Malware Analysis Report

2024-11-15 06:15

Sample ID 240224-yj82zach93
Target thunder.exe
SHA256 eead021690a43a1d5e7d7148000c3ab9339cb0d81708ae44ef82fbbe3d7dbff7
Tags
lumma stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

eead021690a43a1d5e7d7148000c3ab9339cb0d81708ae44ef82fbbe3d7dbff7

Threat Level: Known bad

The file thunder.exe was found to be: Known bad.

Malicious Activity Summary

lumma stealer

Lumma Stealer

Suspicious use of NtSetInformationThreadHideFromDebugger

Unsigned PE

Program crash

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Delays execution with timeout.exe

NTFS ADS

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Enumerates system info in registry

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-24 19:50

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-24 19:50

Reported

2024-02-24 19:59

Platform

win10v2004-20240221-en

Max time kernel

454s

Max time network

450s

Command Line

"C:\Users\Admin\AppData\Local\Temp\thunder.exe"

Signatures

Lumma Stealer

stealer lumma

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2828415587-3732861812-1919322417-1000\{08BC6E56-D283-4D31-B92C-BA29BF7A3772} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2828415587-3732861812-1919322417-1000_Classes\Local Settings C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2828415587-3732861812-1919322417-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\Unconfirmed 540965.crdownload:SmartScreen C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1068 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe C:\Users\Admin\AppData\Local\Temp\thunder.exe
PID 1068 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe C:\Users\Admin\AppData\Local\Temp\thunder.exe
PID 488 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe C:\Windows\system32\cmd.exe
PID 488 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe C:\Windows\system32\cmd.exe
PID 488 wrote to memory of 692 N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe C:\Windows\system32\cmd.exe
PID 488 wrote to memory of 692 N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe C:\Windows\system32\cmd.exe
PID 692 wrote to memory of 3500 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\certutil.exe
PID 692 wrote to memory of 3500 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\certutil.exe
PID 692 wrote to memory of 3064 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 692 wrote to memory of 3064 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 692 wrote to memory of 3624 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 692 wrote to memory of 3624 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\find.exe
PID 488 wrote to memory of 708 N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe C:\Windows\system32\cmd.exe
PID 488 wrote to memory of 708 N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe C:\Windows\system32\cmd.exe
PID 488 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe C:\Windows\system32\cmd.exe
PID 488 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\thunder.exe C:\Windows\system32\cmd.exe
PID 2880 wrote to memory of 3352 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2880 wrote to memory of 3352 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4056 wrote to memory of 3764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4056 wrote to memory of 3764 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 1096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 1096 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3104 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4192 wrote to memory of 3872 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\thunder.exe

"C:\Users\Admin\AppData\Local\Temp\thunder.exe"

C:\Users\Admin\AppData\Local\Temp\thunder.exe

C:\Users\Admin\AppData\Local\Temp\thunder.exe 1068

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c color b

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\thunder.exe" MD5 | find /i /v "md5" | find /i /v "certutil"

C:\Windows\system32\certutil.exe

certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\thunder.exe" MD5

C:\Windows\system32\find.exe

find /i /v "md5"

C:\Windows\system32\find.exe

find /i /v "certutil"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cls

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff911fa46f8,0x7ff911fa4708,0x7ff911fa4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff911fa46f8,0x7ff911fa4708,0x7ff911fa4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff911fa46f8,0x7ff911fa4708,0x7ff911fa4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11863636788915702198,6562603999762976468,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,7043551107672800464,4314704077331546414,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,7043551107672800464,4314704077331546414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:3

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,11863636788915702198,6562603999762976468,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5288 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2356 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5284 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6740 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6624 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6688 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6172 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6900 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\Temp1_CFX-Bypass-main.zip\CFX-Bypass-main\CFXBypass.exe

"C:\Users\Admin\AppData\Local\Temp\Temp1_CFX-Bypass-main.zip\CFX-Bypass-main\CFXBypass.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2628 -ip 2628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 764

C:\Users\Admin\AppData\Local\Temp\Temp1_CFX-Bypass-main.zip\CFX-Bypass-main\CFXBypass.exe

"C:\Users\Admin\AppData\Local\Temp\Temp1_CFX-Bypass-main.zip\CFX-Bypass-main\CFXBypass.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6116 -ip 6116

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6116 -ip 6116

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6116 -s 1084

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6116 -s 1108

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_CFX-Bypass-main.zip\CFX-Bypass-main\CFXBypass.sln

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3504 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\Temp1_Temp-Spoofer-Lifetime-main.zip\Temp-Spoofer-Lifetime-main\Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Temp1_Temp-Spoofer-Lifetime-main.zip\Temp-Spoofer-Lifetime-main\Loader.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3228 -ip 3228

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3228 -ip 3228

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 1084

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 1104

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3228 -ip 3228

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 1140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1316 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2340 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2160,17871638439514730556,11309112879059190906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6148 /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\FiveM-Cache-Cleaner.bat" "

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\FiveM-Cache-Cleaner.bat" "

C:\Windows\system32\timeout.exe

timeout /3

C:\Windows\system32\timeout.exe

timeout /3

C:\Windows\system32\timeout.exe

timeout /t 5

C:\Windows\system32\timeout.exe

timeout /t 5

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\NewSearch.cmd" "

