Malware Analysis Report

2024-12-07 22:58

Sample ID 240112-fxlvgsfbdn
Target 1x43xx.exe
SHA256 b90a5b9a5ee5305fdb4bbaa5992849e15942037bafe241eb965325e5bd056f49
Tags
risepro persistence stealer paypal evasion phishing trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b90a5b9a5ee5305fdb4bbaa5992849e15942037bafe241eb965325e5bd056f49

Threat Level: Known bad

The file 1x43xx.exe was found to be: Known bad.

Malicious Activity Summary

risepro persistence stealer paypal evasion phishing trojan

Modifies Windows Defender Real-time Protection settings

RisePro

Executes dropped EXE

Loads dropped DLL

Windows security modification

Adds Run key to start application

Detected potential entity reuse from brand paypal.

AutoIT Executable

Suspicious use of NtSetInformationThreadHideFromDebugger

Enumerates physical storage devices

Unsigned PE

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-12 05:15

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-12 05:15

Reported

2024-01-12 05:17

Platform

win7-20231129-en

Max time kernel

0s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1x43xx.exe"

Signatures

RisePro

stealer risepro

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\1x43xx.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe N/A

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2732 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\1x43xx.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe
PID 2732 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\1x43xx.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe
PID 2732 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\1x43xx.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe
PID 2732 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\1x43xx.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe
PID 2732 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\1x43xx.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe
PID 2732 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\1x43xx.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe
PID 2732 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\1x43xx.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe
PID 2316 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe
PID 2316 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe
PID 2316 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe
PID 2316 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe
PID 2316 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe
PID 2316 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe
PID 2316 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe
PID 1876 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe
PID 1876 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe
PID 1876 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe
PID 1876 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe
PID 1876 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe
PID 1876 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe
PID 1876 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe
PID 2280 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2280 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files\Internet Explorer\iexplore.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1x43xx.exe

"C:\Users\Admin\AppData\Local\Temp\1x43xx.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://store.steampowered.com/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.paypal.com/signin

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2560 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2472 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2604 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2576 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2596 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2668 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2664 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2736 CREDAT:275457 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2kf9386.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2kf9386.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://instagram.com/accounts/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://twitter.com/i/flow/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.linkedin.com/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.epicgames.com/id/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://steamcommunity.com/openid/loginform

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.facebook.com/login

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://accounts.google.com/

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3yz21sk.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3yz21sk.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 www.paypal.com udp
US 8.8.8.8:53 steamcommunity.com udp
US 8.8.8.8:53 store.steampowered.com udp
US 8.8.8.8:53 www.linkedin.com udp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 www.epicgames.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 instagram.com udp
US 8.8.8.8:53 twitter.com udp
US 8.8.8.8:53 steamcommunity.com udp
US 151.101.1.21:443 www.paypal.com tcp
IE 163.70.147.35:443 www.facebook.com tcp
US 151.101.1.21:443 www.paypal.com tcp
IE 163.70.147.35:443 www.facebook.com tcp
GB 104.103.202.103:443 steamcommunity.com tcp
GB 104.103.202.103:443 steamcommunity.com tcp
US 13.107.42.14:443 www.linkedin.com tcp
US 13.107.42.14:443 www.linkedin.com tcp
US 142.250.27.84:443 accounts.google.com tcp
US 142.250.27.84:443 accounts.google.com tcp
US 34.206.239.255:443 www.epicgames.com tcp
US 34.206.239.255:443 www.epicgames.com tcp
US 92.123.241.50:443 store.steampowered.com tcp
US 92.123.241.50:443 store.steampowered.com tcp
GB 142.250.200.46:443 www.youtube.com tcp
GB 142.250.200.46:443 www.youtube.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
IE 163.70.147.174:443 instagram.com tcp
IE 163.70.147.174:443 instagram.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 104.244.42.65:443 twitter.com tcp
US 104.244.42.65:443 twitter.com tcp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 92.123.241.137:80 www.microsoft.com tcp
US 216.239.32.29:80 pki.goog tcp
US 216.239.32.29:80 pki.goog tcp
US 216.239.32.29:80 pki.goog tcp
US 216.239.32.29:80 pki.goog tcp
US 92.123.241.137:80 www.microsoft.com tcp
US 8.8.8.8:53 community.cloudflare.steamstatic.com udp
US 172.64.145.151:443 community.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 community.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 community.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 community.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 community.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 community.cloudflare.steamstatic.com tcp
GB 142.250.200.46:443 www.youtube.com tcp
GB 142.250.200.46:443 www.youtube.com tcp
GB 142.250.200.46:443 www.youtube.com tcp
GB 142.250.200.46:443 www.youtube.com tcp
US 8.8.8.8:53 store.cloudflare.steamstatic.com udp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 8.8.8.8:53 www.instagram.com udp
IE 163.70.147.174:443 www.instagram.com tcp
IE 163.70.147.174:443 www.instagram.com tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 8.8.8.8:53 facebook.com udp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.35:443 facebook.com tcp
IE 163.70.147.35:443 facebook.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 8.8.8.8:53 www.paypalobjects.com udp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
US 192.229.221.25:443 www.paypalobjects.com tcp
IE 163.70.147.35:443 facebook.com tcp
IE 163.70.147.35:443 facebook.com tcp
IE 163.70.147.35:443 facebook.com tcp
IE 163.70.147.35:443 facebook.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 store.cloudflare.steamstatic.com tcp
US 92.123.128.181:80 tcp
US 92.123.128.181:80 tcp
US 92.123.128.181:80 tcp
US 92.123.128.167:80 tcp
US 92.123.128.167:80 tcp
US 92.123.128.167:80 tcp
US 92.123.128.181:80 tcp
US 92.123.128.181:80 tcp
US 92.123.128.181:80 tcp
US 92.123.128.167:80 tcp
US 151.101.1.35:443 tcp
US 151.101.1.35:443 tcp
US 151.101.1.35:443 tcp
FR 216.58.204.78:443 www.youtube.com tcp
FR 216.58.204.78:443 www.youtube.com tcp
GB 142.250.200.46:443 www.youtube.com tcp
GB 142.250.200.46:443 www.youtube.com tcp
GB 142.250.200.4:443 tcp
GB 142.250.200.4:443 tcp
IE 163.70.147.35:443 facebook.com tcp
IE 163.70.147.35:443 facebook.com tcp
IE 163.70.147.35:443 facebook.com tcp
IE 163.70.147.35:443 facebook.com tcp
US 54.86.169.242:443 tcp
US 54.86.169.242:443 tcp
GB 13.224.81.102:443 tcp
GB 13.224.81.102:443 tcp
IE 163.70.147.63:443 tcp
IE 163.70.147.63:443 tcp
IE 163.70.147.63:443 tcp
IE 163.70.147.63:443 tcp
IE 163.70.147.63:443 tcp
IE 163.70.147.63:443 tcp
US 92.123.128.167:80 tcp
US 92.123.128.181:80 tcp
US 92.123.128.181:80 tcp
US 92.123.128.181:80 tcp
US 92.123.128.167:80 tcp
US 92.123.128.167:80 tcp
US 92.123.128.167:80 tcp
GB 96.17.178.209:80 tcp
GB 96.17.178.209:80 tcp
US 92.123.128.181:80 tcp
US 92.123.128.181:80 tcp
US 92.123.128.181:80 tcp

Files

memory/624-42-0x0000000000350000-0x00000000006F0000-memory.dmp

memory/624-44-0x0000000000350000-0x00000000006F0000-memory.dmp

memory/624-43-0x0000000000350000-0x00000000006F0000-memory.dmp

memory/624-37-0x0000000001020000-0x00000000013C0000-memory.dmp

memory/1876-36-0x0000000002960000-0x0000000002D00000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe

