Malware Analysis Report

2024-12-07 22:59

Sample ID 240112-f1zwhsfcan
Target XWX354.exe
SHA256 59f63e0e010518db4d6b1d6d1a7e7620fef5e05685d0756112a713278efef5b4
Tags
risepro evasion persistence stealer trojan paypal phishing
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

59f63e0e010518db4d6b1d6d1a7e7620fef5e05685d0756112a713278efef5b4

Threat Level: Known bad

The file XWX354.exe was found to be: Known bad.

Malicious Activity Summary

risepro evasion persistence stealer trojan paypal phishing

Modifies Windows Defender Real-time Protection settings

RisePro

Executes dropped EXE

Loads dropped DLL

Windows security modification

Adds Run key to start application

AutoIT Executable

Suspicious use of NtSetInformationThreadHideFromDebugger

Detected potential entity reuse from brand paypal.

Enumerates physical storage devices

Unsigned PE

Modifies registry class

Suspicious use of SendNotifyMessage

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-12 05:21

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-12 05:21

Reported

2024-01-12 05:23

Platform

win7-20231129-en

Max time kernel

142s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\XWX354.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe N/A

RisePro

stealer risepro

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\XWX354.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000c068746d1c6e47722042ccb7c9d63c9dfc86c80379bca97ef216c9b612a5bccb000000000e800000000200002000000026373d2a922c14dd26c00fe9c129fcba2ef168f2f344d4362cb8f0d1433c12db90000000f0ac1cffe6312c034ca5ce387057321afbb4ebfd036afac847e7167641872fbcd6de0614a840013e6002b810bbcff334e60b392e7f70f814b7b2d8d6ff156b94dd01bc0326d0a070bb6d24dab9d5c51d4b06161caaa972e67e7893b26ca4973c9e4bc4e7b3e57799e50f23b928fc564ee411a95634332c67d1793fa91417896c950dc5e13f937a759a0ae931ab6a1950400000002886ad106eeb94bc15aeb03e20035e770974192bc30e0fe220d9c5cc36ff86714769393cdb007dd260eb838f325869ccd54d2c885b39daf70d4aec0a3f1b7309 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6457B151-B10A-11EE-9CB1-72CCAFC2F3F6} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Az94cU.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2980 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\XWX354.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe
PID 2980 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\XWX354.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe
PID 2980 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\XWX354.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe
PID 2980 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\XWX354.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe
PID 2980 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\XWX354.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe
PID 2980 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\XWX354.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe
PID 2980 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\XWX354.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe
PID 1916 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe
PID 1916 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe
PID 1916 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe
PID 1916 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe
PID 1916 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe
PID 1916 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe
PID 1916 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe
PID 1552 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe
PID 1552 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe
PID 1552 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe
PID 1552 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe
PID 1552 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe
PID 1552 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe
PID 1552 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe
PID 944 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 944 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files\Internet Explorer\iexplore.exe

Processes

C:\Users\Admin\AppData\Local\Temp\XWX354.exe

"C:\Users\Admin\AppData\Local\Temp\XWX354.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://steamcommunity.com/openid/loginform

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://instagram.com/accounts/login

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2664 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2608 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2592 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2456 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1636 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2676 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2584 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2712 CREDAT:275457 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://twitter.com/i/flow/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.paypal.com/signin

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.linkedin.com/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.epicgames.com/id/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://store.steampowered.com/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.facebook.com/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://accounts.google.com/

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Az94cU.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Az94cU.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 www.linkedin.com udp
US 8.8.8.8:53 store.steampowered.com udp
US 8.8.8.8:53 www.paypal.com udp
US 8.8.8.8:53 steamcommunity.com udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 instagram.com udp
US 8.8.8.8:53 www.epicgames.com udp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 twitter.com udp
US 8.8.8.8:53 www.linkedin.com udp
GB 104.103.202.103:443 steamcommunity.com tcp
GB 104.103.202.103:443 steamcommunity.com tcp
US 13.107.42.14:443 www.linkedin.com tcp
US 13.107.42.14:443 www.linkedin.com tcp
US 8.8.8.8:53 www.facebook.com udp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
US 151.101.1.21:443 www.paypal.com tcp
US 151.101.1.21:443 www.paypal.com tcp
US 142.250.27.84:443 accounts.google.com tcp
US 142.250.27.84:443 accounts.google.com tcp
US 104.244.42.129:443 twitter.com tcp
US 104.244.42.129:443 twitter.com tcp
IE 163.70.147.174:443 instagram.com tcp
IE 163.70.147.174:443 instagram.com tcp
US 92.123.241.50:443 store.steampowered.com tcp
US 92.123.241.50:443 store.steampowered.com tcp
US 34.231.188.151:443 www.epicgames.com tcp
US 34.231.188.151:443 www.epicgames.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 216.239.32.29:80 pki.goog tcp
US 216.239.32.29:80 pki.goog tcp
GB 142.250.200.46:443 www.youtube.com tcp
GB 142.250.200.46:443 www.youtube.com tcp
GB 142.250.200.46:443 www.youtube.com tcp
GB 142.250.200.46:443 www.youtube.com tcp
GB 142.250.200.46:443 www.youtube.com tcp
GB 142.250.200.46:443 www.youtube.com tcp
US 8.8.8.8:53 www.paypalobjects.com udp
US 8.8.8.8:53 community.cloudflare.steamstatic.com udp
US 8.8.8.8:53 static.licdn.com udp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 8.8.8.8:53 store.cloudflare.steamstatic.com udp
US 104.18.42.105:443 store.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 store.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 store.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 store.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 store.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 store.cloudflare.steamstatic.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 8.8.8.8:53 www.instagram.com udp
IE 163.70.147.174:443 www.instagram.com tcp
IE 163.70.147.174:443 www.instagram.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
US 8.8.8.8:53 t.paypal.com udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 8.8.8.8:53 facebook.com udp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
US 104.18.42.105:443 store.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 store.cloudflare.steamstatic.com tcp
IE 163.70.147.35:443 facebook.com tcp
IE 163.70.147.35:443 facebook.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 142.250.200.46:443 www.youtube.com tcp
IE 163.70.147.63:443 tcp
GB 142.250.200.4:443 tcp
GB 142.250.200.4:443 tcp
GB 52.84.143.44:80 tcp
US 8.8.8.8:53 ocsp.r2m03.amazontrust.com udp
GB 52.84.137.125:80 ocsp.r2m03.amazontrust.com tcp
US 44.198.12.190:443 tcp
GB 88.221.135.104:443 static.licdn.com tcp
US 92.123.128.161:80 www.bing.com tcp
US 92.123.128.161:80 www.bing.com tcp
US 92.123.128.167:80 www.bing.com tcp
US 92.123.128.167:80 www.bing.com tcp
US 92.123.128.167:80 www.bing.com tcp
US 92.123.128.161:80 www.bing.com tcp
US 92.123.128.167:80 www.bing.com tcp
US 92.123.128.161:80 www.bing.com tcp
US 92.123.128.161:80 www.bing.com tcp
US 92.123.128.161:80 www.bing.com tcp
US 92.123.128.181:80 www.bing.com tcp
US 92.123.128.181:80 www.bing.com tcp
US 92.123.128.181:80 www.bing.com tcp
US 92.123.128.181:80 www.bing.com tcp
GB 13.224.81.102:443 tcp
GB 13.224.81.102:443 tcp
US 92.123.128.181:80 www.bing.com tcp
US 92.123.128.181:80 www.bing.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
US 92.123.128.181:80 www.bing.com tcp
US 92.123.128.181:80 www.bing.com tcp
US 92.123.128.181:80 www.bing.com tcp
US 92.123.128.181:80 www.bing.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
US 8.8.8.8:53 play.google.com udp
FR 216.58.204.78:443 play.google.com tcp
GB 13.224.81.102:443 tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 udp
GB 88.221.135.104:443 tcp
IE 163.70.147.35:443 facebook.com tcp
IE 163.70.147.35:443 facebook.com tcp
GB 88.221.135.104:443 tcp
GB 88.221.135.104:443 tcp
US 8.8.8.8:53 udp
IE 163.70.147.63:443 tcp
IE 163.70.147.63:443 tcp
IE 163.70.147.63:443 tcp
IE 163.70.147.63:443 tcp
IE 163.70.147.63:443 tcp
US 172.64.145.151:443 tcp
US 172.64.145.151:443 tcp
GB 88.221.135.104:443 tcp
US 8.8.8.8:53 udp
US 3.162.19.24:80 tcp
GB 88.221.135.104:443 tcp
US 8.8.8.8:53 udp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
US 151.101.1.35:443 tcp
IE 163.70.147.35:443 facebook.com tcp
US 151.101.1.35:443 tcp
US 151.101.1.35:443 tcp
IE 163.70.147.35:443 facebook.com tcp
US 8.8.8.8:53 udp
GB 142.250.200.46:443 www.youtube.com tcp
GB 88.221.135.104:443 tcp
US 44.198.12.190:443 tcp
US 3.162.19.24:80 tcp
GB 88.221.135.104:443 tcp
GB 88.221.135.104:443 tcp
US 8.8.8.8:53 udp
GB 88.221.135.104:443 tcp
GB 88.221.135.104:443 tcp
GB 52.84.137.125:80 ocsp.r2m03.amazontrust.com tcp
GB 52.84.143.44:80 tcp
GB 52.84.143.44:80 tcp
US 104.244.42.129:443 tcp
GB 88.221.135.104:443 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
GB 88.221.135.104:443 tcp
GB 88.221.135.104:443 tcp