Network

Country Destination Domain Proto
US 8.8.8.8:53 3.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 keyauth.win udp
US 104.26.0.5:443 keyauth.win tcp
US 8.8.8.8:53 x2.c.lencr.org udp
GB 2.19.169.32:80 x2.c.lencr.org tcp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 5.0.26.104.in-addr.arpa udp
US 8.8.8.8:53 32.169.19.2.in-addr.arpa udp
US 104.26.0.5:443 keyauth.win tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
N/A 127.0.0.1:55378 tcp
N/A 127.0.0.1:55380 tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
GB 92.123.128.174:443 www.bing.com tcp
US 8.8.8.8:53 174.128.123.92.in-addr.arpa udp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 th.bing.com udp
GB 92.123.128.180:443 r.bing.com tcp
GB 92.123.128.180:443 r.bing.com tcp
GB 92.123.128.146:443 th.bing.com tcp
GB 92.123.128.146:443 th.bing.com tcp
US 8.8.8.8:53 180.128.123.92.in-addr.arpa udp
US 8.8.8.8:53 146.128.123.92.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
DE 140.82.121.3:443 github.com tcp
DE 140.82.121.3:443 github.com tcp
US 8.8.8.8:53 3.121.82.140.in-addr.arpa udp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 8.8.8.8:53 github.githubassets.com udp
US 185.199.109.133:443 avatars.githubusercontent.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 185.199.109.154:443 github.githubassets.com tcp
US 8.8.8.8:53 user-images.githubusercontent.com udp
US 185.199.109.154:443 github.githubassets.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 185.199.109.154:443 github.githubassets.com tcp
US 8.8.8.8:53 133.109.199.185.in-addr.arpa udp
US 8.8.8.8:53 154.109.199.185.in-addr.arpa udp
US 8.8.8.8:53 repository-images.githubusercontent.com udp
US 185.199.109.133:443 repository-images.githubusercontent.com tcp
US 185.199.109.133:443 repository-images.githubusercontent.com tcp
US 185.199.109.133:443 repository-images.githubusercontent.com tcp
US 8.8.8.8:53 login.microsoftonline.com udp
NL 20.190.160.17:443 login.microsoftonline.com tcp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 private-user-images.githubusercontent.com udp
US 8.8.8.8:53 collector.github.com udp
US 140.82.114.22:443 collector.github.com tcp
US 8.8.8.8:53 22.114.82.140.in-addr.arpa udp
GB 92.123.128.146:443 th.bing.com tcp
US 8.8.8.8:53 services.bingapis.com udp
US 13.107.5.80:443 services.bingapis.com tcp
US 8.8.8.8:53 80.5.107.13.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 185.199.109.154:443 github.githubassets.com tcp
US 8.8.8.8:53 api.github.com udp
DE 140.82.121.6:443 api.github.com tcp
US 8.8.8.8:53 6.121.82.140.in-addr.arpa udp
US 8.8.8.8:53 codeload.github.com udp
DE 140.82.121.9:443 codeload.github.com tcp
US 8.8.8.8:53 9.121.82.140.in-addr.arpa udp
N/A 127.0.0.1:55392 tcp
N/A 127.0.0.1:55394 tcp
US 8.8.8.8:53 sideindexfollowragelrew.pw udp
US 8.8.8.8:53 gemcreedarticulateod.shop udp
US 104.21.80.171:443 gemcreedarticulateod.shop tcp
US 8.8.8.8:53 secretionsuitcasenioise.shop udp
US 172.67.213.168:443 secretionsuitcasenioise.shop tcp
US 8.8.8.8:53 claimconcessionrebe.shop udp
US 104.21.58.31:443 claimconcessionrebe.shop tcp
US 8.8.8.8:53 171.80.21.104.in-addr.arpa udp
US 8.8.8.8:53 168.213.67.172.in-addr.arpa udp
US 8.8.8.8:53 liabilityarrangemenyit.shop udp
US 172.67.182.52:443 liabilityarrangemenyit.shop tcp
US 8.8.8.8:53 31.58.21.104.in-addr.arpa udp
US 8.8.8.8:53 52.182.67.172.in-addr.arpa udp
US 8.8.8.8:53 sideindexfollowragelrew.pw udp
US 104.21.80.171:443 gemcreedarticulateod.shop tcp
US 172.67.213.168:443 secretionsuitcasenioise.shop tcp
US 104.21.58.31:443 claimconcessionrebe.shop tcp
US 172.67.182.52:443 liabilityarrangemenyit.shop tcp
US 8.8.8.8:53 github.com udp
DE 140.82.121.4:443 github.com tcp
US 8.8.8.8:53 api.github.com udp
DE 140.82.121.6:443 api.github.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 8.8.8.8:53 4.121.82.140.in-addr.arpa udp
US 8.8.8.8:53 codeload.github.com udp
DE 140.82.121.10:443 codeload.github.com tcp
US 8.8.8.8:53 10.121.82.140.in-addr.arpa udp
US 8.8.8.8:53 sideindexfollowragelrew.pw udp
US 104.21.80.171:443 gemcreedarticulateod.shop tcp
US 172.67.213.168:443 secretionsuitcasenioise.shop tcp
US 104.21.58.31:443 claimconcessionrebe.shop tcp
US 172.67.182.52:443 liabilityarrangemenyit.shop tcp
US 8.8.8.8:53 github.com udp
DE 140.82.121.3:443 github.com tcp
US 8.8.8.8:53 api.github.com udp
DE 140.82.121.6:443 api.github.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
GB 92.123.128.149:443 www.bing.com tcp
US 8.8.8.8:53 149.128.123.92.in-addr.arpa udp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 r.bing.com udp
GB 92.123.128.132:443 r.bing.com tcp
GB 92.123.128.132:443 r.bing.com tcp
GB 92.123.128.177:443 r.bing.com tcp
GB 92.123.128.177:443 r.bing.com tcp
US 8.8.8.8:53 177.128.123.92.in-addr.arpa udp
US 8.8.8.8:53 132.128.123.92.in-addr.arpa udp
US 8.8.8.8:53 14.173.189.20.in-addr.arpa udp
GB 92.123.128.132:443 www.bing.com tcp
GB 92.123.128.177:443 r.bing.com tcp
US 8.8.8.8:53 github.com udp
DE 140.82.121.3:443 github.com tcp
DE 140.82.121.3:443 github.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 8.8.8.8:53 api.github.com udp
DE 140.82.121.5:443 api.github.com tcp
US 8.8.8.8:53 5.121.82.140.in-addr.arpa udp
US 8.8.8.8:53 objects.githubusercontent.com udp
DE 140.82.121.5:443 api.github.com tcp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ce1273b7d5888e76f37ce0c65671804c
SHA1 e11b606e9109b3ec15b42cf5ac1a6b9345973818
SHA256 eb1ba494db2fa795a4c59a63441bd4306bdb362998f555cadfe6abec5fd18b8c
SHA512 899d6735ff5e29a3a9ee7af471a9167967174e022b8b76745ce39d2235f1b59f3aa277cc52af446c16144cce1f6c24f86b039e2ca678a9adac224e4232e23086

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 65a51c92c2d26dd2285bfd6ed6d4d196
SHA1 8b795f63db5306246cc7ae3441c7058a86e4d211
SHA256 bb69ea4c761c6299b0abbc78f3728f19b37454a0b4eb607680ed202f29b4bb01
SHA512 6156dd7cec9fee04971c9a4c2a5826ba1bb3ef8b6511f1cdf17968c8e5a18bc0135510c2bd05cc26f3e7ae71f6e50400cf7bec536b78d9fa37ede6547cfa17e0

\??\pipe\LOCAL\crashpad_4192_KGBYHJSHRVGHAPWR

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b49c70036c4656b2edb73b7a34a0aca9
SHA1 0b788b3d9d6e377768222706b2bd9784197aef8a
SHA256 a2ece7efc5fad36a85beb2c7e12d7a24ab32bc91fbccea76cec6e2f7edbb6b0d
SHA512 fe9b15c1705986c5b2b8365f2803c3d1290234f106d673e1016d3dc919bf05d883dcf320af2c12b5ada8c0c050530a7f164a8284a48da8bee852553615df765b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d18480cd-273b-4f79-ad84-2a5669783f61.tmp