MD5 81c241ffb146eafa73d0861c538fb9d2
SHA1 f96cbed8c268b0e3293b47bd6cb8ea7a1f3cdd96
SHA256 39c795dc000169fc21b59b633a69b15e0d02acecc5d1bff4e8b6e6151628ee8c
SHA512 0b829ba3a79b741d34029dc5b4152e7f9e009cadc63caffdc5b59290194a36e64679bfa565ea3d68ebfecc518b33fc20763df31f3ab495fa5d614cbaa8caec61

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe

MD5 6c181f0fff0eee02609bc6a3fc96515c
SHA1 e2aed7b245147395f8625846dfa840e74d478f64
SHA256 eff85fb760f7649e00460800e8a1bee9772aebc6a1770a2b65030933ec77d571
SHA512 164db6e99c466fdee95fc2380ba6e6cf3d396522644b4df4ac728b3bb0fa3d1a0c05db8d5dc786b8a7c1fc30a7142fe4b07cca28cffe8740706e24782e1db5fe

\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe

MD5 02b277e5a69d39f3cdf2ca68ea32a969
SHA1 325c7b9184da5657b84046d142d76be1f7e77bc6
SHA256 99653913c7a8170d9a8215d9c37afc98a54405f8ae1f029d9f953057e8ebd844
SHA512 825f5a51bf376786a2ff4085f40f25ed3fd11f1d0e1d2e3eccf00824dcddae3966995b09b9e20276d1d2b8a5d514114585f5f6a2ebf9755e2c5c4d5423f4042e

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe

MD5 872e310ad0af260cbe5157720df5616f
SHA1 5ff5cc95d25eede2c178cf641e5b6fa5a7f89e3e
SHA256 ec104b6b59c6a14ed9262cf3fc5664564355ed614a371fb2d0630a04a6e16728
SHA512 d53a82f33a1907166c1cc7846ac3972c13866dc09c6fca7a91f29f317f85dbfbc1c85e6853c459cef14beabf838c91f96e5add592d8da8c9240aafd508498a83

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe

MD5 0084087b1348a8fde1c3300216ece728
SHA1 5f17c2be6cc4aebadaa287f7c45e7e5905f30075
SHA256 1ebe5b265dda6740403f79082f93894268fa772747f3121780a8e78701b3a9e9
SHA512 6cdd9f99aa6c0728e7594bd0e1834e0cad54a177bb72463e4001c92c690b6a4941461074917a99e227be98072d87f8eafad77aa0fc3ce1bc5dd847798500bdf8

\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe

MD5 da649855ce93fc171ca8903003cff5cb
SHA1 eb85c897b7d83014893d73fe0709187a5f3e1746
SHA256 613d946a6ee0a292ed53aa0fbf395c3137ceb626eaec80fae4d729691400acdc
SHA512 908f720ab31068e0883f90718c4391f8cc1c6b0ac301cd45d089eafbdf256fb0fe5ebc7abc81e98f6211b97e318c2e755882622fc7bfdc77325764349b76a97d

memory/2316-2421-0x0000000002960000-0x0000000002E76000-memory.dmp

memory/3236-2457-0x0000000000B40000-0x0000000001056000-memory.dmp

memory/3236-2448-0x0000000001450000-0x0000000001966000-memory.dmp

memory/2316-2420-0x0000000002960000-0x0000000002E76000-memory.dmp

memory/624-2412-0x0000000000350000-0x00000000006F0000-memory.dmp

memory/3236-2756-0x0000000000B40000-0x0000000001056000-memory.dmp

memory/2316-2757-0x0000000002960000-0x0000000002E76000-memory.dmp

memory/2316-2759-0x0000000002960000-0x0000000002E76000-memory.dmp

memory/3236-2758-0x0000000000B40000-0x0000000001056000-memory.dmp

memory/3236-2760-0x0000000001450000-0x0000000001966000-memory.dmp

memory/3236-2761-0x0000000000B40000-0x0000000001056000-memory.dmp

memory/3236-2762-0x0000000000B40000-0x0000000001056000-memory.dmp

memory/3236-2763-0x0000000000B40000-0x0000000001056000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8a7e2be979e863a3942a52a695e49d7b
SHA1 d3f440dfdbb6b8510fe9d722c23bde6cf75156eb
SHA256 a205b1ef5f1585428519d5f411c88cca79bd662257f3733e30f5c629cb239a99
SHA512 553621ab997446791a86a8ae7365d9a993c34bf7a56570c837faf29c9029d8a1069e10c76b1bc8907992b4cb2438c0e98155445e39fb5c03cbf0e36d92fdf230

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2fd83369e2a66acd8f3a29e2a9c2b399
SHA1 efc77654411998b808a99b3a9becfe8dacd20175
SHA256 a184d13aecf71c7f315747fc6f5f0d13639b8de280598046aed410a0d3e0b039
SHA512 4d2c058b0259af0fdd4317354893411edb8b6487eb4f49adc65f01e2befb367c07383850065023b292df948a1c835dac5fb806e39e2c7c3dda1ccb6254b8496b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/3236-3193-0x0000000000B40000-0x0000000001056000-memory.dmp

memory/3236-3194-0x0000000000B40000-0x0000000001056000-memory.dmp

memory/3236-3195-0x0000000000B40000-0x0000000001056000-memory.dmp

memory/3236-3196-0x0000000000B40000-0x0000000001056000-memory.dmp

memory/3236-3197-0x0000000000B40000-0x0000000001056000-memory.dmp

memory/3236-3198-0x0000000000B40000-0x0000000001056000-memory.dmp

memory/3236-3199-0x0000000000B40000-0x0000000001056000-memory.dmp

memory/3236-3200-0x0000000000B40000-0x0000000001056000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-12 05:15

Reported

2024-01-12 05:18

Platform

win10v2004-20231215-en

Max time kernel

160s

Max time network

173s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1x43xx.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2kf9386.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2kf9386.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2kf9386.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2kf9386.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2kf9386.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2kf9386.exe N/A

RisePro

stealer risepro

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2kf9386.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2kf9386.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\1x43xx.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Detected potential entity reuse from brand paypal.

phishing paypal

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3073191680-435865314-2862784915-1000\{2292CD61-03F8-4B37-83B5-C46DE19FF1D6} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2kf9386.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2kf9386.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2kf9386.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2kf9386.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2kf9386.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3yz21sk.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2204 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\1x43xx.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe
PID 2204 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\1x43xx.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe
PID 2204 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\1x43xx.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe
PID 2536 wrote to memory of 3240 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe
PID 2536 wrote to memory of 3240 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe
PID 2536 wrote to memory of 3240 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe
PID 3240 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe
PID 3240 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe
PID 3240 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe
PID 3048 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3048 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3048 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3048 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3048 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3048 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3048 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3048 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3048 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3048 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3048 wrote to memory of 208 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3048 wrote to memory of 208 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 556 wrote to memory of 2772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 556 wrote to memory of 2772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2392 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2392 wrote to memory of 3512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 208 wrote to memory of 1008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 208 wrote to memory of 1008 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3048 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3048 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5100 wrote to memory of 2744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5100 wrote to memory of 2744 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4648 wrote to memory of 3944 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4648 wrote to memory of 3944 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3552 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3552 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 5080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3692 wrote to memory of 5080 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3048 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3048 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5044 wrote to memory of 4432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5044 wrote to memory of 4432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3048 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3048 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3452 wrote to memory of 3712 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3048 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3048 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4372 wrote to memory of 1428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4372 wrote to memory of 1428 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3240 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2kf9386.exe
PID 3240 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2kf9386.exe
PID 3240 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2kf9386.exe
PID 556 wrote to memory of 3864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 556 wrote to memory of 3864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 556 wrote to memory of 3864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 556 wrote to memory of 3864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 556 wrote to memory of 3864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 556 wrote to memory of 3864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 556 wrote to memory of 3864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 556 wrote to memory of 3864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 556 wrote to memory of 3864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 556 wrote to memory of 3864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 556 wrote to memory of 3864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 556 wrote to memory of 3864 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1x43xx.exe