Files

\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe

MD5 b0ed43c2e36eef5315e914709af6cbd6
SHA1 9d77f0f494044784167934905457a2c85d0a519d
SHA256 53ec937528a4a03b4b042a010ef47fa0af9092c608777cbba8bea099ddafd613
SHA512 daf498873571da1a2377e2a186d39678dc796f5d33431dfc7b8c867142142e261238aebb86d19cf4d8cf0556b11a37f487a400e1ad08e3dfc33c2fbd70ea21e7

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1552-36-0x0000000002650000-0x00000000029F0000-memory.dmp

memory/2964-40-0x0000000000840000-0x0000000000BE0000-memory.dmp

memory/2964-39-0x0000000000840000-0x0000000000BE0000-memory.dmp

memory/2964-38-0x00000000011B0000-0x0000000001550000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe

MD5 67af0f82e73d455e50ffc01eb8d3552a
SHA1 970d3d45cd2c7f7a02c9ba1ce8e5e44567361273
SHA256 15733c41d8cff87c844d123412d5bde0836bb8bddea5536e1eca6a7fa314f2d1
SHA512 faec82f3767fab90bc7f9b4a19b5d7b611fa7d7fc35f9b4ca9d8a2af13828ae73cb348e15dc6a2e7916b6d618c064427eebc6e4ed56c089cd21407c91e8ae532

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe

MD5 0cd358db542a363728992656cf24b9bb
SHA1 839dab2e3cc095313078cfa94b9a0fa7b3d711dd
SHA256 576bc3c46ce9759c39aa0dd05cad0daffb675c151e114f14ade8167a6fe599e4
SHA512 1374863d22cbd91262d58cde9062976f24d42851cc58f8ae468f8fcfc237f221e43b01b68943a374a0370a5b58913eae562d0cec77c569b5f98cbb17d335fa47

\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe

MD5 3154943dd528dfb216d42dce9675d265
SHA1 8dd034a577b72e5db463e64c43ad9234d9ab1e91
SHA256 4ecfd7c21a0adea3747af8c7d6a8314a9058ae34d4517b0927c797f681b41cb5
SHA512 eaf57ee1e14460e08cf11bc5ced80fbbcd3e5db54df58fd69a5492c99abc08e3dc937d9f07aabd7448d986865a1c9f989233d820c8343b22850929c96dc39c0e

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe

MD5 09cd231baa15a64e3ebc806fe69981cf
SHA1 5de6cf3becae63329471ecd8d1f53a3b3f5ad6dc
SHA256 feb504059f21ff7d2e0b40f5729d3ae329a5e1514bff330535cbc464a88b1672
SHA512 890bf7370381075b75a2e81c7e8ba99bb0d2008efb723ef4bab64b9ad13771c56aaae41299448f8fce35727b00c48f0d80f5fe4c3c7ca79398695c8f5e9b6be9

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe

MD5 f30ed852a4239fc8ecc9f6b656ed863e
SHA1 a031fc02ebd2abd02414b9bceff37bc3a469aa7b
SHA256 1c4b8ebbe159d1ade4a9d25300775f862d2ec4fbb6b69a4ac885b5aede150c27
SHA512 5201edff8dbb59e5c713a03ac90f88528953c952482218d996a0bff0c75fa24af32758b94d39354ee036ca47ae1dffd58ecfcee9d136e6268f0b075cb8960573

\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe

MD5 34170ab508cf69125b60fcfae142a26b
SHA1 a0d642386572446fe637335523c0f0c4d0459327
SHA256 288114625b46381b655faa2778006bb1805d096e4b677103724b74c51cb0a89f
SHA512 7468fd64105e945155225d94e7fac1ca5121499974690aa817bcb122872757cc073298448342c1099d77f57a4a7ee4698d9de334b2ffe2ff3ee84c138388636d

\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe

MD5 4dd2bae9da28965ca6fbd000b16111b9
SHA1 2f6dc1cdb0dd5444002b96b9a1f202ce1034e6b3
SHA256 d978d6f1c025f7760af2532f48e95ce55dbbe8deb8e6eb3559fcf218069df3f5
SHA512 e42dd76bbdf2e37c96fcdfe40bb5c9b6516747961e724b330bf314ab22779d7486be39b1f96696ece2784e0b535381c3f13e0178d5034edb4090fd9cb85dd564

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe

MD5 03f556f490287b60c1800e651e858139
SHA1 38e2cb7e1ab1930b6da1a6ec6923163f7c8cdb52
SHA256 2dd072079178e0a76de26339188c04f4748e235fce29e43971afeb0921adfde7
SHA512 b77d23f8079017777a4e133b07a01d83d9fb5da103a6454e43ccbd7039148857e2ec17f3d0c6f424277a2bd8b2158ef1519afc4d65162285bbc4adc89fc56663

memory/3208-2881-0x0000000000280000-0x0000000000796000-memory.dmp

memory/3208-2885-0x0000000001130000-0x0000000001646000-memory.dmp

memory/1916-2880-0x0000000002780000-0x0000000002C96000-memory.dmp

memory/1916-2879-0x0000000002780000-0x0000000002C96000-memory.dmp

memory/2964-2874-0x0000000000840000-0x0000000000BE0000-memory.dmp

memory/3208-2999-0x0000000000280000-0x0000000000796000-memory.dmp

memory/1916-3000-0x0000000002780000-0x0000000002C96000-memory.dmp

memory/3208-3003-0x0000000000280000-0x0000000000796000-memory.dmp

memory/1916-3002-0x0000000002780000-0x0000000002C96000-memory.dmp

memory/3208-3001-0x0000000000280000-0x0000000000796000-memory.dmp

memory/3208-3004-0x0000000000280000-0x0000000000796000-memory.dmp

memory/3208-3005-0x0000000000280000-0x0000000000796000-memory.dmp

memory/3208-3006-0x0000000000280000-0x0000000000796000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1c6613e67558a8494a8a0fa01297e5eb
SHA1 af810e336bf43863d0387ec61e47aa8ef49b4891
SHA256 6f222f371f4652815f1df4e92c325c3faa508edfe9344ba130662612740fc4a2
SHA512 cd3696d957f14618bb4973ffb49019c76cc07ae55103858334783e4d5e3ab92a3d902d5b2f245f772c89225afeb8ed052a96dc5e40a855ff044486c46bbfa6af