MD5 37e2e44853ba47e5144beb313d2ae1a3
SHA1 88c4b05a524db7dd6d20125cc3688b18449ac5a7
SHA256 f0f9e79c3b0a653b239bc7977e19aa98296a3f600b6f5b342ea9ff95a5b04726
SHA512 911a8c1d17ebb917ef077152aa3881fcca89dc91c8996be0037493c25bf99a974bbdd2760f6942821edf61ac7f5959b76cea413650cbc43f7b3dc61a1d0b07b6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c7ac064e2ceee8b0d9ac2a3783801cea
SHA1 181a37581db940fe404367c0db906c32aa1de13b
SHA256 e92fa55c11f3d6621255b9ac05f3b103fa8fb85c6f395d9cea1dd093b1da090d
SHA512 8f38f3b623f8618483e8248b7fa602579dd924f0a068c620c19d27756baf8c94ed680bc8845a0d83a1a70fb92f8c0a47bbf7d3d1d7b1dfef5f7190f47776c528

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 427c94fd9a9ad3292115c394ceddd3cb
SHA1 9d5a93d36ba6f5f754115e14ddf9484e6ca6430d
SHA256 a9a39a472da30fc6a6838571e026a6bb0d734ac6d82a737a2ab89900cb2859eb
SHA512 e95af916f0cc0dc80474ad00709033484b064fd12708fce142d200a09bad30c5102a6d7a36152d6681da41757281d915ed444968caa63eeaf9a253c6fc026d8e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8b396025838fba75470a25f04aa37bd1
SHA1 5240dbcaf5b01ed55916647ef11d9cdfcf75b202
SHA256 adb84f86c0ad233ec04c921c9f5a219fa115fafe61721a323d17fd50699e1192
SHA512 3bcb8869c124f4d4bd914741a43dbb0fc61fa206cc8ebb3395ac31c10c327937048629561fa0f7066a910e88801ef8837aca9e8c5f715db611b61faca9e0edd6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6fbfdea37c5c40c23e64a2b7f36d381d
SHA1 b9dda53d9037abf9a59cd2ed8c3c200ead9b678d
SHA256 2281b5a47a3342a33ab833223e34cfb45ccc21827a1d7d5054c04b70a0c9b85c
SHA512 c5668ed8e7ace7194b6c6d97c5f8cdc48ed5318bc3902845a47b8b3feeaab36d48e46906b20375762ac910a4bd884a4e73095426a0808b340fd0f03e36de8564

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 54481aa60bdaedaab676c82e2a44960d
SHA1 c9ab036bfec2eaf5ac1a361d16ef291152012a52
SHA256 55d21c66bbd119e1ec9a927a9b2e1731f57a242950dad7bec954b5347b95825e
SHA512 99eb87edd5d1dcf326c94451cfc9b8f2d430ee3b9a33a312310bdf5c8bfea2150a51d79c42a3710272cfe7779b2dae726f45fc297d77e105e4b6e7512653c4b5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 f47544084f1d13bbbb99836c4b14ab4a
SHA1 223a2600a2c564a8805ebc1457767458da629f1c
SHA256 e8ad538b0c3d745ca53c7606cbcae447d8b13ea0a3188e09874f83bf1166b4f7
SHA512 6c6e6e6762608a5e597deb3db22dd8789cb809ec1648b38054feddcfb7ad1d99556d9d592948456a3bc26d360f7c2b65b5911d0fc973ea4f06845d312fb51e98

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 d7ae1c3fe39f1097e93ff541b3a5f6d5
SHA1 3293607ebd33079fb7dbd2e7ae76066ec3ec2edf
SHA256 28e558b48c0e11c4e6a1a54946616af015280c9ee2393262757e217ca8e8167b
SHA512 98f4756e842cae673e1e22111b0c1e689e0486ee680705b9c96cebdcccde87651f54e7fbcd29b74632c896296728db4417d4a489ae2b5f3d0e5f4819048f4703

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58e395.TMP

MD5 7590f910dba856c7e22a74a09c412e2c
SHA1 82f66535878c4d78daee29252ee132b679a50d4a
SHA256 443b950fde2127374bade1fb3d3d7b954a6bbd94ea253cc36a692dd9fab0ee25
SHA512 ba8eeec65981b95003c8389918f07bc60d4ce0e29bc316a01c14ae3350bccaa4f8e84a3ebbf802ca362bf942d9beb2fdba4e78e0477501eb7717466498d2dc7e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 fcd29f726fdbdc5ab1ddb09e53872221
SHA1 8aaf7b77bb906dc9ac7392d3288975dc39c591ef
SHA256 371b51fd65ebc94d8f35d7964a8ee6f00a08ca5f301dbb40a35d0810f0d2e887
SHA512 023fbe52a0b3e423dbb4459684247f8f4508d6698dc8397dd62272ac0797ffdabf5292abba3d6476b8cac91b2bd6932ed7d9928d94243beb9326e822acb7c579

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

MD5 452cee87a193d291cf0394c0a8f961c9
SHA1 5ed43fad7737f776e85433d7fe7aa70d37eb4606
SHA256 6c31786e9b268be9d7e56b3e519845551550a8b0df4d3f55fbaf947378446c61
SHA512 355afabaa3be9194b4d47800be51e0ccecd9a857364fa57063b0866ee7595d33def0aed28eff297e582d16978e1ffb61921f3ee723e7c5e940dd48197b472500

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

MD5 a127a49f49671771565e01d883a5e4fa
SHA1 09ec098e238b34c09406628c6bee1b81472fc003
SHA256 3f208f049ffaf4a7ed808bf0ff759ce7986c177f476b380d0076fd1f5482fca6
SHA512 61b54222e54e7ab8743a2d6ca3c36768a7b2cf22d5689a3309dee9974b1f804533720ea9de2d3beab44853d565a94f1bc0e60b9382997abcf03945219f98d734

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

MD5 d6b36c7d4b06f140f860ddc91a4c659c
SHA1 ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA256 34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
SHA512 2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

MD5 710d7637cc7e21b62fd3efe6aba1fd27
SHA1 8645d6b137064c7b38e10c736724e17787db6cf3
SHA256 c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b
SHA512 19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

MD5 eeb2da3dfe4dbfa17c25b4eb9319f982
SHA1 30a738a3f477b3655645873a98838424fabc8e21
SHA256 fbfee0384218b2d1ec02a67a3406c0f02194d5ce42471945fbaed8d03eaf13f3
SHA512 d014c72b432231b5253947d78b280c50eac93ab89a616db2e25ead807cab79d4cb88ffe49a2337efb9624f98e0d63b4834ab96f0d940654fc000868a845084fe