"C:\Users\Admin\AppData\Local\Temp\1x43xx.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.linkedin.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa72ad46f8,0x7ffa72ad4708,0x7ffa72ad4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa72ad46f8,0x7ffa72ad4708,0x7ffa72ad4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa72ad46f8,0x7ffa72ad4708,0x7ffa72ad4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffa72ad46f8,0x7ffa72ad4708,0x7ffa72ad4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffa72ad46f8,0x7ffa72ad4708,0x7ffa72ad4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa72ad46f8,0x7ffa72ad4708,0x7ffa72ad4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x14c,0x16c,0x7ffa72ad46f8,0x7ffa72ad4708,0x7ffa72ad4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa72ad46f8,0x7ffa72ad4708,0x7ffa72ad4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa72ad46f8,0x7ffa72ad4708,0x7ffa72ad4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://instagram.com/accounts/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x16c,0x170,0x174,0x148,0x178,0x7ffa72ad46f8,0x7ffa72ad4708,0x7ffa72ad4718

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2kf9386.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2kf9386.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,2159524113159065435,7837708646532770466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,2159524113159065435,7837708646532770466,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,5425891354247009971,2273120875917507377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,5425891354247009971,2273120875917507377,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,13804624803204802305,8190524094880544097,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,13804624803204802305,8190524094880544097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,17623559063879199289,5465486723424327046,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,4958854695389219257,5932931004288977881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,4958854695389219257,5932931004288977881,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,14286949375416468458,15942337702250460466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,14286949375416468458,15942337702250460466,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,2661645462936721404,8720769184877661606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,16019025882018642295,8224357332581720444,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,17623559063879199289,5465486723424327046,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,474920253778078344,10458949207021396369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,474920253778078344,10458949207021396369,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16019025882018642295,8224357332581720444,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,2661645462936721404,8720769184877661606,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4372 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4388 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4488 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4380 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5112 /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x300 0x244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7976 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3yz21sk.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3yz21sk.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8996 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8960 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9368 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9368 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8864 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8856 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7940 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=7792 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9240 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,4480591085072034500,4681529423153411370,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6988 /prefetch:2

Network

Country Destination Domain Proto
US 138.91.171.81:80 tcp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 www.epicgames.com udp
US 8.8.8.8:53 twitter.com udp
US 8.8.8.8:53 instagram.com udp
US 104.244.42.65:443 twitter.com tcp
US 104.244.42.65:443 twitter.com tcp
IE 163.70.147.174:443 instagram.com tcp
IE 163.70.147.174:443 instagram.com tcp
US 8.8.8.8:53 www.paypal.com udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 65.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 174.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 steamcommunity.com udp
US 8.8.8.8:53 store.steampowered.com udp
US 151.101.1.21:443 www.paypal.com tcp
US 151.101.1.21:443 www.paypal.com tcp
GB 104.103.202.103:443 steamcommunity.com tcp
GB 104.103.202.103:443 steamcommunity.com tcp
US 8.8.8.8:53 www.linkedin.com udp
US 3.94.238.60:443 www.epicgames.com tcp
US 3.94.238.60:443 www.epicgames.com tcp
US 92.123.241.50:443 store.steampowered.com tcp
US 92.123.241.50:443 store.steampowered.com tcp
US 8.8.8.8:53 www.facebook.com udp
US 13.107.42.14:443 www.linkedin.com tcp
US 13.107.42.14:443 www.linkedin.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 21.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 103.202.103.104.in-addr.arpa udp
US 8.8.8.8:53 www.youtube.com udp
US 142.250.27.84:443 accounts.google.com tcp
US 142.250.27.84:443 accounts.google.com tcp
US 8.8.8.8:53 50.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 60.238.94.3.in-addr.arpa udp
US 8.8.8.8:53 14.42.107.13.in-addr.arpa udp
US 8.8.8.8:53 35.221.240.157.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 www.instagram.com udp
US 8.8.8.8:53 abs.twimg.com udp
US 8.8.8.8:53 api.twitter.com udp
US 152.199.21.141:443 abs.twimg.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 152.199.21.141:443 abs.twimg.com tcp
US 8.8.8.8:53 video.twimg.com udp
GB 199.232.56.158:443 video.twimg.com tcp
US 8.8.8.8:53 71.10.230.54.in-addr.arpa udp
US 8.8.8.8:53 84.27.250.142.in-addr.arpa udp
US 104.244.42.66:443 api.twitter.com tcp
US 8.8.8.8:53 api.x.com udp
US 8.8.8.8:53 pbs.twimg.com udp
US 8.8.8.8:53 t.co udp
US 104.244.42.197:443 t.co tcp
GB 199.232.56.159:443 pbs.twimg.com tcp
US 104.244.42.66:443 api.x.com tcp
US 142.250.27.84:443 accounts.google.com udp
US 8.8.8.8:53 141.21.199.152.in-addr.arpa udp
US 8.8.8.8:53 158.56.232.199.in-addr.arpa udp
US 8.8.8.8:53 66.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 197.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 159.56.232.199.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
GB 142.250.200.46:443 www.youtube.com tcp
GB 142.250.200.46:443 www.youtube.com tcp
GB 142.250.200.46:443 www.youtube.com udp
US 8.8.8.8:53 i.ytimg.com udp
GB 172.217.169.86:443 i.ytimg.com tcp
US 8.8.8.8:53 86.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 234.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 46.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 community.akamai.steamstatic.com udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
IE 163.70.147.23:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 store.akamai.steamstatic.com udp
US 8.8.8.8:53 www.paypalobjects.com udp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
US 8.8.8.8:53 static.cdninstagram.com udp
GB 104.77.160.220:443 store.akamai.steamstatic.com tcp
GB 104.77.160.220:443 store.akamai.steamstatic.com tcp
GB 104.77.160.220:443 store.akamai.steamstatic.com tcp
US 151.101.2.133:443 www.paypalobjects.com tcp
US 151.101.2.133:443 www.paypalobjects.com tcp
US 151.101.2.133:443 www.paypalobjects.com tcp
IE 163.70.147.63:443 static.cdninstagram.com tcp
IE 163.70.147.63:443 static.cdninstagram.com tcp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 apps.identrust.com udp
GB 96.17.179.184:80 apps.identrust.com tcp
GB 96.17.179.184:80 apps.identrust.com tcp
US 8.8.8.8:53 23.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 200.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 220.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 133.2.101.151.in-addr.arpa udp
US 8.8.8.8:53 63.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 184.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 static-assets-prod.unrealengine.com udp
GB 13.224.81.102:443 static-assets-prod.unrealengine.com tcp
US 8.8.8.8:53 102.81.224.13.in-addr.arpa udp
US 8.8.8.8:53 rr1---sn-q4flrnss.googlevideo.com udp
US 173.194.57.102:443 rr1---sn-q4flrnss.googlevideo.com tcp
US 173.194.57.102:443 rr1---sn-q4flrnss.googlevideo.com tcp
US 8.8.8.8:53 102.57.194.173.in-addr.arpa udp
US 173.194.57.102:443 rr1---sn-q4flrnss.googlevideo.com tcp
US 173.194.57.102:443 rr1---sn-q4flrnss.googlevideo.com tcp
US 173.194.57.102:443 rr1---sn-q4flrnss.googlevideo.com tcp
US 173.194.57.102:443 rr1---sn-q4flrnss.googlevideo.com tcp
US 8.8.8.8:53 tracking.epicgames.com udp
US 18.205.33.141:443 tracking.epicgames.com tcp
US 8.8.8.8:53 static.licdn.com udp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
GB 88.221.135.104:443 static.licdn.com tcp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
US 8.8.8.8:53 141.33.205.18.in-addr.arpa udp
US 8.8.8.8:53 104.135.221.88.in-addr.arpa udp
FR 216.58.201.106:443 jnn-pa.googleapis.com tcp
FR 216.58.201.106:443 jnn-pa.googleapis.com tcp
FR 216.58.201.106:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 106.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 youtube.com udp
GB 142.250.200.4:443 www.google.com tcp
US 151.101.2.133:443 www.paypalobjects.com tcp
GB 142.250.178.14:443 youtube.com tcp
US 8.8.8.8:53 14.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 facebook.com udp
IE 163.70.147.35:443 facebook.com tcp
US 8.8.8.8:53 35.147.70.163.in-addr.arpa udp
US 8.8.8.8:53 fbcdn.net udp
IE 163.70.147.35:443 fbcdn.net tcp
US 8.8.8.8:53 www.recaptcha.net udp
US 8.8.8.8:53 c.paypal.com udp
GB 172.217.16.227:443 www.recaptcha.net tcp
US 8.8.8.8:53 114.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 192.55.233.1:443 tcp
US 192.55.233.1:443 tcp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 t.paypal.com udp
US 151.101.1.35:443 t.paypal.com tcp
US 8.8.8.8:53 35.1.101.151.in-addr.arpa udp
GB 172.217.16.227:443 www.recaptcha.net udp
US 8.8.8.8:53 b.stats.paypal.com udp
US 8.8.8.8:53 c6.paypal.com udp
US 64.4.245.84:443 b.stats.paypal.com tcp
US 151.101.1.35:443 c6.paypal.com tcp
US 8.8.8.8:53 dub.stats.paypal.com udp
US 64.4.245.84:443 dub.stats.paypal.com tcp
US 8.8.8.8:53 84.245.4.64.in-addr.arpa udp
GB 142.250.200.4:443 www.google.com udp
GB 104.77.160.220:443 store.akamai.steamstatic.com tcp
GB 104.77.160.220:443 store.akamai.steamstatic.com tcp
GB 104.77.160.220:443 store.akamai.steamstatic.com tcp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
GB 104.77.160.200:443 store.akamai.steamstatic.com tcp
US 8.8.8.8:53 ponf.linkedin.com udp
US 144.2.9.1:443 ponf.linkedin.com tcp
US 8.8.8.8:53 1.9.2.144.in-addr.arpa udp
US 8.8.8.8:53 sentry.io udp
US 35.186.247.156:443 sentry.io tcp
US 8.8.8.8:53 156.247.186.35.in-addr.arpa udp
US 8.8.8.8:53 platform.linkedin.com udp
US 152.199.22.144:443 platform.linkedin.com tcp
US 8.8.8.8:53 login.steampowered.com udp
GB 104.103.202.103:443 login.steampowered.com tcp
US 8.8.8.8:53 144.22.199.152.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
FR 216.58.204.78:443 play.google.com tcp
FR 216.58.204.78:443 play.google.com udp
GB 142.250.200.4:443 www.google.com udp
US 8.8.8.8:53 stun.l.google.com udp
US 8.8.8.8:53 78.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 142.251.29.127:19302 stun.l.google.com udp
US 142.251.29.127:19302 stun.l.google.com udp
GB 13.224.81.102:443 static-assets-prod.unrealengine.com tcp
FR 216.58.204.78:443 play.google.com udp
US 8.8.8.8:53 api.steampowered.com udp
US 8.8.8.8:53 127.29.251.142.in-addr.arpa udp
GB 104.103.202.103:443 api.steampowered.com tcp
US 104.244.42.66:443 api.x.com tcp
US 104.244.42.66:443 api.x.com tcp
US 104.244.42.66:443 api.x.com tcp
US 35.186.247.156:443 sentry.io udp
US 8.8.8.8:53 talon-website-prod.ecosec.on.epicgames.com udp
US 104.18.41.136:443 talon-website-prod.ecosec.on.epicgames.com tcp
US 8.8.8.8:53 136.41.18.104.in-addr.arpa udp
US 8.8.8.8:53 talon-service-prod.ecosec.on.epicgames.com udp
US 172.64.146.120:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 172.64.146.120:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 172.64.146.120:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 172.64.146.120:443 talon-service-prod.ecosec.on.epicgames.com tcp
US 8.8.8.8:53 120.146.64.172.in-addr.arpa udp
US 8.8.8.8:53 js.hcaptcha.com udp
US 104.19.218.90:443 js.hcaptcha.com tcp
US 104.19.218.90:443 js.hcaptcha.com tcp
US 8.8.8.8:53 90.218.19.104.in-addr.arpa udp
US 8.8.8.8:53 newassets.hcaptcha.com udp
US 8.8.8.8:53 www.epicgames.com udp
US 8.8.8.8:53 api2.hcaptcha.com udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 90.16.208.104.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wh6ys76.exe