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2b9952f2489fb3f125007be77ef62055
SHA1 61c6562e8e2b190240cb38e7f2f33f4071d31fff
SHA256 b02ed6997206ce1c4acd1e5a95ffdbba630f9f2f3a19b8ce679b91b059d3ef85
SHA512 0daae7af69d43beaa3deca88a603419f8d5a3ccb124e8ef2c737e12d9212951cd67a35bc5411087b1d55bbc423843fc8cc6ff70a37e87d10595709139cf5053a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 82a7a90077a0947467598cf6be926b6e
SHA1 c0326dd67190f24164dede63f77254e7f921d41c
SHA256 8e301772780e4a1ae64e2a30f96568d5a8463c6bdb44f85e78d40b5f7e9e2ca0
SHA512 2c1028db380b18f26d5c87f407ff8d18a4e73c151a6a028285f0bd28e09696b34201820966c30bee7e54466d9a07733a330328c9f456382e4985a5e33bd0f157

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cabfc482835031b6209c9fe5ff630bd2
SHA1 2b2df9666dcdc830e3bfc30c193088bc4a3aa687
SHA256 1fb59a57e155c99a65e28d20640439788e19fe4cbd38c959020be558765a75b5
SHA512 b8702dfc5104908186ec0736b3c8b312c0cce7337ddf74d3bfbc6b5ab7296a54c797fa3aeb3e3b0ba4276e46ba149b545fc5c1f1fc631e0f9db358e6338b8d1b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b4f3872cb9787ef7dd82d0d73e8063d5
SHA1 a677e254f914284ae9725c3df48c40ae74f6038e
SHA256 677bc0d5bd5a1bb1ce3a31be48b7d7bcc4e04346292eeefd1155c493cb9aa58a
SHA512 401124a7b84959a425bcfd1a72c29a85097a1d48523dafc14e45e06eb65daa5d640b231f18d33e408c73745929d7dafa9834df0a6f31b7838301bc04d1549020

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1699bb036c11331ac12c116082855d34
SHA1 f0f617c3dcd350f40f36a6cfbb72cd7ef48c7612
SHA256 98ff2cc89e4600c82551d388fcfdb0bc8b4ef6ed0efd5e2afb2a6a5b5acf2154
SHA512 a7c5bcc728ecf6e03d449bb3ac506b14b0e16d4b57505e8786c729fec42f6ab7c12d174056dbbd5f36980bd614253dbd230ffa934b915c9314a9dc7de9449ae2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 07845700c1184e11a62bd9f198eeabc3
SHA1 1945a0fcc807ba73d19b6d1eeb2067d2eb382d4c
SHA256 5476b831c6d2c10ce959a56f2d3f2d7b111d3d6b508ea812a0636fad75b5ed6f
SHA512 ab9ab59b3d8dbda661e0e7fd2d918b4ba276c2d051ce9c41c7aafe988a8c9bfc3099131141e56967bfb5448369d097f01e7dffa74958da669a7dacd32ba3ae4b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3e3077d9dc35171b3b5dfe72ab015122
SHA1 5e0dfa167de68ccf842178c2c3fb27dd231ff2c9
SHA256 566951c4deb56c6ebd1fcffbb7d5c6f2d4921311a0ec72e26d47790d668bf9ff
SHA512 7081deec240aee6d7459b3fdfe281690c8183e4cb50312a127e70de39d7cc06ed5f5b6cacdc774601c4f682fde8ab8be7bc0755bf300b804126ae94fc948d58d

memory/3208-3435-0x0000000000280000-0x0000000000796000-memory.dmp

memory/3208-3436-0x0000000000280000-0x0000000000796000-memory.dmp

memory/3208-3437-0x0000000000280000-0x0000000000796000-memory.dmp

memory/3208-3438-0x0000000000280000-0x0000000000796000-memory.dmp

memory/3208-3439-0x0000000000280000-0x0000000000796000-memory.dmp

memory/3208-3440-0x0000000000280000-0x0000000000796000-memory.dmp

memory/3208-3441-0x0000000000280000-0x0000000000796000-memory.dmp

memory/3208-3442-0x0000000000280000-0x0000000000796000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-12 05:21

Reported

2024-01-12 05:23

Platform

win10v2004-20231215-en

Max time kernel

153s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\XWX354.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe N/A

RisePro

stealer risepro

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\XWX354.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Detected potential entity reuse from brand paypal.

phishing paypal

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3073191680-435865314-2862784915-1000\{7142F1AA-3D1D-43E4-8F4E-2B4EC0937CD3} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Az94cU.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1028 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\XWX354.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe
PID 1028 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\XWX354.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe
PID 1028 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\XWX354.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe
PID 400 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe
PID 400 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe
PID 400 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe
PID 1384 wrote to memory of 3784 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe
PID 1384 wrote to memory of 3784 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe
PID 1384 wrote to memory of 3784 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe
PID 3784 wrote to memory of 724 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3784 wrote to memory of 724 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3784 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3784 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3784 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3784 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3784 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3784 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3784 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3784 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 724 wrote to memory of 3184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 724 wrote to memory of 3184 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2896 wrote to memory of 3904 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2896 wrote to memory of 3904 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2036 wrote to memory of 4548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2036 wrote to memory of 4548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1064 wrote to memory of 3532 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1064 wrote to memory of 3532 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2368 wrote to memory of 3372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2368 wrote to memory of 3372 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3784 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3784 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1608 wrote to memory of 1648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1608 wrote to memory of 1648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3784 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3784 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1636 wrote to memory of 2648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3784 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3784 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 376 wrote to memory of 972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 376 wrote to memory of 972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3784 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3784 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1600 wrote to memory of 2552 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1600 wrote to memory of 2552 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3784 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3784 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2364 wrote to memory of 3488 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2364 wrote to memory of 3488 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1384 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe
PID 1384 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe
PID 1384 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe
PID 2364 wrote to memory of 5536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2364 wrote to memory of 5536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2364 wrote to memory of 5536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2364 wrote to memory of 5536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2364 wrote to memory of 5536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2364 wrote to memory of 5536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2364 wrote to memory of 5536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2364 wrote to memory of 5536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2364 wrote to memory of 5536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2364 wrote to memory of 5536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2364 wrote to memory of 5536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2364 wrote to memory of 5536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\XWX354.exe

"C:\Users\Admin\AppData\Local\Temp\XWX354.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x16c,0x170,0x174,0x140,0x144,0x7ff9b65a46f8,0x7ff9b65a4708,0x7ff9b65a4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff9b65a46f8,0x7ff9b65a4708,0x7ff9b65a4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff9b65a46f8,0x7ff9b65a4708,0x7ff9b65a4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff9b65a46f8,0x7ff9b65a4708,0x7ff9b65a4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff9b65a46f8,0x7ff9b65a4708,0x7ff9b65a4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.linkedin.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff9b65a46f8,0x7ff9b65a4708,0x7ff9b65a4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x80,0x16c,0x7ff9b65a46f8,0x7ff9b65a4708,0x7ff9b65a4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff9b65a46f8,0x7ff9b65a4708,0x7ff9b65a4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff9b65a46f8,0x7ff9b65a4708,0x7ff9b65a4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://instagram.com/accounts/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x16c,0x170,0x174,0x148,0x178,0x7ff9b65a46f8,0x7ff9b65a4708,0x7ff9b65a4718

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,6330642082959698021,12642440327979802686,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11512732387313642776,18064247357994752977,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,6330642082959698021,12642440327979802686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,16923694148640307215,14184931463756057120,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,11512732387313642776,18064247357994752977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,13401564150997341035,8029878341283780876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,16352308583219332114,1796976595746050159,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,9175523456050636855,8055377850718722917,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9175523456050636855,8055377850718722917,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,13401564150997341035,8029878341283780876,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,16923694148640307215,14184931463756057120,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,12540498064392076560,6949699442344803053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,3822082291246879636,230754007310451876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,3044304904826936906,10912100745140246686,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12540498064392076560,6949699442344803053,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,3822082291246879636,230754007310451876,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,3044304904826936906,10912100745140246686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,16352308583219332114,1796976595746050159,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4324 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4472 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4300 /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x2fc 0x4cc