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 45459e43d0b0a0c1ec7a1d0a0cdcf2ea
SHA1 993a1b66c83af383a12c3f13218c722a3a3af7a4
SHA256 92dff8d79644475b61c11309fd2f129ef4a89249d7a7bcd97179bf978a79484c
SHA512 59e61d59ec62d277bf8182ad0a256a42e046a76915b7af6e93f24e6fce345e9afb263152db0710eea096609020b567f7231689c22ed81355a21ea723e3c64dd6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

MD5 74e33b4b54f4d1f3da06ab47c5936a13
SHA1 6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c
SHA256 535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287
SHA512 79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ca06b665807e221d7b213ab0c3a02617
SHA1 e72ae40aa3365ecacc23487255de729b2a5ba2d1
SHA256 daa012bd6f2219c16a7537255e86059f8706aa83c65a469dbf201c996bdfe2a9
SHA512 c5098156a3a5a8ff913dc3f5c136d0c0729e9a1c1509efab67eaed7933098afef06f09950a415e691030364bd8e7f7d06809c6a1b641e34f1d2ccacc4d926322

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

MD5 bc4836b104a72b46dcfc30b7164850f8
SHA1 390981a02ebaac911f5119d0fbca40838387b005
SHA256 0e0b0894faf2fc17d516cb2de5955e1f3ae4d5a8f149a5ab43c4e4c367a85929
SHA512 e96421dd2903edea7745971364f8913c2d6754138f516e97c758556a2c6a276ba198cdfa86eb26fe24a39259faff073d47ef995a82667fa7dee7b84f1c76c2b2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 6678718ee1516a84f7bf62f50e83f364
SHA1 9f9d66641148791562791a34a16cb09e766dd07e
SHA256 a359b5fe7dab4bc9b5c9ed584c5fa391b15c0da44e30a11ac6a95938b49ff6e1
SHA512 97a895e7a1c731a4edc0301c4a19c81b0ce70431e4c136145ec947fd585d5a0d9d83d7e9876637381c534caebe3aa5d6ebcab2abb23a2c65c6605f7ad28c825b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 ce25683fef74f764f8b125b87b42e1ae
SHA1 b8b1d838b126885c00323e35d880f9fa806cf0ef
SHA256 cbc846d54c1a7571f363d3adcc41debe83b884a81d724873a36f489b0a44deeb
SHA512 73fc5a32bfaaf712680d10b82496ec08abf701c1f8a55bb3b60f594adbe86fb6a66cddf331557381da3685b2c0d857c17f21774fbd4bda543eadef32375e4ccb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 75b0b0bf3b137f81c260ee56bc6f03be
SHA1 27eee7973bfc6bc304c0f6188bd16110b26cdfe4
SHA256 2bb402965501d497d03a68410f5acde163ee6e49e44060c7175e3c582080139d
SHA512 b5c4375fbb2fd70ae59db13e4a8a3e4b5825b9b38877e97c0e4cafecfe0a372b6a8d5e634ac322f1468a2eee5ceeabde6b4224d8b0f0d795727a3af9ba94c0bc

C:\Users\Admin\Downloads\CFX-Bypass-main.zip

MD5 c5516828ab189999b29056a4b1fcb028
SHA1 afb6b58b1df5fe7246f929d8b5289e3f113005f8
SHA256 ba81e4b85bf608905f17eebf66d976f897743f069cfb9bb4722ddcf75cdf9d29
SHA512 8d31626fc4914dca9d00b5f217596a660000f82f4a2ac27be5699e27e82af4420978b9a6e03518fd523bf7b66b10924ce047ea532758bfb6c5dd7f9e32467529

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 7184e6c5f75290d4839c39a9404cc6bc
SHA1 0ede90f537f2558350c07a711d4848500271ca9e
SHA256 7748a1e2020a86b1e882e24d19e1126b2e015fe5294e646a5138060feff9b271
SHA512 91921beb96bd2777360d509a2482408f95cd14f03b82d8b6234c7f5d6cdd0c38257461f2efcf5d135237e781233c498bf61f6bf2b672b0478c661a6899ebfb76

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 79e87f26929171deaa13b5a47750e1df
SHA1 0e4d1c2050cd319df8fd2a9b033729adc253be43
SHA256 c92549fd0c10a0548f47c526faae7004a35333c110be346f7434a429bdc25b7a
SHA512 a623c0573a6e1a34a7339d7f466000d5b3a67f3af134513392f1894e14de8b7cb8d45b732fb1ced17c0422c513a5a9c06ff2717e4eb6530965f9561d1f6b9213

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 3d48709e28c7dffb5d3948bd8bfa322d
SHA1 d20c515ac9045c363fd055b01041ad0ade5c28ee
SHA256 73f2d3e192064a801ce32f7e2cc791d7f4480aa5eacf0cb04e791e2e98b2f49a
SHA512 06f8d6938ab6caaa0b299e19718e6384949ab38e6509d35711ef23fc8c8c0b2e368f8169dc424725621e8509649ae15b64addb409623801a707bdde493c5db10

memory/2628-1002-0x00000000012B0000-0x0000000001347000-memory.dmp

memory/2628-1007-0x0000000001360000-0x0000000001361000-memory.dmp

memory/2628-1008-0x0000000001360000-0x0000000001361000-memory.dmp

memory/2628-1009-0x0000000001360000-0x0000000001361000-memory.dmp

memory/2628-1010-0x0000000001360000-0x0000000001361000-memory.dmp

memory/2628-1013-0x00000000012B0000-0x0000000001347000-memory.dmp

memory/6116-1014-0x0000000000A30000-0x0000000000AC7000-memory.dmp

memory/6116-1020-0x0000000000930000-0x0000000000931000-memory.dmp

memory/6116-1019-0x0000000000930000-0x0000000000931000-memory.dmp

memory/6116-1021-0x0000000000930000-0x0000000000931000-memory.dmp

memory/6116-1022-0x0000000000A30000-0x0000000000AC7000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 2a12bc12e573f816a917b35bf8c6157c
SHA1 c753422c44cdd94d1f5e6183e466371df877612b
SHA256 c5650fc729d4d3e11d2943eb0b40bb0717b838bf6c0a62107d4a78d32abc8c1e
SHA512 a1803b3739ac7384c0c50dfad70c1155b6e112792587199ebd3a4f6dfb136f7f3ac8257f9265d47eccc9790b0a34e2e882807740a71613b0c4c0d15d71d133ca