MD5 21973aaeff631fdcc0a2f4a8527acd4d
SHA1 16db73caec48807c15cb167a1b8b6939b4d50633
SHA256 38327b5912f4d418fc2301fa35efe1fc7f2dc6e2247eb4c2a9bda891c752c890
SHA512 4a2e8d6c1de4b6a79ac9d7cdc9e0302a4769137731613f9f1b1b4e85a655ed815e549f87d31d65b7ce8261bc55b87f8cdd6e88dee7942e1b8952877235b9f6fc

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe

MD5 332d3376ad7eba2a5b26215b530d8fbd
SHA1 d03f63e0bad2ffbde29d28488696da393068aaf1
SHA256 65e6b5caf61834a09e675ad51b045c362572fc3f9049004b2867ad9b796aee5f
SHA512 45d8a35262ada376a41587c325da08eb108d9a5b812274fd01e7f3e09780314f10d1f8e9795bce75a6cb49800b4dab22a93076266b398643a8d022ca0d31dafd

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KO0YT90.exe

MD5 9fc314a210397f97520ea72478cacd23
SHA1 16fc51cd527bd1d953874ee32ad232f1eb35d636
SHA256 7b19db407cb653c1493b8174cea6a6e645b4cf7b4a23671aa8dfa07f1f6c61af
SHA512 f09959e5564dadc0b04374ac2a3e6be26bdf71418b2180cdb27da41716bcc21aa35a979b4a2c79a0d84045b7c5f9604401232b8e743b7c39dd227067281f6127

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Cy74Ah2.exe

MD5 9a6ed7956976378c8c67f4d162b80021
SHA1 a8a9ad421d924c153d1194cd8180c1980f96a9a4
SHA256 f7f44398428701dff7cc9b40938b926915810a1c97a58495ac2ba0fc08740154
SHA512 58155fe01f9ac25422ceedb5d8e5d347d13e33d2bf9e0643a4d8ab5d62817d84a91cf9dc582c94273c45d5dc59ca671e571a9bf42c8a33fb2f3774d402e99590

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 b810b01c5f47e2b44bbdd46d6b9571de
SHA1 8e3d866cf56193ca92a9b74d1c0e4520b5a74fdc
SHA256 d1100cf9e4db12cc60cce6e0e2e3d9697e762c219f6068eb55a1390777bf4b45
SHA512 6bbf900b2f7614dd17aa6d5febe3ad1100851e2309ba2cd5219c5aa5af7bf830eec2cc88071d37987aa7e3f527b8df5b2d85e8b21b18fcb071baaab1a2eadae2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 efc9c7501d0a6db520763baad1e05ce8
SHA1 60b5e190124b54ff7234bb2e36071d9c8db8545f
SHA256 7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a
SHA512 bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2kf9386.exe