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Az94cU.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Az94cU.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7424 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9136 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5140 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8800 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8720 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9672 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9672 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8956 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8780 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5068 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8144 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8056 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15837397547529272855,1752983957923685127,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6928 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 store.steampowered.com udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 www.linkedin.com udp
US 92.123.241.50:443 store.steampowered.com tcp
IE 163.70.147.35:443 www.facebook.com tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 13.107.42.14:443 www.linkedin.com tcp
US 8.8.8.8:53 instagram.com udp
US 8.8.8.8:53 steamcommunity.com udp
US 8.8.8.8:53 accounts.google.com udp
IE 163.70.147.174:443 instagram.com tcp
GB 104.103.202.103:443 steamcommunity.com tcp
US 8.8.8.8:53 www.paypal.com udp
US 142.250.27.84:443 accounts.google.com tcp
US 8.8.8.8:53 50.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 35.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 14.42.107.13.in-addr.arpa udp
US 8.8.8.8:53 103.202.103.104.in-addr.arpa udp
US 8.8.8.8:53 174.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 84.27.250.142.in-addr.arpa udp
US 151.101.1.21:443 www.paypal.com tcp
US 8.8.8.8:53 twitter.com udp
US 8.8.8.8:53 www.epicgames.com udp
US 104.244.42.129:443 twitter.com tcp
US 8.8.8.8:53 www.youtube.com udp
US 54.197.168.29:443 www.epicgames.com tcp
US 8.8.8.8:53 21.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 129.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 29.168.197.54.in-addr.arpa udp
US 142.250.27.84:443 accounts.google.com udp
US 8.8.8.8:53 www.instagram.com udp
GB 142.250.200.46:443 www.youtube.com tcp
GB 142.250.200.46:443 www.youtube.com tcp
GB 142.250.200.46:443 www.youtube.com tcp
US 8.8.8.8:53 46.200.250.142.in-addr.arpa udp
GB 142.250.200.46:443 www.youtube.com udp
US 8.8.8.8:53 i.ytimg.com udp
GB 172.217.169.86:443 i.ytimg.com tcp
US 8.8.8.8:53 46.10.230.54.in-addr.arpa udp
US 8.8.8.8:53 86.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 234.187.250.142.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 community.akamai.steamstatic.com udp
GB 104.77.160.220:443 community.akamai.steamstatic.com tcp
GB 104.77.160.220:443 community.akamai.steamstatic.com tcp
GB 104.77.160.220:443 community.akamai.steamstatic.com tcp
US 8.8.8.8:53 store.akamai.steamstatic.com udp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
US 8.8.8.8:53 apps.identrust.com udp
GB 96.17.179.205:80 apps.identrust.com tcp
GB 96.17.179.205:80 apps.identrust.com tcp
US 8.8.8.8:53 220.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 www.paypalobjects.com udp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 8.8.8.8:53 rr2---sn-aigzrne7.googlevideo.com udp
GB 74.125.4.167:443 rr2---sn-aigzrne7.googlevideo.com tcp
GB 74.125.4.167:443 rr2---sn-aigzrne7.googlevideo.com tcp
GB 74.125.4.167:443 rr2---sn-aigzrne7.googlevideo.com tcp
GB 74.125.4.167:443 rr2---sn-aigzrne7.googlevideo.com tcp
US 8.8.8.8:53 200.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 205.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 25.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 167.4.125.74.in-addr.arpa udp
GB 74.125.4.167:443 rr2---sn-aigzrne7.googlevideo.com tcp
GB 74.125.4.167:443 rr2---sn-aigzrne7.googlevideo.com tcp
GB 74.125.4.167:443 rr2---sn-aigzrne7.googlevideo.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
GB 142.250.178.10:443 jnn-pa.googleapis.com tcp
GB 142.250.178.10:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 10.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.200.4:443 www.google.com tcp
US 8.8.8.8:53 tracking.epicgames.com udp
US 8.8.8.8:53 static-assets-prod.unrealengine.com udp
US 8.8.8.8:53 api.twitter.com udp
US 8.8.8.8:53 abs.twimg.com udp
US 8.8.8.8:53 api.x.com udp
US 44.198.12.190:443 tracking.epicgames.com tcp
GB 13.224.81.102:443 static-assets-prod.unrealengine.com tcp
GB 13.224.81.102:443 static-assets-prod.unrealengine.com tcp
US 104.244.42.66:443 api.x.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 8.8.8.8:53 t.co udp
US 8.8.8.8:53 video.twimg.com udp
US 104.244.42.130:443 api.x.com tcp
US 8.8.8.8:53 pbs.twimg.com udp
US 104.244.42.5:443 t.co tcp
US 192.229.220.133:443 video.twimg.com tcp
US 192.229.233.50:443 pbs.twimg.com tcp
US 8.8.8.8:53 102.81.224.13.in-addr.arpa udp
US 8.8.8.8:53 4.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 66.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 141.21.199.152.in-addr.arpa udp
US 8.8.8.8:53 130.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 133.220.229.192.in-addr.arpa udp
US 8.8.8.8:53 190.12.198.44.in-addr.arpa udp
US 8.8.8.8:53 50.233.229.192.in-addr.arpa udp
US 8.8.8.8:53 youtube.com udp
GB 142.250.178.14:443 youtube.com tcp
US 8.8.8.8:53 www.recaptcha.net udp
US 152.199.21.141:443 abs.twimg.com tcp
US 8.8.8.8:53 14.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 5.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 static.licdn.com udp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 172.217.16.227:443 www.recaptcha.net tcp
US 8.8.8.8:53 23.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 104.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 facebook.com udp
US 8.8.8.8:53 static.cdninstagram.com udp
IE 163.70.147.63:443 static.cdninstagram.com tcp
IE 163.70.147.63:443 static.cdninstagram.com tcp
IE 163.70.147.63:443 static.cdninstagram.com tcp
US 8.8.8.8:53 63.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 zn1ynnliufrct75cb-paypalxm.siteintercept.qualtrics.com udp
US 104.17.208.240:443 zn1ynnliufrct75cb-paypalxm.siteintercept.qualtrics.com tcp
US 8.8.8.8:53 240.208.17.104.in-addr.arpa udp
GB 172.217.16.227:443 www.recaptcha.net udp
US 8.8.8.8:53 fbcdn.net udp
IE 163.70.147.35:443 fbcdn.net tcp
US 8.8.8.8:53 fbsbx.com udp
GB 142.250.200.4:443 www.google.com udp
US 8.8.8.8:53 t.paypal.com udp
US 151.101.1.35:443 t.paypal.com tcp
US 8.8.8.8:53 35.1.101.151.in-addr.arpa udp
US 142.250.27.84:443 accounts.google.com udp
US 8.8.8.8:53 ponf.linkedin.com udp
US 144.2.9.1:443 ponf.linkedin.com tcp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
US 8.8.8.8:53 1.9.2.144.in-addr.arpa udp
GB 104.77.160.220:443 store.akamai.steamstatic.com tcp
GB 104.77.160.220:443 store.akamai.steamstatic.com tcp
GB 104.77.160.220:443 store.akamai.steamstatic.com tcp
GB 104.77.160.220:443 store.akamai.steamstatic.com tcp
US 8.8.8.8:53 login.steampowered.com udp
GB 104.103.202.103:443 login.steampowered.com tcp
US 8.8.8.8:53 platform.linkedin.com udp
US 152.199.22.144:443 platform.linkedin.com tcp
US 8.8.8.8:53 144.22.199.152.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
FR 216.58.204.78:443 play.google.com tcp
FR 216.58.204.78:443 play.google.com tcp
FR 216.58.204.78:443 play.google.com udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 78.204.58.216.in-addr.arpa udp
FR 216.58.204.78:443 play.google.com udp
US 8.8.8.8:53 sentry.io udp
US 35.186.247.156:443 sentry.io tcp
GB 142.250.200.4:443 www.google.com udp
US 8.8.8.8:53 156.247.186.35.in-addr.arpa udp
US 8.8.8.8:53 stun.l.google.com udp
US 8.8.8.8:53 api.steampowered.com udp
GB 104.103.202.103:443 api.steampowered.com tcp
US 142.251.29.127:19302 stun.l.google.com udp
US 142.251.29.127:19302 stun.l.google.com udp
US 8.8.8.8:53 127.29.251.142.in-addr.arpa udp
US 104.244.42.66:443 api.x.com tcp
US 104.244.42.66:443 api.x.com tcp
GB 13.224.81.102:443 static-assets-prod.unrealengine.com tcp
GB 13.224.81.102:443 static-assets-prod.unrealengine.com tcp
US 35.186.247.156:443 sentry.io udp
US 8.8.8.8:53 talon-website-prod.ecosec.on.epicgames.com udp
US 104.18.41.136:443 talon-website-prod.ecosec.on.epicgames.com tcp
US 8.8.8.8:53 136.41.18.104.in-addr.arpa udp
US 8.8.8.8:53 talon-service-prod.ecosec.on.epicgames.com udp
US 104.18.41.136:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 104.18.41.136:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 104.18.41.136:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 8.8.8.8:53 js.hcaptcha.com udp
US 104.19.218.90:443 js.hcaptcha.com tcp
US 104.19.218.90:443 js.hcaptcha.com tcp
US 8.8.8.8:53 90.218.19.104.in-addr.arpa udp
US 8.8.8.8:53 newassets.hcaptcha.com udp
US 8.8.8.8:53 api.hcaptcha.com udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 10.179.89.13.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VK6jT60.exe

