617a1cd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59620c.TMP

MD5 ddf867663337d082de8fa7de73971ff3
SHA1 82c692a2b7d19bb792b370660dcf73dd6aed2299
SHA256 9786b8bbfca95d967f19f90ba2fb018f3790ac49c21a96d25de2b6db163368ca
SHA512 c950a87173b39f64d694796b04ccea8cd3aca2a9b6124f1102b993401f9a38c29138ddfccf6bad923ca33af37564e45fdc1c31197d5ea14c01f3e90d6d9b3019

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

MD5 923a543cc619ea568f91b723d9fb1ef0
SHA1 6f4ade25559645c741d7327c6e16521e43d7e1f9
SHA256 bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd
SHA512 a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

MD5 7d75a9eb3b38b5dd04b8a7ce4f1b87cc
SHA1 68f598c84936c9720c5ffd6685294f5c94000dff
SHA256 6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7
SHA512 cf0488c34a1af36b1bb854dea2decfc8394f47831b1670cab3eed8291b61188484cc8ab0a726a524ecdd20b71d291bcccbc2ce999fd91662aca63d2d22ed0d9f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

MD5 909324d9c20060e3e73a7b5ff1f19dd8
SHA1 feea7790740db1e87419c8f5920859ea0234b76b
SHA256 dfc749d2afefe484d9aa9f8f06d461ad104a0ca9b75b46abfaaddda64a5e9278
SHA512 b64d2dce1f9a185fbb8a32adc1ff402d8045d379600bf3f9154bbde18303610f18af9fce258442db1e621ecf10b77aafe99cffedfcbe2a1490056c50cc42d0f9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

MD5 d55250dc737ef207ba326220fff903d1
SHA1 cbdc4af13a2ca8219d5c0b13d2c091a4234347c6
SHA256 d3e913618a52fe57ab4320e62a5ace58a699d6bce8187164e198abe3279726fd
SHA512 13adff61e2cfa25dc535eba9d63209b7e7e9bd29fc4d6c868b057df7f680aa66ef5783a0e82a8367185debf7f6fe5bae89adc0770daff5317d2e16db5ad3ab39

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

MD5 b3ba9decc3bb52ed5cca8158e05928a9
SHA1 19d045a3fbccbf788a29a4dba443d9ccf5a12fb0
SHA256 8bd1b2afcbe2fa046b0937197f1b2f393ef821ff89331f99754b9006f0114df4
SHA512 86a86d370e96fa29c0c1d12991c2287936b400830869ff7b5abe4de6f32db2df782b626d724496cd6de27f8cbd32101ba34cbcd4c650ef11afa26bc048d68529

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 210f4663c0c30a3e9bcfbb35f0de8aed
SHA1 7cf37c10474aaada2665e88bbfa4440e7828cbff
SHA256 9e301a3df64c321f99daad551cb9331122b11593b6095a458731a4ae030ccab7
SHA512 13403d7d1fa9d9eef1c6f44fb1319f4db1dc1866cd71c32d7b5196ea035e365f4cb74b963b79f6b6d6a6faf76617acdb74ac378bc496b5ea00fe85b767c28c32

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 bc72041a26fae74b9dd151cf9dceb88c
SHA1 d19e804391ae39580cad199b858954633dc95081
SHA256 29b2cf5d039d374a0fc9c0d544fd7c9c3aa220404ab1ebbfd9e55a3233fda895
SHA512 817558d236167a5c680a928342ec4ec3c5050361d73ef2672a1e13139020d0be6a57aa127d54b9828c34facd82c76b4bbc5f7dcad2c609127d05d08fcf2889bb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 c72567708369086a92db760bf07a494e
SHA1 63cf8a534382e5a51bb79a7c8da91c85ef3e481e
SHA256 f402e5311dc56babfa3c55b756c06e9e16c7cbf767eb18ba041de8c97cf86467
SHA512 422d01ba33839d81c1f120bc0fb1b591bb18657249f7412882815c2d9a9d62990567c73b813efdc5fb616eb008ca553d142d9aad181fd62abc1500923dbe78cf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 9e03256cb9c5225954752d536edc9c66
SHA1 02416bdf3dc1ed6333ef8f4668978e747e6ba595
SHA256 9d0fd05d4b639fae7ddf6326251d7c1d815a14f64f6792866681fa552f49e998
SHA512 c1987389decea50bcc33666f6f52b222913bca30a7b4a80226d4d4834e41aa841c9633a27e39d9b37210ca03b296f5fc87a6bf55621cdb072a5abb5a4a2a5069