MD5 09ad33bc3340bb460945f52fc64d8104
SHA1 8961fb7b80dd09fb1f7936e1a488340076d241b3
SHA256 a3cf01cc1676f1ed1b8c99e0fec006243eee183afbf9f9d798e4730fa7eac4e5
SHA512 2c39399642bd76f6912a57b7ab743752bb678eb8a85e8f53499403818984c3c750e4dedeb13ea179076211a351a74f5f3656003b928cdcbf2917f4fe0a1079b7

memory/2028-91-0x0000000000ED0000-0x0000000001270000-memory.dmp

\??\pipe\LOCAL\crashpad_4648_BAGYYJLUXBYWLZAN

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 1f16ef5e94d33dbf6d545d8958707d26
SHA1 1feedcbca0a1b75e03665ea7b189d24ac2dcafe1
SHA256 7df6895e5d0a877ba0e055e691fefac75d1f3d5f15579d72c59e378ffe0b1998
SHA512 0710aa6d78efde6d63e2ccc6c6b3f1c69534209a1e0c7d78fee54edfaf0636bc03c1ceb91a57e53cf4befc35cd1b72e2ce275a74ca5b4c7449487a531301d03f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 0916e6e41a977a35cacb6a23edb3e798
SHA1 19f5ef6ea6b0595ccb577d371825e23a693980ce
SHA256 6c6ea98f500c9ecf8cbfd6d71adbf980a5c63dd76623c0d48dafff6cb418ebb5
SHA512 2411aec4d3800b9f97f500b0af261082c1cdb50847ae27bff4ad6b0cf30d74beb2c6d6637f1c2b7ce9281e6717a46cb56f6e8d06064bc1a0de539ac43b5113d0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6993c7b88c38bc7babed3e7f8d005502
SHA1 4d9e9ad6e7ced7a2249a17ac1d408faed3303292
SHA256 53b9f4069be5e6fcc69079ab1cadad09786676da74db020a1abd9f855380cb6a
SHA512 65ae253bb5654e35695f873821187a0e4f2278cac4450a21ac621e2a0a2aa719a9cb238e89c3ed004dd8bf2c07e81a2780ec834d94cf6aeb3cceb8ecfb677357

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6f0dcc25-0d3a-426a-b7ac-1ad3956c495c.tmp

MD5 ca2688c48f4301fab300090f565e57b0
SHA1 8a9f3f052cf38c737ccaf768151e55ad53ea3693
SHA256 787ebb2146bd34f61272f09b427720d57e4430f287fbfed20a1e52459d3612f7
SHA512 d0c3310ea057ce8a657f522f01982cfdc42abed191225a5484cbb116f6e4ed975a6c3a9318373087c885fdeecd043e6154eb00a561be063302b8d321811a7e1b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 9d2ba7d51a83ae3e17d7210a864d3c6a
SHA1 1720ef33c565a7850d4eb67ea8b802a7eba80def
SHA256 c8edd39c53879bef598d28d8bb9ce51485b1c4f494c582f01951fa7992dcba5f
SHA512 65081b60c6624f76996b12edde137d2dba8528d0f7412519ed3fd48221aad98aded32e65d930ecf8b11c9ae3dba4e87f037209b76751aaf4fe59d76c4c4bf42a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 42a26cd503fef4807ac146c5af2b26de
SHA1 027137d0467d789ec98ff59db10fd86007075087
SHA256 1e2ca4faa4f4f9dd3c0cba37a5d24659fbd37b2622b4b7750061aba6342ef88e
SHA512 a18f59875e86c34da1f2f75964a8ecf5ed38effb70ca2c2bdf291daff313b5326e6ffe0909465da1e3173643a85ecb5c060e3c99fc8f657d1502c235eb61fef2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\70a98357-b86b-4cd3-b0e0-573cd9e16f03.tmp

MD5 c3ff5f448698d4e6cf7d69494d3aa8b6
SHA1 130ac415d512b3ed7cdda5d71cf8ce7c793e9d80
SHA256 ef63250dd43a65938647a07759a5011a30d9b24c9b9016392ed17343bd538c5f
SHA512 4116b1bbfd68b006ea5700f31fe02b316627ccefe5fb3bb30b1457038aac78c5950f1204919c1b7b8f81ce30b258ddfecbd360d1c09d24d7772f75e85f68c340

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6283f87e164e15bd2808ecf47f4168b0
SHA1 1368c5e8df64518495481aab4abe62c571cacc7e
SHA256 22143cd0c220ad433b1502c1c4bf544b30f07baee7b50d400803383e838f4806
SHA512 8fe68ba4c807a9879e114e1ef4e0b24a9d9873a6a58a4fdc2f95a6d04ab973db59fa8d4a7faf73e5a271cd8aeef71b93230c96d6d74bd75aefac517778e71f08

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a6f0e02f-aa6d-4c76-80ea-4300f8c158d6.tmp

MD5 0d461ae3a174a07ecf3020c793c7645f
SHA1 51e7222597e62870c04bbcec60dac40129854f59
SHA256 c555b7cd98f5ab82f1f6225adcb8e953fac7f7f3336f13664b5b6c3c3388f8a2
SHA512 f18b03f18cd3fbfd6fd30ec6abf0fa8fd009fb674edb95e9906acd22513d2ebb8b68da1f41f3fad13b6ba809d2f3b8cb70eb2d027afde57adea99e5342d2a7e2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c0ce0b6cde4f37e686062b38ae67e1ed
SHA1 7740181de1948899ad4d0aa8a619ab105511e13d
SHA256 72a75ac7749dbbc49b211c901a7df654a21cf5445f524bf90595d3e205a3c4e2
SHA512 27a8595435715ea6763eb3f7643c47f1e7c13497b8950240337a06bbd7fae71a37a723d20f6a2465632eda90567b1644d531b64a91aabcef0c66902df6928fae

memory/2028-327-0x0000000000ED0000-0x0000000001270000-memory.dmp

memory/2028-332-0x0000000000ED0000-0x0000000001270000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 b439ec4fd1e87c8bfe5004c761d90f1f
SHA1 79befa2859eefff20126d98c710096b5e16759f7
SHA256 187202704475e165faa9a6565fded87dc555cbddce9322eda85e697308df13d0
SHA512 85940edebf67996dab4c85d35644b54a5e43be13da283a2db65e871fc13804f5a41913a28615b86d799e2b33e4df8508d5980ce9ea11916934b5ff47de6b5ebf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 3538a50b2f2d559e3ec972efb3d68180
SHA1 0da4dcd358dd6151bd2ffeb4476bd5c436ca65d3
SHA256 ca90884f51f74369164df15f08036815ae20141ef2eacadd996f03880a0a824a
SHA512 477087074211f82697b8c7b9fcc4405ba04456b1170dcd525b6f8d233114257093e6a4c919ba50ee1329122247fa0a3bc294b7ccb3f2771aa5346c4dc07ea1ea

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 6bda9f182daaf3f4a0f445a819e0e9ac
SHA1 298247e9788cfa165093dcf8ef884ff82a5f5334
SHA256 1497bbdc9d02b56bb6dccc0197c8aaa34ccbbe1643b6a82a3b2cd4515ed8be2d
SHA512 b6ee01e8af31c93416fa45969963752369f0114f9392ba256dfd2cd75ff8914f2ac209c4a3683d40aa032b7ecb5b54a777a76842a451f496512bb3702cec7a50

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 7316f137d7ea1631f144b0f4d4604984
SHA1 fb2f1bdf7617037e9237f8757e57baadffc8a477
SHA256 92926eb2c4daa62ff6ae7e8ff694f2b4417066b31134b365fde7cf25628a3c2a
SHA512 4a80c4b47350436ecccf5932439465b4c709b2af6c1b2d7308c5f4e22e1270b206e1e5607e3c9691a99028a56e606a2024955ed7729e9d97b0cdfdc0067aa206