MD5 79677f25db8981051d0d3f9102933e5f
SHA1 154dfa2f82d3be353927bcc58011af56cbe2c241
SHA256 3c507cb622761a88e6dc13141924ed563407ecf0c7561c053f0a74d0fec4754c
SHA512 f4af81d78735d60259682367f0c6385d2140621742021794c846efadedf6d0fccbd7e57fc310176554cad4d7fcd8fcb284a9762492404bf53aedacb343b9fce5

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cG3SL42.exe

MD5 f542e37504cc37abc9aa48918b051d96
SHA1 b4947190dd1a9ee2aa96b00741e764d3c5d7e79f
SHA256 f617271ae69d6fc428e0da2dadad234ebfda20c169bee9e0c51efb1d58eb1c50
SHA512 0d922a455d26a0c33cd66b9a9010e475ae88c2176fcb86f8de084ac19158578aeb8eba60f8626c67fe3489cb87d8807bd6793efe70db457e77380c73ed0d37e9

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1yz50pA1.exe

MD5 9a6ed7956976378c8c67f4d162b80021
SHA1 a8a9ad421d924c153d1194cd8180c1980f96a9a4
SHA256 f7f44398428701dff7cc9b40938b926915810a1c97a58495ac2ba0fc08740154
SHA512 58155fe01f9ac25422ceedb5d8e5d347d13e33d2bf9e0643a4d8ab5d62817d84a91cf9dc582c94273c45d5dc59ca671e571a9bf42c8a33fb2f3774d402e99590

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 b810b01c5f47e2b44bbdd46d6b9571de
SHA1 8e3d866cf56193ca92a9b74d1c0e4520b5a74fdc
SHA256 d1100cf9e4db12cc60cce6e0e2e3d9697e762c219f6068eb55a1390777bf4b45
SHA512 6bbf900b2f7614dd17aa6d5febe3ad1100851e2309ba2cd5219c5aa5af7bf830eec2cc88071d37987aa7e3f527b8df5b2d85e8b21b18fcb071baaab1a2eadae2

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2fi2830.exe

MD5 09ad33bc3340bb460945f52fc64d8104
SHA1 8961fb7b80dd09fb1f7936e1a488340076d241b3
SHA256 a3cf01cc1676f1ed1b8c99e0fec006243eee183afbf9f9d798e4730fa7eac4e5
SHA512 2c39399642bd76f6912a57b7ab743752bb678eb8a85e8f53499403818984c3c750e4dedeb13ea179076211a351a74f5f3656003b928cdcbf2917f4fe0a1079b7

memory/2440-43-0x00000000003D0000-0x0000000000770000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 efc9c7501d0a6db520763baad1e05ce8
SHA1 60b5e190124b54ff7234bb2e36071d9c8db8545f
SHA256 7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a
SHA512 bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

\??\pipe\LOCAL\crashpad_1064_SYBZIITHPVVJIFIT

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2440-142-0x00000000003D0000-0x0000000000770000-memory.dmp

memory/2440-140-0x00000000003D0000-0x0000000000770000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4c4aa22b-c08a-4f20-b925-e4db589b2d71.tmp

MD5 6fba7f5b894e871b5b0fac75ab5e19be
SHA1 c7220eaf34e196f291c45d536fb7254c87cb5418
SHA256 a66cd7c09255fd80999baede092915f380324b0f795d21f89fd009c168563a63
SHA512 d2d503eb0dc08a3775cd69ee9fcbfc7ab667b2b209bb39b19635d2e1852fa87fe4e2d6b27c54e88a9a983f7b1b0be7b69bcb7695b69c5ceb27be0ca7c2699516

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\07771b52-1ec7-45bc-b8a6-cafb55a07fb5.tmp

MD5 4fce809beab543731b7a44e7eeb273ae
SHA1 e5a8b01cf0cd769214bb0ad904f1ff3d2ee6acf9
SHA256 58a47bdefd37540f13e4722135ae6044d35012ba0b8048f673b0e3ae4026b0ce
SHA512 0687b2315fe31aa014461f99af65c8d79e5793a397630e68cc2dea3387ebe6861bf467cccc807097ea8baba9ff066f36515804e23cd28191bc737fc5ca38df78

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 9d0379d9e49dac9433562702ee752bde
SHA1 3bf6b1d916e77e84651fcee0dbcf149ddfc1d838
SHA256 ae4e669455d21e1405f6b288c940f145410ad9abaa9f5345f5d5582875254fd4
SHA512 03958a22bd6ed66033fb1f4d619ad824857a27ce81170316cd4e9a750819f82f6158833726f130dc0826bf586eb98f200528402ef0c2a84e76322752ac34dc49

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 e7137aa8eff09d5a9b84803e88225c5d
SHA1 b7f5f53645bdbadec0f87e07f9e76c9bea9aeb90
SHA256 dcdefee0edcf97149ac80ae99cde09324143c83727b7fa779186daa61bbe3855
SHA512 b477207bcbff6a1098e12f12f1ecbe992f710b155661af4e4edc49bc0f53adf8524ed3e4c32c3fcd28ec9e0d7cb19da4005ed40d1836b0289dd75cac807fd37f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 648b7c801d5c35f558a7136125d5fcc6
SHA1 851d28561d0872ea755036385f5dcea13e7d5cbf
SHA256 9227c3eef8ffd347bfa1960abbe661a41e77c98fef89bcf30c1d5a24d9ccb1eb
SHA512 f893bb50b847e87cf2fda566b898021558d2716ca5ca1cada7a35cf400717b0ded45d4258c884d9e58ebb1d78d314db3386c8498059344ad9d6f19bab81a3b4a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 294418cd5919071d5de712f840a6d3e4
SHA1 037db803fae0cfcb7e26697fb64955ffe4041c70
SHA256 2f9144654b7142b18773cb2f78abda261034b046dd82a59cece9362e0f55db9b
SHA512 78903694ff2a70bf2df73568d554ef48a37fc8bb51079a6a66335113eead2bf534a648666fd635c5e2a3bf66d2dfeaff5fc0ddc9bd34b523001ed43d54d80bcc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 3d6051d0f6e53d170a0bae11e97a3602
SHA1 6a70aca9876d856a7b0b409e0db570360aec7119
SHA256 b595a844f371509fce8ea2b2d858854c54f492e56912a3bd5c7bb035b31b9dd7
SHA512 803ce4bbe5f0d29eb4c62a252d89f4a3dd2a5adc69752af25b535c6411eb33b15663b721dbb48b8a63d3804e1894e260d88f929d0cc4eecbeffafb570be89ee7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 8ddcce8df4d95dea7ddd9327da735f81
SHA1 07bab942379458269f2d228d95d726d39857997f
SHA256 6f648da444f6b4e34e34a2472e2a7c7fd221f46b4c510dbf3b0cfee33132cd6f
SHA512 db79e6ad309a32b59d5091cdae9973436de2ae0930486a94f4d508a73bca8e09af7d8c9fbaa386d2a18e3dbd2f3828624219aacb220a8091df2e024f31de8923