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

MD5 fa93e2e3c9398b6edc54bdfd2c81af55
SHA1 b1fb3cf67c0d3f5828689ed081e2b4cae9fb6f30
SHA256 65b79f45389ed25f27121070a0ba835fe2fe5f91b6f2ec0b9e64623449c21d11
SHA512 c7a268cee78a1ece77accbe6b9af04e08be24223b0920df9e8514643ca4b9ef52fb3472cc721aff2174df975742e8b8de123ac7726697ebd699bd05d7e3f0518

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 1731d6e65c10834aea6469ee7f59701d
SHA1 943766904dbcc380a036f96bb9e273c50b78b6b8
SHA256 0c1f1bea1ef9f7383507f43ff2ec65aadb08778ae6d70f097ce181644094ed8d
SHA512 73f0875b1c7d4b7b58745759ce98fdbd1ef158d70fc91b8dbe37e385348ef2a236038372a9968e0b5bf0d345a90e07a281143ea7954b1bdb8e87309553c9f610

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 7618adcd6bca6431b8e69317adc13053
SHA1 b2b777b859635df99b87113beaee3bbc8631fe2b
SHA256 088a10e45cc671462a63ddb87254f45f261b7a4d585df126a0453a6122c98e26
SHA512 9a9c322f32bd15729e5c0293e3a591c06f504e32020c97f352cfd78da76648f751b906858a264d412546ccf16a84cde6574fe49dc2e931165b6508755ce508ce

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 baaaeeed7fff33212cc53e71d2dfae7b
SHA1 71393ee9cc0ae20db0e136f08c37d97882910d47
SHA256 e173dee5dafdd8ae00f394e368f369a18ae8394dcdbcd91d4b1d5bcd861d3410
SHA512 7ea7698447bb9afe89ed7b39d5da94ef5ba1d61249a43917822caff55f6aabe79f7f238af10c6a713e8cafaca29cf142887c59682c89afa52a7e17675acf1bd2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 814d8019bf10966c495a2a90ebdeaea1
SHA1 eef57529af6929e0b43a1af4efb857bc8a10d815
SHA256 2e6b599ced696e9a301fb70896b86d86cd94b7732c060f4e84217292d2f0bbea
SHA512 dbf394241e385b52b7c1a32523f738f107c44ba94db2687b2ca9b2d97ff3c00b5ffaace98ebb1e5ba0b7855b62843d2858c41a8532d3e6cc5f06b36fb7e1a487

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 24a31a8313fd3b0fe6ce1be403c6378f
SHA1 9438585d3f73c90206df68559342152653d7ac0a
SHA256 abc64e0c0868f0eda5fe9921107e86933c0cbadf2607cc6aa0bdfaaeba89e922
SHA512 7c307b5d35812eda5b13e4b5c9ffca3f9c788af557dc57798e67fd6c6be82adb927c7dc06aabe9c1be2ec6892bb99fda35e0398b1447e43589f72a991c5398fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 e8183be3b7a18044ef22ac4d718ff91b
SHA1 3f8d035c337f7acb65d3a96c4ef527085a80051e
SHA256 021aa82f6f94fc0c3baf4399dff30d606469f3e184180a711c2827d29f8658be
SHA512 074c7fffc28717e0f20065ad55d058744f69af50e6572f16ce85c6baa702970617c947733b04cbb048b23fe49852a5193bd354bfa27aeff25cd1f1829b7cefe8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 67c555dc54091bca56af189119491bfd
SHA1 0b23bca3f84f5ae7d9069da41efac7c13eef5d09
SHA256 8bfc31a35d7db76db84144e6cfd4f7e58232c8f4f203ae4fb457ffff9848a3a2
SHA512 20839e7a9a5216dafd9ccc7f20b37766796563e14dcae304065ea1f07e4f520428acd0afe0fab0af021337412fc98a0cd4b8cf215c4ab4036776398e02a898bf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 76fc301187821a5ad8ec60daf3b50e32
SHA1 538f2d60728df5fb052471755ebb132c53ef8970
SHA256 4699f242461f798dd57fb93ac25d115bfc14debf5810d69c12257f12b10f2344
SHA512 3ee1a94da4feece496e518d92c3bee2360bf799bb11c0b83e90c22d5812991e9d1fb90e2bd158d7dfc83fc348824b62041b80021b6438b96323f25f6bb198141