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 56c36acefd41cf5ea5054b8f346d9949
SHA1 9e1a3755aeda95dd5c07283b7c19eb0f9ccf2dd5
SHA256 3ae02d73865cb64243bdd1b5b17c8d6085137650bab4c02f8190f19f344bdfa0
SHA512 b5dc90f162c25c8c698c3ad59e485e0278a78d78a8e5473753e89bd468eb2a96d685bfe80b3f704c023a127f72840cca8994115f69288b28d7a718851c39853b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 121510c1483c9de9fdb590c20526ec0a
SHA1 96443a812fe4d3c522cfdbc9c95155e11939f4e2
SHA256 cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c
SHA512 b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 3cfbddb44386fb1a29da5b3aac186749
SHA1 845e745c887e7ae0d8426d0b1ae4560b4d07f185
SHA256 53570590b351e7190ea8c7b694a55be9c3e1a5504f58bf138ca3c660f71a1fef
SHA512 292beac03fd6193b57b81ae34e9d679a26fcaf836167b96c52f160ef810d828ff2bbc2803c436bf890234baac605ef8de1358d4ed46eaf682ba624329e045e28

memory/2028-626-0x0000000000ED0000-0x0000000001270000-memory.dmp

memory/8560-656-0x0000000000D40000-0x0000000001256000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 3d416d69c33d77af486ad71e6ddc98ef
SHA1 633902f35448af4804bbc8452aebd80c13a42251
SHA256 28a72e33cefc854bdd8fc8b83fbebfcff49eda594b87cb219a3a51504459e72c
SHA512 de7c8ca930e343445d996a3d3e263ffabb4feff1cecb9cac32a5d997b2eddad6dcb6cc7c2697538f1dc04f9ee635503f8901fcc4effed0fee21a950dff8e1c44

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 2792ab4811de73e1c2ee01b8c765ffa8
SHA1 9cbf96d7e66ca5c70622eaf251ed05851068263d
SHA256 7384183e26787741341de98e2dd87c26094e4c950be798b26483c9b26a6dfd74
SHA512 36fc1570bb50d3859a7496d9f35559b103365d3406a6a9a788673b0cbf96de652f43ef0d3a9fdec1879089a6e0525a5556852cdbdfdf28803f1448f78c226371

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

memory/8560-828-0x0000000000D40000-0x0000000001256000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 a4680cf0267b475c76a93b2bfbc0450f
SHA1 c92598e6f68855ae8a4cb3b08abeb3581f6df958
SHA256 8a3f860cdc8ccc8dee620dcdad5bd70ec14d174c61487c37ca23e420299d769e
SHA512 bb0bde8ba871d49bdeb090e33d4490562ec038302cc07a73638ca0c566dbc8f16bf5c351dd44761bd19134d04b93ec73af4f28293dd16545f26acf5a8f7d13ec

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d9f0.TMP

MD5 b7a8e3e745d6fccfe51dbf01ff2a3bc7
SHA1 55e88a701f20a393e6990966c15eea125bb50581
SHA256 14268cd683baa86ef14d32ceef9509f9967885b84b806781f5f8f0f8415d2c18
SHA512 976cac6af67cf835e93cabb6f859cd734db26b27aa30a76c058381d4aa4a18f59d4cadb4bea1468fcf091256f8b1ac7ca9656f26b111f46c8a36203c03eec2f4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 59fc7f157e7043f152677e3516b8ecdf
SHA1 ad8b64c6623883db837c5473daaa799c1d5ce199
SHA256 6c50c978aea050c6e908bdf8101201a94aef6a06a0b9d0134eef77292a7420e5
SHA512 9e51e76588af6d63db8755e999d6dbacd43ba80ee6246325f60dc528cf4a4eb150c1880461cc82ed1784c49636ee237760dcc8f4fbeec796b94500ccd6ee368e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 d4e6edb3bf4c45853b8299cc17306a17
SHA1 bbc76e0de5a46f54b7c852f2c4ba6848221016ae
SHA256 4223b6ebc3f5cbb1fbb2c9e9c9a1767fba47660860e425fbc91a342cdd54c7da
SHA512 9962cb79ef3c98a5b2ca2d675cbec1b8c150710654d6fbf9e3ec1351b104bed7cf0be933a8807f247b15f255300a8469a582036aa35577bc8da2249856bbfabc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004d

MD5 e3038f6bc551682771347013cf7e4e4f
SHA1 f4593aba87d0a96d6f91f0e59464d7d4c74ed77e
SHA256 6a55e169bc14e97dfcd7352b9bc4b834da37dd1e561282d8f2cc1dbf9964d29a
SHA512 4bee876cea29ad19e6c41d57b3b7228f05f33f422e007dc1a8288fd1a207deb882c2789422e255a76c5bf21544f475689e7192b9a8a80dc2e87c94ee0bc6d75f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2aa52b1b-6a70-42dd-8393-5315719967fe\index-dir\the-real-index~RFe58f0c4.TMP

MD5 149f93cf3019226aef76cf1b10c204fb
SHA1 747121a478668f9058d9fd55658a8c79bb568b3c
SHA256 7bed621015fa33e51593bfcd7461b3b1be472b865dd3b8b7369207cdd100b83d
SHA512 ec70954d2afb1f1ab707d77bd7c2b0bcaf614c817b2be8d6bbfe2431808f6ec2b27d14579541b5cf587cc6ed89429c758d0fa66fc08786ed72f5e1ddf03ed7ab

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 4ee1b4acd79e588d5a9575ed8106fa24
SHA1 38b761769590f1586f2f5de64cfb8349fb9c9993
SHA256 ad19007153fca96afa1777ffce3c18cd6eef2de4a9d1dd34a5ebc6594e26f5cf
SHA512 fa994661cf3f3eec65d621afe64c78aab97bc9c70928cf2cd9163793f886c1004469cf9804d9f0d3a6feafb7df3329d4368a2b0f9dac4bbc1a69cee7dea21e68

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2aa52b1b-6a70-42dd-8393-5315719967fe\index-dir\the-real-index

MD5 622d1472ecbe68c7efcf50b08d143666
SHA1 20d5a77645d099ec0936030cf6ba289af620f76c
SHA256 38291680936ace44d27b69c3b89e4a9efe37d30bcf49e64038624031cf73067d
SHA512 9f983317449898565bb71e2055a6f1b6a0b5e21b66f9ee8c1af3469d17cdc7a5a75c2c113f1c85547d950f1c23680f10dd290954b9581bf942ace31863cab4a4

memory/8560-956-0x0000000000D40000-0x0000000001256000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_twitter.com_0.indexeddb.leveldb\MANIFEST-000001

MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

memory/8560-1028-0x0000000000D40000-0x0000000001256000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 f2cc679c5a2219c69a0486ec50618919
SHA1 fb852ea5dc6c03f1fe484cff81a486109620c314
SHA256 99574ae4a204eed4b10b0e330cbaa85c2d6ef73d9bfa2d94eeb18bcf2ff22f8a
SHA512 71511265ee2f752866d9356f17d8bc0f599c471216ab602d19ebec439044fbb7490d5b2dcaaa62cc45fdd8ebdd7466a300aac3fa9f00364bf8733ecb0145b29b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e35541f3c7aade552cee08b5534606b8
SHA1 df97efa5abeaaebd69525a9757a60cd74574ec25
SHA256 6f5fe383155e36ea14c5ac423a2dc3fd7a1d513410038a0445548056f973329d
SHA512 046c96e42629d144ca799b4befa39c01b25a2a36d6fa99e7cee9843b21e8baeb579219e4fab8eff5303f885ca8c4c8a922249e4cbc06f4d2c67bed9abfa8250c

memory/8560-1078-0x0000000000D40000-0x0000000001256000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 05128f1d266585e929884bb01d4a6849
SHA1 6bc822f320d47e3de9ff3d51bf26edf0c46347d8
SHA256 8f9c18b28539a0fb51aa0c485adc73feb48d1904e75f09d49772d3d9ea2c1007
SHA512 1a204f24ae7ddb16aa438c6264081bb7ab28e753856dc8d6d38c27511dfcb5ec429fd091d24cf4081425f48e1845689e2955c1ea409e2a5f2a01d0b98270ae71