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 9e0b704777772712642b935466eef930
SHA1 247f63a0475a93fb3fd78ad0999c069b94a9979b
SHA256 a4d0aa1407adc99d975065b22e71208dd6f534e497009dc9f9586cd7710d4310
SHA512 e0e093f1a0b99f14714307d7317a1678bb359c75e63bde83725ea9d15f87a2e04385340d0e4acdc614ef6b82c41bb0c85caf383b3f9a8ed4ce52786f7c1eb7c4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 4ef38ae49d04176ffa756884dfbab49c
SHA1 ce6d34d121ab82869488512788ee6db33a57709f
SHA256 0dfa3272fea83404d2400261f604e53f1e417e9201154b72e2dc0c0e25f808f0
SHA512 4bfd07e8340a675761442e34e546ad390da4af2f3cb30e9b772f53b9faffcaa76f1f406b7c6f7ee725d03d76604aa6941401fda49a6f20ad33a9296ae1f9996c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 21a04151f55e47f67acc95fd70c72240
SHA1 fe23714d8ec24c6a4668c314493c6fa282d02766
SHA256 a1384d680832eb955d76f8d5bcccd3546b9a749290058ef92244e2077cd37afe
SHA512 e4cb60c509281c7ad3dbd58285f3e2720bb6366a77d4cdaf7455efde039331def28dcce9f54ff83ba273174bb00c5ad2c762408733078a873515b20880e34c15

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 a6a396e75836d07aa694507f4369fddc
SHA1 4a5cda9273d89e250245a6f0498c74bf1d90f949
SHA256 5c7fa1c0ae4ca9b2dc28bec4a0f69eef866e27ea568e0ecec624a26505a7a00a
SHA512 9a9721dced7958fa29c17feb8e81405162fee4802a23ce4c65dc94f5187553d6a89fea3b478224e8630687199f043eaa311f66e91fcdedcc49b4f7146140fbba

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 66d21b7019c364a0986d34c47f46a75e
SHA1 4eac3a662962294085ed77c41094bdde8af5bc69
SHA256 84e9c08232e29953210741d9f950697b40d3569303c9484c926023f01ebb36bc
SHA512 c6189c85d6b4782743335c3b0047f1c78460244a210e8dda64891bfb33342cd4d6a9c3350fd432e1cf1c4f7ce8b4202c38720afce694b91f7a0a571178b94883

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 011c0351133765eaacbfdb2b9a2debc0
SHA1 dcd2bedb46a5ad25684011763402fdee87987778
SHA256 1216162ff43039070a6a90380700d10d8a7c95aede7cdb4659aa3853416d8ef1
SHA512 0e363f852deb2b01d14c7ea43c5d2bd6d1fd1eef6a8182b8a454bd93e67191afe798091acaaac21968d696ab309d26ea42743322b49b558d0f2f15fb4169aaa0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

memory/2440-410-0x00000000003D0000-0x0000000000770000-memory.dmp

memory/8212-423-0x0000000000E50000-0x0000000001366000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b08695105b5fb793414a26b1a700996e
SHA1 b104a8f8ff195a6c7d763d2de851e7a69f1ccb05
SHA256 de5dd2d683600bfd9cd8ea885365f0372746e726c71db1b03110a58a6fdbd29a
SHA512 4a5008caa16a6aa0aae64a0085ae684bcae97d57313842710b51848051ed3cb23c5a760fdb41dbad5c54813c97545092e22b10bdd3382bf671bc8f85d9f3aff0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 121510c1483c9de9fdb590c20526ec0a
SHA1 96443a812fe4d3c522cfdbc9c95155e11939f4e2
SHA256 cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c
SHA512 b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 35593b335dae5776d2c6d8aab2af2771
SHA1 d9720a02826cdc837fb863c15b26bc7a223aea17
SHA256 58f817cce31aad9c14ca0ba7a495a1bfd2a641c8b6bb2b9d3fc3ff350e680bac
SHA512 dbd3556cc367926cc4045cbb9ee1ceb730317eedb0085af979830bb4ed65a57d66b2ee91a38745d2122344169cfe6873d38ec030b29285cf66b17487fb4c01a8

memory/8212-705-0x0000000000E50000-0x0000000001366000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 aec4384b5a6c8b9ce5916b8bc9da8bac
SHA1 c7ad7a9feca8174f411386f9949279fd46cb30cb
SHA256 c9788879b3100e3ef8bd02d72532a0f771d3650239cd74e65ab7d1168b827e46
SHA512 c095064193334d7f1b461c5a00c13f604032fbc3dc6323d084565140fa00a0edc999693d88d9639dd23fc9886a4bfc219681a06e09a4d1dfa35a96635e686bff

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d3d5.TMP

MD5 85687933cccde2811e94720f5f3dddf0
SHA1 274cba38a9f26bd1fb0ca7f10b600d3d77421ada
SHA256 551c7e70bb1c52ba53bcd7f638eff5fbf137a5ba2c9a6893e1409dd2847ea764
SHA512 637f006b771a3560c0e5cb3acb2c232544f9b415a90a7ae1edbfe6fa9e08b9d4ee6aac0f53b52e5aafe5c5dd47c0a46495ad91f254689afb2aeb546bb0ac893f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b26111854920b36e594e7b63fc18b367
SHA1 bfe72567a733765e7ac39f98015de82538e90234
SHA256 43a5de447d4f3fa4d07e02ef6aa2cb65e2d7dc8ba2aff84acb39c349db595fd1
SHA512 af38f472252c362ad1862b6d482254732f2b65e605ec638fa1001b93c9ecd1d75a710069042edeeb21051e28fbb1f50ce123c6250ab772395ab2fbdf21980db5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

MD5 e3038f6bc551682771347013cf7e4e4f
SHA1 f4593aba87d0a96d6f91f0e59464d7d4c74ed77e
SHA256 6a55e169bc14e97dfcd7352b9bc4b834da37dd1e561282d8f2cc1dbf9964d29a
SHA512 4bee876cea29ad19e6c41d57b3b7228f05f33f422e007dc1a8288fd1a207deb882c2789422e255a76c5bf21544f475689e7192b9a8a80dc2e87c94ee0bc6d75f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 498f3bfbcac5b6313f48156f739af08c
SHA1 606903cf25bb19fc138550ba38e94d8dd20b285b
SHA256 8838dabec3381680572c1c245228a69115f317ed13ccae547b7aa0c3b7556045
SHA512 706216109acfaf35f76f6cba64212b45691f5d4d4f5280e3c6bf3f851a21c2d2f98fa7dfe68f42a54ec2bd6ecd7af1cdb559391d6f190062ea454ba1fb949bea