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

MD5 37d91cb7ab7e0380558dd4b6d8e27304
SHA1 364ed7d6948f51ccd9cf4c618ea4f111d372849f
SHA256 a77aca7eb5f0d17113fa065ebb1e628cecec77a81d866890d0b26b04962bad0a
SHA512 33a3467c08e2285545da1b0d6786463bb6b065fcdd2d3d9083362e115ae4b6881e35730ae4c581251b3a8b33928c043ad608706c5d117044ca22d69c68955c3f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

MD5 382e5a265d13d3280b41f54973289ab3
SHA1 e36e2cadb13183bc03fa209b8bceae3384dbb0c4
SHA256 827c580a692dc92d7ae2d2d6acb946352dc61cf7676e27b796548cf793161463
SHA512 1b7b50d939d9db580800fe556149107fb4e062d28fdad79b8481af8e713731a1671e6a8a52f966bab82fc13b7a41fdaa225e133e66aef616048b39beccdad251

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

MD5 3151d288db2ebf2cdeceadbf9802592f
SHA1 d116b1588f36b90dbc30adc9f23923cca3f2f9df
SHA256 41d97fff19c888e615cc7016e72e4870efb5de6dc72a654ff9b174c9a61459ca
SHA512 2b579ebc1a9c2dbbc159edd389218dd4673100ec19918c9187778e4ec7b4797847c0745c886721d442032188a846e7cef3e3011754f8db22365f22df94c5b88a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 8bcc86c64707189bfeb6288bf3c267a4
SHA1 c276d070948c1416a6578dab10a84f4b7b2af63d
SHA256 e2c6279a480269e5369dd5c4613e69e2970d5aaf72f1ced65a864c7d0f260ec3
SHA512 a1f4a9c39b5b86efb092d98eb4674e49fab6b602588577b86ab57ec227fea6970bcfea745f06f39f42d153d27b89918a56ad67c0fbb6113a37eed9e5c7e6bf16

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e517818b641229e027a60c0cc7ca4a16
SHA1 9ac162f6fdb577540a4e0583eb31877033bfdf26
SHA256 3cc64c1a2b0aa18449f3fe9e935844a249252ba2fc6db6e24e6956cfbb3990c1
SHA512 a303c0172d1962d4426b9b8b82691e8012b48ec18909871340846bb1248d785427782f5afa5a2e7002bf5cb800e6185b67eff26301742fa702a7183105c9ef12

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

MD5 7f50a77557ba9fd051588b80fec72e50
SHA1 274c6b7f0e1254bb54ff7a2b264db49a3cea4779
SHA256 f98a6be809ed895e3900ce29f47fd8cbdec49cbc47118aa3429e0c5a290455b9
SHA512 29ef2a3bf5aa350109085c096748d46cda7d7f061e44e002adc4fcfdbdd559691012ec78e2254d7fe911c5bd31d7a506ddd1e0cd6945a5bd701ed3ee72383408

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 c3c32f45df717eae126f16402dfd95a4
SHA1 1d36b2424e2d88eae236f85900f3152e813fefe9
SHA256 02ab9931a3c718d5d9fc05afd6ad794455eef70448ff1cd90f716f3d04507df6
SHA512 6165cfb1bd184fe3f140621f1f26afca6c8d1015d1459eb6965dc0b7cf3822a05d3df650fa0bfacd46c4606e31223aaefd262984a8079d5e52cd3bb4efc8c311

C:\Users\Admin\Downloads\Temp-Spoofer-Lifetime-main.zip

MD5 ee2407cadf7d970e8f828cd0b2a154a5
SHA1 1991a745497dcfb99182e9acd11ab97442bcb150
SHA256 b20b682bccf264fb5cafa0f9379f597e5786aecdd17a7064f5ed4f4cd7a10924
SHA512 e8216793506b316835b9cf4d261c8b0ae55a216408d255360fa2909e849eefe2d700f2c5a4f281b514b2d8f353708490881d4799d8887c3093e4096bd0c672e9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 4bc2276269b1e23d55d389051b43741f
SHA1 1719885520ad5bc8463f60459755afbf15c23bb4
SHA256 c5e1dae81073c2abbeb08ffa972062b984bcb3ca3c2b6554faafb661de0e3410
SHA512 aab235ccba078f0c7fbd8324c58e4c0cb2665bffb677c9e522d740fc38598286ca1ece1c2349e3d09e0393b59b2ab41bbe77416e44d5f5f7a4f7c2749a4c6ec3

memory/3228-1163-0x0000000000AE0000-0x0000000000B77000-memory.dmp

memory/3228-1168-0x0000000002820000-0x0000000002852000-memory.dmp

memory/3228-1169-0x0000000002820000-0x0000000002852000-memory.dmp

memory/3228-1170-0x00000000028E0000-0x00000000028E1000-memory.dmp

memory/3228-1180-0x0000000000AE0000-0x0000000000B77000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

MD5 5da245e2beac9ddc93d590f7e3dfa3a7
SHA1 a1aea9a2d09be8bb260bc4ced83f8d3a2d18add9
SHA256 39fa6af5f326d31ea8da9b31fe00508c542f6cdd822124df3d06f7c32e4668ff
SHA512 afceade6e0bf714b7bba6692ac340184f5601e0d15bd1970d744181f38d4ef08cb97ccb01a78844e52d27d80f241fffd6fb9b1e502fa5fd17dd6ed8cc559c137

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 fe5edba37815ab9b30794d2754538f33
SHA1 8989e0fb43d3a4a041b63b2f4b968b6ba73286be
SHA256 a6aace948d0e0a12d53d939db4fa13c565ae211b38e8458b1949839000745e2e
SHA512 89b42d876efa40c2d0af060f93fe019446cf4224040ed9b4e385965555a6307e8f74205123d5318d440fe39d6832421a6e4b3301a5e5c89bd22e381c9666f892

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 1981596ee51ba67e0bd61e51d80b7382
SHA1 f43a9d2c4e8ca9274075e0fdf6639f8e29986d0d
SHA256 8dda28f1609d37b1deef7d8b9469034c98d847d38cfab0d9e6d7dfe77534e266
SHA512 229085345b5910d1d4b8e5633400e65bfd0a0ac89f0109e6aa0e3541bae31154fe6df247a6408ca807fe14e77a4b970722ae56ef940a0985e3823c5901d52c6e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

MD5 cf989be758e8dab43e0a5bc0798c71e0
SHA1 97537516ffd3621ffdd0219ede2a0771a9d1e01d
SHA256 beeca69af7bea038faf8f688bf2f10fda22dee6d9d9429306d379a7a4be0c615
SHA512 f8a88edb6bcd029ad02cba25cae57fdf9bbc7fa17c26e7d03f09040eb0559bc27bd4db11025706190ae548363a1d3b3f95519b9740e562bb9531c4d51e3ca2b7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