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 d8cb0e92640addb8ce0309e977d68404
SHA1 ad808290709e44bf5b7b925f76e888afa36030cc
SHA256 cc42eebb2dc5ffec922199e9629a241de7202efc0c0ca631f7fc71098f82dd2f
SHA512 595108d9b149acb8d1aa88e81a986aa24f69b262708bbb0d17145af692a441ce3da9f71b5aa326594916c3318b66ce4eea0aa541220024edb54c34372073faf9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old~RFe593464.TMP

MD5 54e97ce124cbd0acfc136d33b6616824
SHA1 2d5b5ede72073feaf409af6ed32a6260d83dec13
SHA256 0358b982e072387f54723f0ddc8d2a05a3b4eca25040bfd07fa8c77ebc0ea4e7
SHA512 af43903d017033fbd286a79c3bad0ae916c8629d1a7d1337ee9360c1844bb4e870166bd29a1926484cb740de18cc0c59d11e73525876427df76f9e5d328fa6a7

memory/8560-1257-0x0000000000D40000-0x0000000001256000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 b989d1b957e89292346e22963d804875
SHA1 f8e3db1a03727166db8e4f11252e37f7fb338dd8
SHA256 f26f3c56ca75881581320bef58622448c4616fbd22f848a2d7dc6197717e38cd
SHA512 151a293bb60eaa4ff4524d42057e7a1802ba6ea66b503fdeecd7e726290090398b23c22956ec6681e3edbfa00336dd72047bfa4aad89aaff975f9bd6e6f76418

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

MD5 b7b3b15c812af102c779795dc94a70f3
SHA1 5a9080a16d4379d68d669d78bbc2e21f5945d5dd
SHA256 d8301f365845cf8d58c8cd4155a737724704f0ef785e73e95063bc97c16ecbc2
SHA512 b6e42fc1dd3e21c74c7d5bc0e6de5a6ace39e022c02f01e9f308fa5a615ac08f529f1983cd3d9ace63ef3b83bcb7c9c2772ba8f4e13fcbbef3f8c3a788b6283f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 b41147247722e6e153fa1ce807037014
SHA1 ebc467dd640c307aad1f4c56e94762d7c7bf2aaa
SHA256 8c86745f342cd7cdad8b772f9968de2630d5a36ed021da9e6f8b8b8ab694636e
SHA512 792baec5ebfdf0b6576686ed74b3ec805a7fd3250b4199eef834ce8371b26358b759bb9f3d1850738d42658657c170ef559cad5622f60bbfde46d1e64edb6f60

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 47e0d23e035d1745dbdaa1a683114dab
SHA1 079ae7052d9662d845a1b202b5b0d2db3ceb28cc
SHA256 2b967e5dc3c683480c3f8f50ab5806757a1db2270a81e2d046496a18887fb59c
SHA512 77f82a35905953ab634d55bd350cd03f47ddf9da9a874abe88a787702c47e442896a4e039f23310dd1415d698a010e63769a38a80b5a24a013436d479f915adc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 13f61b108c05e32d5eeb05bfb105f1d7
SHA1 7c0f8a2310859724dc4bfaf4ed7f0fba2fb66e1f
SHA256 79e7dcf711d269383d0be0c12b8905732985471502643e42e9ac43387a0326fc
SHA512 227f37eb7a6911bca2f854fa756225e3a54e88e749f53aaa7a359d93812600046e9b83aa9eeb1ac33154788ed0f3ef842a0dd0495efd50a71bca995f319ce531

memory/8560-1460-0x0000000000D40000-0x0000000001256000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 34807a6e70bd50d2c8774f0b960fe9d0
SHA1 6d5407588878185936ce9c02d43df3cc56ac787a
SHA256 40ab49a2fc6ce0f23ddadba280d34bae5b17f6a6bb51240b64a6033b93c23d56
SHA512 52c718ce55ddb580d5004c0ebdfd3ac2dabc75517ef87bd3602d72f679e98880c8e0d6fb40e7d515d0e82f7c0d3e76a7cc19e89161a12443a3ec009391a85674

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 36639beb8ce05f0430890b2c244ba10e
SHA1 c7dea96f369170e35accb6b133a68acb59c2a786
SHA256 03962816c455228c733710f8310dcf16c21e27ba164a4c129679ceac0e9f658f
SHA512 306b620ecc6d47ff54ba1003116df181caf58b1693a1cd51c8657fffeaa785fdc0fba6285619a5b9c709cb053ddd36c2310bbcd837ea88f387444795056f5577

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 d84be624db6ce8ecb5072c785f868dcb
SHA1 d6fa8fe29bf6c54ece2e616dc82e88c75a282240
SHA256 5aec61ce3c3e3697521e44a5efb6507b296cd45fc617d3815be52a43e3e9bc9e
SHA512 1091473e7e4932806a22d19e68ff7c5cf7b701b3c81c007ec26ca4efca7f3db7bab059fac4d69d8cbbd5eb4be2a94ad5efd2e2c35a80aee4fec3f8e899f3e803

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 79d011f898905663c4b65dd5b1923831
SHA1 81842fc9b87741e0f6620b115b2ec7a0329032cf
SHA256 e7c9ec50fd51778b6e57ec6c6c36e33dfa71831eaed7801c67c18a9ca2431b84
SHA512 a2f9c77322aeb39960814708603945bb429d5e578f561f9f265141fd84633816461dee183074ec4c6c49609d5469631e5571ce93b53812d27df63476731018e4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 39e093ffaf9196e36c3b9703deeb0922
SHA1 4a0cfb2bca8cdfebd5a80476d25280eddecc8fc4
SHA256 44f9e40ce6607e13d34131d41f69b3888898144c468764fca40f33add471d683
SHA512 58048f50f4f0e054bce3c80d8bbfca79a8ee80334936c019590f66bdf13204c44f924358c3358a0caf9a9dd7a78e3aa6232df007d6da1c06b342097a4a31d72c

memory/8560-1632-0x0000000000D40000-0x0000000001256000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 ab7ea0f4ae23df59e85f6a8d0396eb04
SHA1 2f5ec6ead75413cb9587e71a874aab283c537648
SHA256 5a8e873a92a7f024233f137bb95d4f4e5038fe29ae80a0216739030b0f52f7cd
SHA512 46dbc3bb7484dae6aa1befb9a83bc369d6474922b9fd636adb09b7fb4cb3d9c26caf15a1687c4eea22c9e951d2b5ec3fed87bb3e34b5a8699a098172a911c6b8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 50d81637daf959dc314c569fcffc507b
SHA1 9df4d2c9c91d3ddd48ef984d3dcb77680a7d4580
SHA256 ca618d0f59a361964568e499a02c094ad3937d547b5b3a0c4342fed2af04d7dc
SHA512 51e69dd94ae1b783af8d4227bfb8bdba33253e3433d84f56599c519c7a6e57325fadfd16bbac78fa24e64ea3098afcc32957e18fb95218d99f05a2803028b8a3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 4fcb27386ca3bd1f8309b45ea12d4162
SHA1 f102e5c9f9f7205ad8a0e27b51fc63b0b1143c4d
SHA256 b1784d59952f04ea156ae323ec21412715f82e048d3370459445a240048fa332
SHA512 a3ee79ffb8f7516744ef54f9da0c3911a23689a67b8a93ab69995118213e6e78ceb76122221db1519fbc4075dfcf4922fab8407db6c9138c03d68bcb499566b2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 239cbfc36046e91106141ba8c0e3ab53
SHA1 d58e99283ae9a850a98e75b28ce3f564fffb79f7
SHA256 96e17430e5368500c7d6a0d56d0feb51bd10a2b678fdce7e2a13449dda233193
SHA512 f8718a78e48215f8c98651cb6781068b272ef0761f5747eae511a40c72eaa0de0ce479b982220977f992f74d3735c0f6f9c0f1e39c66d1c95ae56524ffe350fa