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ec6e.TMP

MD5 840b8b29721adf1485e04fe3b8e29f2c
SHA1 6ae4944805eb85a4de1b4eacf926180d21397eed
SHA256 171e97ce105da3a72f70bbdb3e813a30029e6c7a1ac87b663966f94e873ccda8
SHA512 8ef4ebeedc9cecfc89f28e4a4ccdf0beb10bc683e93c15d0d8e438704db0824ed4684b098db5171cc88ce821c4ac7d14f06d211af0e2fa160e2cfc6ec3c9c5d4

memory/8212-816-0x0000000000E50000-0x0000000001366000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 eee45ea321065db821efcbe7a83b80b4
SHA1 04d8f6407c127185404d6cbd15eeed02ee5bf213
SHA256 81be7863e85d1368d0e5325ed756b1e113ffb33767ffcc7831c84d5a5b4b36a3
SHA512 d4c42e825fa9ddb8564a076005d87610fa94e7546cad7b1b68e1631bef9fc588cdca54043591ec5458a66320f5abaa5369cfbd0d3b25241d5214c9569060d21d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\13b047a9-81e5-4a57-8795-98e14265919e\index-dir\the-real-index~RFe590025.TMP

MD5 c8862fdb4c50335a8cb927dac4db3aca
SHA1 0068f31aa95a6f00e070a152ced54fef6e9e3942
SHA256 da6df50f93eec31ff4703a7828e3291551ace46f4659176dd1ed91cd4862a349
SHA512 cd5bb9baef16f7014ba5fedb25ee6fb0db7323ce7e9a726a15bd91bb3e32df055313a54b7e0d822a25f93aee8bf315951e0becc0596cfc4c0f9f40f01429340a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\13b047a9-81e5-4a57-8795-98e14265919e\index-dir\the-real-index

MD5 75136b3160eef4ab6acbf11b4d172f04
SHA1 b67b7d76c55163ba829d41c2523fd454210dedfd
SHA256 1b5c713c54198e8754b8718b54562f462426fb917702fad0a7088119913ba879
SHA512 503897bcdcef64a02a862f5740cba40e84d04e4536f409d1002545b7bf30d53cd2e976150fe9f768cbbfe75b5486e4bf9e8d9995a226b86af5a1f977553dc3bf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 579a96899c59575f7f4e8b9c76e55ff8
SHA1 dbb2d2880a2aab0f4b6c5ed0fa59d77146c378c5
SHA256 e4dd5e9e1902878c98896ca7e1b7374b27fa913d0ead47d6092d445eab695bd4
SHA512 0c5217ca9e78eee0b5fc2fd129d949451ae243c843fd343ab71ba3ef3cc00f8f5447d0017cb5a0470a1799f6a1645be379d05ce3e672c2ff3b5272a000d2a446

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 7320147437919e479c424b945b55854a
SHA1 ffcb7cb3defaf79d8af1c4e808cc480c2adeb81c
SHA256 6fc97f789d240985725585e2272e0e93718435cc3d72a1d72b13cf8fdb84fc5e
SHA512 355cf0b0756a9a6807515726976138fae17e6027857fab204dcceb97d3c3ee899ec40c2cb3459f316cc8a8dbac0d250b9f071b2425024fa272c25afd0aa398f4

memory/8212-924-0x0000000000E50000-0x0000000001366000-memory.dmp

memory/8212-964-0x0000000000E50000-0x0000000001366000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_twitter.com_0.indexeddb.leveldb\MANIFEST-000001

MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 667e5a5ac98f8bdb5194b1d14b768e3d
SHA1 d27c402d046d647c03de67f1d4857b6ccadb6ddd
SHA256 38bb566acb793d171a72bddb29206a01416bb8d772ed750736a6d9d6e0a7dc83
SHA512 241270e8d2f80380b8c7f7582d8577c3cbe347849640ac80f8a05bb528ee029d85984979338abd08617b1d0f061dd494008643f3c4bd5ff7c5f60797472b1ba0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 bc682dedeb7e0c416beca98d6981b9df
SHA1 1b425f529d56fb978f14768f2a9cb3c9a2d2f039
SHA256 b067fb0ed9b7935db2a13c99a292bf0094894f0a25006c1e72be729ff4b06be1
SHA512 d6101e735fdd8cb68d0e6c9d5a8d750b7a86b0a48bb338e664dfb46d2ee46599928b933964402d59c9385788df2361a63342fc4687e1bcd39e62b1ddf6e69fa1

memory/8212-1092-0x0000000000E50000-0x0000000001366000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 a1df5e3c2bb467c1dd8a249335b69445
SHA1 93e6de1b7722e50248168a780a0fdc39244f28be
SHA256 59a3e24721dd3269bd90c3ef7ca7c929697c9fd4debe0ac0971df4699d0bca82
SHA512 91aad57b8ee84a9bebd1276d9e96f4cdd9985e0d26a49d4585cf296f0b0a58cf56ca1d28d379e801493e3e41d7892224769db9e786c3daf379f154c4b7637b09

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 3a8fb311e691886263f2c092549c919d
SHA1 3b7d753e14d9f5a4d0cc5c1c6857c486d80525c2
SHA256 698bd5897778265a1917f2b6abff718d267318aa6915788b200a6cb90e45d0ad
SHA512 35d95eb4fca92deb1468cdf4b373dba5cd10dd774119914818f58a19409ad4bfba7067b220bd3e561c14bf3ae32f1d8311fd0936b9d9a1cf073baba04274c32b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old~RFe595af7.TMP

MD5 544424ceeb9ef9bfcd07664a3f59da29
SHA1 8c46593309bc71d5aadf3d72a97dac1b1943d044
SHA256 bebfea0d86d0e13b38b9b7dc2b84d3762e0b8ccd75c636c02205aab57702d281
SHA512 d1164f5d41b76651a028366799d18847b091d67f8a526577f33a14dda0e866d979cb9eeb0adf0c4c2f0f5e1c0ec9cea34a8886ba8cc9684c530ff938c14db2bc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 96d57ddba7b8f400fcaefa957cd79e1a
SHA1 d877fc50f522c578e07ac438e079b76314be8b8a
SHA256 d15b1fa2597aab2e37e3c52e420f7c1cd8bca1be6509d090f518700e2240923f
SHA512 722242f21eb2159a7530cbf27624076adfdc7ad53808fede9c15e9a0bb55c231f70802cc6ad9454d04fc1f8935a313db91c0e8a8f7c62e540aa08a5b22cceb88

memory/8212-1218-0x0000000000E50000-0x0000000001366000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 3015490d27659954137b16dc518f3d6a
SHA1 07a46d69da083e3ab7ade75157ec18432644c6bc
SHA256 4e76f5d826ca43139368812c4fa058ce96fb12e27bdc342ffa5aa53beb71c703
SHA512 7f187b539163f2a52d4134f3f67eef24be10951d451724b4a7b2c57274c144ce6dfce97ec013ca1aa12bdf22ba85daa1cf93481d3a8ce8d2eb002c10f693e9a2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 b523fef153f63f3ec6b2dbe47520b2ab
SHA1 526af7c3c0f843eb80c15469ddbe7eb092a629d0
SHA256 17d6f6a537a94923457b485c20df6052b56b28226cde3f0463c9b2e684dcd76f
SHA512 3f6072a631c066fe54a39c0c86deadf70bed66ef34df6885a308ce01782c1aa3de0f7819bf517f7f144442bf0787240aca2b8ca087d1999f118a07bdc9a716ad

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

MD5 317af7d5697fe6825f8e0e47697ab987
SHA1 595c17231d55740c5bea847176ed63ed3e389cee
SHA256 93e35e0cb006c2d46e8d7b76797e9cef3cdee68afed444fa5a9d392a84ebcafb
SHA512 3a1a8506dd51b9ea920ae7b6c2129daeac09257a761e7fb885587c424d224c481db9e199090eb110c3a0ff2bf83cb01c0b56a6e27aeaaf6d2365c88bdb7f828a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 2b21dd0e60216c44f71e7ab58ac3d838
SHA1 e8f0e9cf76238a660352228131d8f2487c7201f1
SHA256 b719be42a07823ae5b986a1805c990f822cb60e328c1f4ecd0728044bfa72b16
SHA512 bf7128dbf6949f66a96b8fbdfe8e3fffc287c9f9b71e0d59abd78d194446b1c38d2bec5187ac5efd19f25e5bc130f6458d11690b5e28a7abcef815fba1bd6f66

memory/8212-1459-0x0000000000E50000-0x0000000001366000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 0c7c833cedeb86e3481488f1ef14cf44
SHA1 4419f5fdf5bdd0556f8561242244d711a6ae6fe1
SHA256 56fa56847feb9502ba4eb86a2e0592b46c1b920f80943d78335e4226d79cc746
SHA512 c611f0057f6ede207c98da2cb4d66c6b44c0d19362192e5b4e1d7e2ebfb2b0a60a31ab82ba1b98a0a5fca728d21c8dc6c679e148ca104b4bd0c59fc2d58dfe84