MD5 bbc7e5859c0d0757b3b1b15e1b11929d
SHA1 59df2c56b3c79ac1de9b400ddf3c5a693fa76c2d
SHA256 851c67fbabfda5b3151a6f73f283f7f0634cd1163719135a8de25c0518234fc2
SHA512 f1fecb77f4cdfe7165cc1f2da042048fd94033ca4e648e50ebc4171c806c3c174666bb321c6dda53f2f175dc310ad2459e8f01778acaee6e7c7606497c0a1dea

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

MD5 65b00bec774c969842aceb3199fbe254
SHA1 bd464411b9578497f081a5f8b6c04180b6ee0f0a
SHA256 d604e67e9d16b6b3d2f10687a36ec00597c48288fa60bfa957bd3ca78eadceda
SHA512 0c89ad2ca25ecd9058e42ed477bf6cd1512859c7ac63701206a82f2591b2878acc7f9354b6a23245fd186ca9b3c809cf7700c0e3e43f469c37580d8531d3beac

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

MD5 24cab279a1b1479cd2848b4cf4db97d8
SHA1 c59c889167dfa25ea85e0ab5b93db29270cd9a3a
SHA256 2feef54f715ea3e6192ec7a9d30e910044968a41d8fe91fc9b1b469ad574df51
SHA512 d1ec7ed765e5ec1b5e095a917437ddcd783ad01a1d6025f1125906617afc24e1d3a9cd702616d18c4231e5ffe60e5326a8dee855db42bc417568283c310e5c10

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

MD5 bb3fc9718561b34e8ab4e7b60bf19da6
SHA1 61c958bedf93d543622351633d91ad9dda838723
SHA256 d6ea500b6752094a4c340d4f5ed01afdca1925006077560d9a3f56054cd8d141
SHA512 97da30e9a0d14e6f9151539b77b2216e0f6b6cc4742f075077f9ff92f46f8b97e82f020c562625261eaa01bcf810ce81c0b7b71340ac566aef1bef5a07dac63e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ddfbe51c46984505248c0642fe48483b
SHA1 ed91115ac421903bb319573060d3635d4fca4aa3
SHA256 afb062872bfe31ff276aacd51f7bbb05987ad8ed0266647ba37fb8e8963c0358
SHA512 a24e828ff46b87dd2d092897270192ec3914d03dccdad27c28d65fbfa5d5e9823e26dde0934d20d08c5d073e25a98e3e1ca5335a429b89106c685a325d7df5ce

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 bdcb87b820098bdfbf509f5c490d1b79
SHA1 ab8662f3c6430333d932fb4cf5a95dd5d2937b97
SHA256 5e39c0c04d43f0b28e90cb4646a57b7182bad0a5e7a03cfab576c99e97d15c58
SHA512 a38aa140181c9b9b66742f42126037252f73a00786c3b1c0cf0183f21f199a5af920133d1d1e688e00bb24a5c8dbd23640b9194664f76a90989a05b18ccb3962

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 3f1b378aad8201fd948371224dc022b0
SHA1 58cfeb2257f6a93c227336d0e18af33a83231c29
SHA256 6e33e62d4b0661d8451bdaeb0971d621ce991c56b0ae58ba0d25eeccbac89ef3
SHA512 b6726e38e95bfefa402d2b9506dd32df679d509e4d15cfd2c6fbd7ea05b6c53b80c9a014e89e236e4707f13b50ce5d39752a4a1e61fd865f1960ff1938f1c70c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

MD5 1deeafca9849f28c153a97f5070355d6
SHA1 03b46b765150a2f308353bcb9838cbdd4e28f893
SHA256 b1639f4ce0285c41f4bd666f3fae4767094e3042b0379646b5ccfe04ef01ec19
SHA512 52122b7e3ca9b58eab42fc652c24b4b8c17c43970f88860372d8377c49c540c31ddc81b519f4d59d34e199571758f82ab2fea0737ac1f847b3d4dd75d7acac19

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

MD5 8b2813296f6e3577e9ac2eb518ac437e
SHA1 6c8066353b4d463018aa1e4e9bb9bf2e9a7d9a86
SHA256 befb3b0471067ac66b93fcdba75c11d743f70a02bb9f5eef7501fa874686319d
SHA512 a1ed4d23dfbe981bf749c2008ab55a3d76e8f41801a09475e7e0109600f288aa20036273940e8ba70a172dec57eec56fe7c567cb941ba71edae080f2fdcc1e0c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

MD5 bcf8a9566c19c82f4bdb43f53a912bab
SHA1 aedbcfb45eed11b7ad362b53ff32bacec9f932ee
SHA256 52c97dd2602b4d9ac70b61c3dd9b0f9869c5c211e2a4b52e94eda5e150349ae7
SHA512 cfec8603b3eecc261735ddb3d9f292f47e5e34761d73c33b8a1fa1efcf8e07b9b5595a28eac3b238842cf1f63a155b0376840f42ab22ad3186390bcfbc62adfb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

MD5 063fe934b18300c766e7279114db4b67
SHA1 d7e71855cf6e8d1e7fbaa763223857f50cd1d4bd
SHA256 8745914e0214bcd9d2e6a841f0679a81084ef3fc3d99125876bee26653f4253e
SHA512 9d0dfc21306b3a56c2ecdf1265392271969e3765e161e117c8765125b34793e24458217cf6514b364f351f47e65baaaf5856be0d13406a789f844d6ba8c7075f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

MD5 9237549144b5166af8e30fd88adb7e6f
SHA1 a6c5e62b29ed242a9a44d9769e6bfe99e26d6da7
SHA256 68379721c4065ca1c7c8f091cf53afaa4cf0cbb93e280e937a5f6b4573d9e10f
SHA512 1c17553cff7e0b3549e7f5648ecc062e48862b9cd15b349445622a36f65e3d3361f842f8b99448356ed909208d0944977d1b78ce06e62ab333b215d049dff31f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

MD5 4b4947c20d0989be322a003596b94bdc
SHA1 f24db7a83eb52ecbd99c35c2af513e85a5a06dda
SHA256 96f697d16fbe496e4575cd5f655c0edb07b3f737c2f03de8c9dda54e635b3180
SHA512 2a3443e18051b7c830517143482bf6bffd54725935e37ee58d6464fac52d3ce29c6a85fc842b306feaa49e424ba6086942fc3f0fea8bb28e7495070a38ce2e59

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

MD5 8d1ef1b5e990728dc58e4540990abb3c
SHA1 79528be717f3be27ac2ff928512f21044273de31
SHA256 3bdb20d0034f62ebaa1b4f32de53ea7b5fd1a631923439ab0a24a31bccde86d9
SHA512 cd425e0469fdba5e508d08100c2e533ef095eeacf068f16b508b3467684a784755b1944b55eb054bbd21201ba4ce6247f459cc414029c7b0eb44bdb58c33ff14