memory/8560-1806-0x0000000000D40000-0x0000000001256000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 c6798c09be81e556b20979444c93f854
SHA1 ca148967ce477109d57bd9135fee91cd6b64da70
SHA256 987632f64390cfa7008cb586f0579524b3e0e23c9f472174d26b66cbd194ac46
SHA512 b5c9f970b3db3c2c6f81c524baef7bf22c31699a592b63bfe4e9e9098dd0d660d605c2a73ab6ae5c92599e601781845569a287aae52854ef8f1472676de100c0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 b0fa7e4ff1378ccdab98bb0bad9e0cf6
SHA1 b8e9498b60e4dc74530132fccb93332c68bad0e1
SHA256 0589eee0abad14c17afe5b583d6e87d3675656daa8282dfa0e79e86e45bed50a
SHA512 b43da64e9b1e8008615a4cdeed7a4c6fa2cbe54a4f93c4f03c265d0aa2d5d0761f1dbc5a00ff723eb4c0fbcd8bb8c6d0df2dde507fcba550748fafcd3baec967

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 b516b034d00d19313453dd07c3370484
SHA1 8f7c10815af7a022d6c578c627c5ebc902c82563
SHA256 77a00b6fc7e09f6dd13739bc0b26bebef17b9eda35394a42836e6e1777fc3826
SHA512 35cc10c4c4fbb6d7cee0ca364bc03f829dbe5f829e025ae4595c23cab7048091188d882c00152db7438d6f28ba666b681314c04f479a8a6e9d289ef632433dfe

memory/8560-2000-0x0000000000D40000-0x0000000001256000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 65527bb3e5cee3c5569b63a75bdff9dd
SHA1 697ba1c2935ec9a8bca3b812210604e1f3f9af8b
SHA256 3ad700dd2eeec5efb77cd58227bfec342b4c43545f7d430baa1b0934e531c617
SHA512 40f661edeb4726a0c964e84d5c73541042f2b033e84347a85da0258e05a752dbbd201294bd44c82b2c14b1148f8238bd82a6248bd13bbc03b5f42ed4d8e6ed55

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\50d068dd-4078-4d02-b391-89b257f583eb.tmp

MD5 ddb7a49fe365a7629210ab5efe474bf0
SHA1 db8708f9fde643d3204a8fa0d715ed1def5525a3
SHA256 ae3152145b21633cc449485b09c96321adcb6c45d51891701aa694b7d21580f7
SHA512 552c9ea1bb5e6d96648b40ce31a8dbb2befb69b014458d2f1f9e5ca547ede675d50c146fbda8c7012103492c82fa9ed1db07b1a1c77d6c5a8ac677e68f00f5f7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 6d6e33d0d4328bf56c6ce8d08c3353e6
SHA1 bc8b43246aa3a90412f2f58a455f7453e3e8d971
SHA256 4ddf60be6914e774f7620272e738c6f265899aac3ed0f89314a0ed154799abcc
SHA512 dcf1923d8da651a139a39984a0affc55cea33ef2d02b433bce77f9f168ad6636fc2f7e09c2a1087f0c78288967f7aa56413231bcd26c673b4a0b50c43bf3a31c

memory/8560-2582-0x0000000000D40000-0x0000000001256000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 e7395a6faf167962c093d1d484e0d8d5
SHA1 e74a2a5cd017dc5032ab9959c6da4e168716f649
SHA256 1a5de4db5f6aa18802782466f10190a44e1dc0917ea21f5f0993915764960959
SHA512 69bed0027609c62c2c9e3152b9bcdfe2e767a360e2e5baa4f59e9fd77b6dd5bb05364a8cf38c893640366ae74b71f0f23ebcf6891b2c893721848774f5d9d37d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 e99651eb493152d9bd74e7113580d427
SHA1 0efe56cfcdacb2069f1a562be52f35e452741c0b
SHA256 cf3dc58281409e32506d8fa688267efd0e7bfcc85a1b29580238b6592a7157d0
SHA512 7d112dd2f98c63ddba78f9a1090c1fbd6b585f5a50827168f6b40a34872bae861f07f0970a915d034e69404a31be68c79115909ae9b917d30835ac56f4cafe20

memory/8560-2613-0x0000000000D40000-0x0000000001256000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 28adf001ab81848ce2784a3b6decd0cf
SHA1 efb10cb36c51380b6b0036610314c50cba771906
SHA256 3a38d05c02a01bb7bcf61942496fa97045527e70ed23335d78383e69e843d284
SHA512 2a39bbddb4af863cff6bbcc37f0220d4817ff3e29e327dfd76824d6121af2fef8b15388b72f48ff29d259192f4cbc779fb382bf34b8ae413bda25ef6bbc8ce21

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\9f715e78-eeb9-4541-b27d-50f5b7a84be4\index-dir\the-real-index~RFe5a3450.TMP

MD5 44f9647642834fea3e32720f0aede128
SHA1 b0a02c35567032ca4ba129b1b6512a8e1bea5b1b
SHA256 fd23a48c13773a041b4828565ec724d7fce545d75062ab3554934b1376c7a89f
SHA512 7c0378f4e885dc7fd2b4badfeac27a217e6dbf922c776480961a25fae1ce4131fbef9a52b314165498f9ca3e4dd3e593cfed8fa8cb54066e611f7fa240a438cb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\9f715e78-eeb9-4541-b27d-50f5b7a84be4\index-dir\the-real-index

MD5 ead3643ef98ea25d4ac38e3a6779e613
SHA1 383b0ab12f5a664cdeb26b7b4f8f374b481e0b83
SHA256 c70bec22bc8212759552b98d625b2272beaa10f2be9754f72f03b0338e59468d
SHA512 b050acf0cf70ced1161950b15acd8d86b14189cce0ad18e4cddb39bfa4dc60b1ed0372b608376927c99917e94328b24f8d5ed94b6660d14aea52dd7efc48f101

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

MD5 828acadbb7c24fc56ee10a7369cd4026
SHA1 08b74d9876da1aec029eafcde6a92928aa8705eb
SHA256 431af5a055774ff5b9154bcf987f49d5ddf293722a6d3c24d1a8471d21b0b090
SHA512 02bb7c12c0f2f7d097fa1a2a44582d59710501eab52a84c8fa781b8d5d3bece6b5ff306ee079f7cccca5a6055147bc684ee6f641fb7cbccaef9af4315c62aaef

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.linkedin.com_0.indexeddb.leveldb\LOG.old

MD5 166bcb2c4d2a60bc2e056915fbdc61d8
SHA1 673de7ad56a8f9eb2f031a9fa3dda0a562c272f6
SHA256 deb8a49582b51fca9aac7f8e4d9fa9f7130f6883b388f3e1e7261509e8babc97
SHA512 f3f5046f3c4961235ac60c9f4d5d73ebab0b0d5e7d64bfab0caa799f7611248dbff5b33edd3d6d61a6fbc92a98d514a73f9467345c1d6abd73f10fae9e920306