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 fbbbee2bbbcf0875cea7d3802c4077bc
SHA1 badba5a880fec8860a5eb3b00bb4efbd14d92921
SHA256 0f818ceaf6c6a6dc1510e811b1338fe6133186e3b5b82d5d5fbb66b3b996ab2e
SHA512 78539c5597714d3f2effc188c53eadc77d5500a738fd4d09ac80288c225916e92e57fdfcdaca4b8388013f2e27de673e38f38395cb926418c59546ac987db343

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 31978412541a4d52496b617af3473492
SHA1 eaa070b51ec6ea455efff07568454ab78eabfcdb
SHA256 c781bb75394f4e8cf45d469d95bad9f74b87cff6ef49555519045a509b280df1
SHA512 df6c17fed6c54152038acf7538c00054d214c8b3bd8e4969b2ebd47a66704b48faad84fcf32e8657ba1c4b29e4cd55e206f045174b3e5c33c884f82ced6b540e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 8ea9cee71d5f8aacd3f0e2bafd3cc901
SHA1 5bf28f9addd8f708d68aafd72540e13ff154fb99
SHA256 95435ecb8cd80b34eda54ce87fe75711366820ea90c2a2c65c78e0e188b2dcaa
SHA512 b58be0a286720cf3530a11a97f0fad1108ef7620d1c62f70be430043d4001baa985e6a458ec6891f86a59eb72c8c0759c5794092901f94d64cbe25b1957870b4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 310a72acda672d75676607fa1a8ecc29
SHA1 813da13f5d36ec999a010793db0a6842df99796e
SHA256 6b99468591a79724783a203926b99a3df4ec291744eb0fa39c33b51e1ea45f7b
SHA512 d8751c3866604138cab9df0f6007bef4af0b6c319ab5f8edb723b787805f366fdfbf3edcdf0b3e77e7935dd0a1e508a26131c09d56f63a40fa8fd570b1d26865

memory/8212-1620-0x0000000000E50000-0x0000000001366000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 5fea028947e9622c16acb0df4e3242ab
SHA1 eb5441ab3ff7ef59f34f928c48d9b9880a7b39c7
SHA256 e42142b2d268f5c0c72bb52a1724128a3719457b5a37d0a18a9780574be99f9c
SHA512 3a77cc78fe33443d983473eaf3fb9efbe96f32bf348091508ea95842c0f94e025b38801dbe1f058c87ad59af45c82bea601ea24cea3d0f76137f7d893f6b882b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 582d381e008d0eb305f49a96e7c04083
SHA1 5962868e23b5014fd1fbb64fca508a4c256b3bac
SHA256 6cda810e3399c2e17d7c3c92974b5ea6b5f170674d6948f9de018e7a54cb9968
SHA512 2d60277b76278697fb6962167e1b7cf8b763b76e02162babab2059f41c89a9b9e7408ce9caa424709de0e87ec7f41b4c8e0d65c9fde88b0d1fa75afe330b9cc1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 678fb153b59537e07deea583a4239813
SHA1 c1158f83d36bc68dc1a2d11afd63a0366353e7c0
SHA256 4a6ca73c0d30cd7e592dbef07ede844887b559cb6e59bc12c3f78d9e29765ca1
SHA512 3835eda1975095be5d20c4f5f7f7bfa0f5fb91cc9a64bd6975bc4ae512bf4cc088b568c0d336fbfa01ed7b1b43ab47c8624f5e0586ca3c0a4f0c0b1f6514c024

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 d8c983ced0f073f13313b9735a09a79a
SHA1 30975835e988736cd23eccc03b588e8c6eae1ef8
SHA256 9eb04ad010a0822fa77734e1533dc83d41bc9a8f2cb9c8fec5550beb0167cbc3
SHA512 084635364d016a8bd1babef83077edead8369d6ee7b433c59f4e2a0be44f8064961d7607931b4efca807cb4c9504050d1ff853e23065859d7fbb8e42a17ecc15

memory/8212-1900-0x0000000000E50000-0x0000000001366000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 fe6c43fdd51701036df877d98457a9c4
SHA1 ef0e01ef25ad0992ae72870904e07119bd1eebc6
SHA256 44d6ed44a88b5dbac35178468baade98d4b13bf3d70ac955d54b7e05a15f92c5
SHA512 a4242929dc570fa44b8a50b0bc5eb6bc74a585109b28087fcb9dd019fa682db6005b0b976dd042853937e58af8e2781be9e98b98a1ddd697daccbc1e86f5126e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 773b67937b726627bc3c7bfb65d889c7
SHA1 fe73f507a0a86c328ddd0bab13f6d731865522c2
SHA256 cba8433736aad4ca17988c93558c2309c8c86035390f6cff423607dd64200dbe
SHA512 b1f4220020e5333c3b4cf55a8e07f97324d257a9eeba5cb7bf431caee117e09c725d98a342e63247ce17266a46ce8eda391d1a871aef6e2be0f45df76a81701a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 cfeed8bdc62a4c1d3a84ad26bf9fe00e
SHA1 7fc8a9e5ab786e338050a195a92cf0f033ac0d98
SHA256 aee5f6db37de5ed2742492eea9c840430e6b82542810f1e28ad349f16f14c8c1
SHA512 7aafe9f2d298059a4253340782384377a69e6a63170f51794d99eeb2f0c2250d0d566d3b2871d0d3a892c304ed2f36cd123235263eab64fd2dab07b8135f3bea

memory/8212-2613-0x0000000000E50000-0x0000000001366000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 1c346de8a06fc924c52da92db9956024
SHA1 f78b4bb51b22210770cc0f4583f4c6fd92e91095
SHA256 4b725f0002341167a07bda6db53e106dda819b6421b523d817cf3b665582f12f
SHA512 3bcc5ae2a1dfa29c415cff7a410f2158a7d1a906d8eab6a9abad25d44e6fbe66ce50d372b0a68ab70eeb6182257dea5a6f76cd0dab783d98606db7335606bedd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 969e2e52eab0f0d588751da74bc7c338
SHA1 d89fb10fa8dc17413f30351230023fd812adddd0
SHA256 f0c1c66aae61d24f2e9a1c71a7bb3e3dacffc683fc834dc091ad49b3a3b3a989
SHA512 de87dbbcd5b2be8c503289ca5a03c0880031473b63133d76b896f9b414d236e044e32dc114f72c2de87f9d744fca273fbd280017d442f6c85d8e1ce8e2414ead

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 924177179f273a1132c2d7859c6c6aa3
SHA1 cdeacdddbdac36ebdf586a8a6db550e684ecf3af
SHA256 c6abfe076bf31c5b1d0def6460754dad4ec0432b68f25038a9ac208f3a97cb6f
SHA512 b6dee6f50ce7c325eb7f2393cb70b9887465bfe020eff38809ee85d230f33ccfaeee1ee2c31eb370ea3900e96bd7c4b446e86c636f01f136fb8e3297e33011cd

memory/8212-2651-0x0000000000E50000-0x0000000001366000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 1af910a7dfad7836ea5d0674bf40a875
SHA1 7577ae801bb3e4565449e512beedf169633af30b
SHA256 b1f7edadff665d45f41e6eb0d665cf742d45153d2438f2f66837f381c0a41ad4
SHA512 81be65293c83ac3e4bc854753b746888e26f3b559718c1edf90e86aa4399270624845486c523ffd5bee2b4cfd939c8ad32088053107bf8f68c0dcbc313b44b5a