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

MD5 2f3c7b5f9221520efbdb40dc21658819
SHA1 df12f010d51fe1214d9aca86b0b95fa5832af5fd
SHA256 3ba36c441b5843537507d844eca311044121e3bb7a5a60492a71828c183b9e99
SHA512 d9ed3dccd44e05a7fde2b48c8428057345022a3bcea32b5bdd42b1595e7d6d55f2018a2d444e82380b887726377ab68fa119027c24ac1dadc50d7918cc123d7b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7116d760c26aedf6_0

MD5 d05c3fff301e2117ab8ffbf8f106ab43
SHA1 c72836a7d7dc5dafd89606d4002863b49e4a972b
SHA256 5b0319d3079e275425b8db9dcc0342cd0e05c3534de666d84bc3dd0baddfeba3
SHA512 bb594210d42dd8d32b9e9bd8166927415f47b76fd969a16fb1540d08cfbeb1e75f90f6f9939f40725ed932fd62c2c80dcbba766fe62a3fa844dab5303f1da9cc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3a3c8393d90e5773_0

MD5 b0f93619649e3ee7fb98d1440e4bca9b
SHA1 4fffe4d61199b563dbf635260df796dbfd0087e2
SHA256 37f74976aa59221e2cd7ca805d34442e58a43495e8a9aa701b7b25a054da23d9
SHA512 061f46922aa9607fd2b5d1bbb862e5d73a8beff5ed45c700d2b647d0a0dcf58daa51a3a9c478b47dbdb3ff29c9682e59c4a96669222fd88c4cb17932d0bca77c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ade44207b4253689_0

MD5 3973965620405c51d3a8ef3ea20f1ccf
SHA1 fe9797a019e3383ed946fb425fcbdeb61e9b41c5
SHA256 ea95571946270e9f583e69049aa75cd87b1a3d9984d5f87e111e9f3a346d842a
SHA512 df0218cb19c9a88d55ab0e2c0f8da4ced077dc020f4af75d03a9d008716f5561a1f20a0640182e38a3a522931c4fd8562c0ff0b618c33b1b986c301611e75048

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\041ab5e0a09f745e_0

MD5 e3ff3ee140d34caf5720c066d42e51c2
SHA1 8f7f3a53285b3887f65f6f65e6a3ab24be6932ea
SHA256 0217a77524345f1d50016e3c941a69958d71443abbe646e83bd08f740551d88b
SHA512 8683ae89f0f6975bef741fef3234a0132a41e41915c0ea81fdc7def8f34f4c198a1cf9991c879f70463cd565430d4d45f08a5642bf335957bd14d941b9145315

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0cb5819a5e419a6c_0

MD5 98d74d47cf98258f3b21064a1866f40c
SHA1 4ca65451eb135a2cdb649a916031a4de3ca51aab
SHA256 58851ac3e3d4eb367a262bfbb064b88c4e458fae105068bd6487866da5ac2c3c
SHA512 6d13db26d43ee3cb803a3c000727dfceefb16e32479f8070827052e9e5f5ba8c1aa1d225108d620d00dfebe2047dbe024717a7fd2224eeda22fe51ee5f0651fc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f21f7dcaa6f9208f_0

MD5 e16a7b411ff69c10ef06c917964d1566
SHA1 e51742755d8004be160581059f069d6845e13045
SHA256 5df8a58939325b1416920b64399bf2b0a5f5667d15b599249ff2ab1efaf86fd7
SHA512 f7e098b67ce46d3ce73a9fcf20b1401c08f0a040553670b01fa09a808a9c26242720ac906f33fa0431a9b4006a864cc820621e3daaf2ac1ae9a336819141e47d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bce7a0cec4e30e6d_0

MD5 d72c155a2dbf13803c5c04d37ae31e04
SHA1 dc93ae166fd8b899a32fc1595e332881447bb900
SHA256 398adf9eced466b20e4779025b2c7d7bbe26dcfff9a09d32d5f2292a25fcb9a3
SHA512 c18ac2f64ae2ca2c9b52a1dd1ca6782e424228e7fd3917723b00f62387a6aa6df8f8620c0b3adbf346c9e4e5011b7a2bd4e8f75bf773e5004106fbc56ccf6050

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ff3249ea979788e3_0

MD5 35e42eeb18d0f5aad39d5a959998cf52
SHA1 949e5e55385928ab6900bca68a628de9757321b7
SHA256 f155139a455ece58f8f711cbf2fbbbabbd4d208c6e83ec91987a33b5ad1215e7
SHA512 3d42877d44e1ad2ad1814b12bb6317e8c989e1f821d6c43d8de5ba76e0d4b6fe9915a45e1b92adbe463f50101738f8f5a73df59a6bbb6c2daac124cd25f5b1dd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\27c6c37348d5e89e_0

MD5 dc50a4178f6bc928943156527ca4b197
SHA1 05358319288b6d9bb6746bbde155543a23b4187a
SHA256 c13fb1951094c3c01884fa9ea8bdfe94df5e28445fcfffd55ba12493f175e8e3
SHA512 e94b323b161efa5475842b0af84c12ca2a59e68008eb0da54b6de336ebe92e51d898ddd6cd16abed6a4b4f3307f180409f674d63f0e4414ab746ab993055abdf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\03158d9548ecbd27_0

MD5 922d599b8e651e1f481129702070dd12
SHA1 fd6b59c5c2a60d435d7d298a47db692bd2d2e414
SHA256 bdc6f1dfdf49bd30bda9e84bc7e12e510e69ee519d35bb999cfc6fdedac81ffb
SHA512 6146d05350c819916da27a118592a5b5653c38164df73ca27ed25cf54b87a249928ba9223ce7fdb2dffc1d0e52524e0f7ccf7f8b5bedc4d30e91bca0d648ab3a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3ea042d487c3b9c1_0

MD5 bf2892222626c4fd335946f3bfbd7e79
SHA1 e58b431500d8b5563eb3c169c77cd5f353c657e7
SHA256 ddcdc4a9e3eaeae05ff5558346c0606b2135d179c23c68b5a279d18b21d21255
SHA512 0216f16e23e3dbe03ba980ecaea17ded4f5e73fe4303f483dc9427d3b0f83b03e54082fd586d91733a88bb62e2d5e350d2996d07338b9259437aa49f1de2b824