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 ce5938e45f3e4f447927bb61c9527789
SHA1 377220aaf2d5e3507e22f21da0d70dc2b4d95538
SHA256 7d284331324e4140c5b2a4acd935d50d3263e63aee2dabef45320a908f0d17b4
SHA512 7c73e1850e9d219f21d14ec7e506f69268e5776412f93018032b780d2bddcd102c5576508d9e2acd4f945deae3de633abf0d537bcf362294ef4cd2190084a7d3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a4344.TMP

MD5 0b4555cd89fd4c522a01038fc7f6e5e5
SHA1 dcae20e0507c293e7c4e76f2b33b964f97d4ad2d
SHA256 8285c80fcfc3f940f55203c151dd56507710fb44caecec00fe153664a96ff3ca
SHA512 ea6f63bfbe840c67e48f333d6058b4a39baae8b3e99203ad4e056f0fd29bcaa61bc99f7c267192e4519f33556cee5f81cd36594b6af592f63c9788e963449f83

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 155eb261e4ff8724d53105de53a4e871
SHA1 9cf2ea7141d2e1e6750c587912ee1f88e5e954af
SHA256 d8ea41ab34c3551fc0ecffad7a24c52e05cbf669920899f4155019960e0e59b4
SHA512 ea3afdd923b32bfe8d5192de147ff49d95e98dfd24d63ada60eac2302e8f92db05e149b7396f7b22a67885b1040b23429c064b7dab29e16983e4a0ef1bbdb68c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\35d8e1be-4f68-439d-8d59-157ec34aad9e\index-dir\the-real-index

MD5 4f3641ab4e0679e56707f06d687bdadf
SHA1 7a36cd5b91b29f949d01462e41903d58efa826e5
SHA256 54ee79c4a5968b9de47b3f6eb1f9349bf9b814e563c3904b96f54ea340afa456
SHA512 80145b794e6328220e1d0a40266c687d26bad8747dd6c435467b811892570b0485827a11c5188e9c137262775265c14ba3e88e88155210f5ca3fc17d15c4f113

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\35d8e1be-4f68-439d-8d59-157ec34aad9e\index-dir\the-real-index~RFe5a7234.TMP

MD5 d500d0093bd74cda95ba46be1c8cae96
SHA1 472c64b6e609b5ac611b9841069982216c5d58e3
SHA256 68b41978867c2bd1134a81b5c36c288ce7e805472d78a14fa2280c1f514a1a75
SHA512 bd5f6e4250c2a6d39c56ccea8f15b926af2550f22284530ce0e8ea7c1d0e7002a3163043c4e636820267463d6186e82fcc6b8af0a5b07da16b9687db42890891

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

MD5 2f2c67fb2afbd11a9786f6ef4f5b2b8f
SHA1 16218f964dada61664cbb5010ae966c462807dc7
SHA256 b3372ceef85a53eb67b18b2df8f66f75d1517ab9028fa67950389201999be3f6
SHA512 32f05c54f21f2fe023441b2a628d84856a2ff58323f84a8f3c684452afb08bac313889b23659cd3c10923a3dcd4f8e184dc8da921714034d33d4df7629dd862e