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ed799799b4d0b2f2_0

MD5 e749c21300f69df20d1a1ff3460532e5
SHA1 d0d5d45431c3cf476d1bfffaf9dd28adf4f0d66e
SHA256 b7462e51806e4edf11652b2adca3e4ac5c82b784a96e42d639c8d20a559d2cae
SHA512 006532500c8e0b515280fc5c60ed6774d3ef78b59594aa88a773818b39fb6f6c50c949d130d5d8ad957fe31bd496ced2e6030d2be65e54eccc38972ea9afe07c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\84ef792e97c5476a_0

MD5 747ce9a3d9872d56989f2fe8f38f459b
SHA1 c193e2f6a3fe0bd69101ddf5ee7517916e8da230
SHA256 e65dea5fc092486d2142528ea61a85830742fbd76405b7fa3a6364ead751ae4c
SHA512 83133273b0f9d0c43c18f8e77da5c98c4c064d5583b775fbb946c618301c523dbe65c1a80698274f9d52b9d5a1031435ba18c96d43d16ba9801800ff609efd2a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 2975f873879fdd232a1e1924816c6c17
SHA1 3bd0d7b0346c8e8adaf357030a2b5b0a6e37078a
SHA256 2dd43d3f130229c2694f2618d7fbacaaf35037491ca2b8558f6a8f294a0d8998
SHA512 7f624854dedab5055369d42bc48ffc7c409a4a85515a6705bf2c21e82542f5e8e37dc72d6ca254f6828c62a7a8536dc8640817e0095d223ab90ed8068f285e36

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 5e9722ac838e04e2b60b04f04d96deed
SHA1 3ff4666d968818643e5f4624375085f403bdcad2
SHA256 6a74869b5a7df4a588f6a8e3ed37815830f594972d844b0c19c74d2ed1ab271f
SHA512 08a30b5ccf34982748f46d0e39bcdb4e392948fdfc62d94f14d4ebb8a6b6e6944fa9265e90f6b31a18f5177153b4b2d4978a3f6df89461b505ab7992a8edfca2

C:\Users\Admin\Downloads\Unconfirmed 540965.crdownload

MD5 1f637924ea09790d83d439ce187a4772
SHA1 3dbc70d677b3ba7eb2504911ef756f24009bd37e
SHA256 0072f7c2a572d70698db5acdc7021a35c2c349920a7c5aa39c835573b5be00d3
SHA512 feb913a41944ed6a47fd4f7516ae7eaf6a0d7d6012d9e58a77213bbe6f8dd73f2a0fb63b2e88b5b0b164a67e574105e041aa44dd8a80a2bd71d49a19feb18062

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 cea550d977434cca476fc0c65650b93d
SHA1 5da3bedca054a8a06e9575be9ae0841061c02284
SHA256 5bc93dd294f08bcc530e0a122eb5597faf0e06143ef4bdc31dd0ff8bf973e7ab
SHA512 47761490eac83d0d5b1a9052ae96c4f7e5387c67cdd05f78400e53cbcbaaf7c8fc70e546fc156f8df21ca7b74eae4499a8632e21830fd87987dd9a663deaa8ec

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 fbcb3bb1cf1355e94b29a9e695b11b57
SHA1 e9a26d87133104b676850150cba45516547d7b8f
SHA256 267f9306e97a908e71bfd154448c56d2c45a196ea47e1742636dbf3c42eab18f
SHA512 986add8c3ff3633d2aaf3e4eea84f4bb83ac2bb8ac7da7ac869bc2e888a30ef8862fbe3a4f2a44d49a862cda3a9d807c0f01be9b9d013284dd166935d66f27ce

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 0f185b576dd6ec4426992b1247060865
SHA1 a0b98df98b016078c2c8aa46506d6bf206950cd2
SHA256 2cc0d14d54c47a9fd19d658b203aa557402690c200ab1827cd8cc96a5c4628d8
SHA512 b40acb6f6e2fd1ef8f67a721283f572d779e9ae19aa46bbc7a659ea83be341c91b084ace3b8a5fe7d7d60f9000fef6cc5f55a881d316d2ecd59d6bbc91f80799

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 2f04df8f8aedb830405a9939ac5ea739
SHA1 4de83e97e3f1db2c102fc4b08e259d6cb25395e0
SHA256 efb206bf2c8be94e9f0967feeb120efb438d948a07379351a8b2c04ff4ed36a8
SHA512 32a2ae478176bc6563416a7c19db64d9e4fd1628537cf1b4b6f98e6d40caca29bbea33e3615ed5e0bdfc71c72900dd92a32ab25c34d1db5d66aef24da4c430f4

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

MD5 aa147ab46de222db130b7f2f46e1d62a
SHA1 d2e18dac9267ece9dffb3cc79f248ed67279c52d
SHA256 250675d73cf73cba0652fce7f590fa578319cfece53f4f5cbab8db282c556f70
SHA512 bdb1c74a09a60f14cebd8554cd8eaf3e2e3f924f6b7933adcce8915c969f1b5bcef8c8f7f09e444b9255fcf813fc58cebc1e90e391152758346b7856f76f6ca6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 bb6131517f1870222f1219afa86141fc
SHA1 6a3a3b60e4bd16f5914dd212f12706b9e49c8af6
SHA256 73630a09752e3e66e8f90d57479a9ff863ad1bacf30134844101f12cf6b1f3f7
SHA512 0a3dece9e69915995dc8bf3dc20eb52b9cf81ce5701b13c9e67f818eddde7a339091612966e8814421eda3a7f4c9373e45dd7b8b8c5ab6c95f46ec551a082640

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 4529f8e9483e6af5677ba1f5da25b69c
SHA1 5b67753f6420415d21b3bb426d42510b6b0452b0
SHA256 5a067e664ff91e32df9704c9f1813029dd870756b1750f2603eb1a63e333d8fa
SHA512 fbf84f02180273122d456c43c784c843704f98cf46d4aa704a933d981b22410f11b4e5d4869a1ec21c5590aaaa7e3358cbc12e72c878c03edb1c3da18cdcc8ab

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 f839da7bba62ef626f4c31964157ac24
SHA1 92f99b6dcf4fd40d0f5738b02d106bbbbe1884d9
SHA256 8191546db05939f6b9a760bf90c32bbe92dde30406708d0de4cb0b462e8fe0a3
SHA512 bcad80b8092d3d4a79ae66d827b866e06681227990f8dcd32128b2010787d7b5f9fcb12438fb77e53c81ec25ee3abd879e3943245eeffdf686e870b331b533d8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 07107c92354dcdb640e102fd5324d82e
SHA1 1e48fafa0613385d109e2d5df234f13b4e0a32da
SHA256 73a56913111b5faaed833040017ea9173c5656653a71c455324da7d405992b66
SHA512 21169bdc51e8440073b9217dcb65bea85366febd2f95879b8f34845e5f9f360ae3e827f5cc26547ac4c1936c23818d29be446f3be91773c439a4ea522f6cbe73