Malware Analysis Report

2025-08-05 20:10

Sample ID 240302-3rekjsah77
Target 576d8054195fadf28509e5caa4669318527bedf88ed48ad5d1b911b116ebd3e2
SHA256 576d8054195fadf28509e5caa4669318527bedf88ed48ad5d1b911b116ebd3e2
Tags
upx
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

576d8054195fadf28509e5caa4669318527bedf88ed48ad5d1b911b116ebd3e2

Threat Level: Shows suspicious behavior

The file 576d8054195fadf28509e5caa4669318527bedf88ed48ad5d1b911b116ebd3e2 was found to be: Shows suspicious behavior.

Malicious Activity Summary

upx

UPX packed file

Loads dropped DLL

ACProtect 1.3x - 1.4x DLL software

Legitimate hosting services abused for malware hosting/C2

Drops file in Program Files directory

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-02 23:44

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-02 23:44

Reported

2024-03-02 23:48

Platform

win10v2004-20240226-en

Max time kernel

218s

Max time network

203s

Command Line

"C:\Users\Admin\AppData\Local\Temp\576d8054195fadf28509e5caa4669318527bedf88ed48ad5d1b911b116ebd3e2.exe"

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A camo.githubusercontent.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\System\symsrv.dll C:\Users\Admin\AppData\Local\Temp\576d8054195fadf28509e5caa4669318527bedf88ed48ad5d1b911b116ebd3e2.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-399997616-3400990511-967324271-1000\{7F817636-3D57-4223-B351-EA02FBDFE130} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\576d8054195fadf28509e5caa4669318527bedf88ed48ad5d1b911b116ebd3e2.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5064 wrote to memory of 4936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 4936 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3476 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5064 wrote to memory of 3964 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\576d8054195fadf28509e5caa4669318527bedf88ed48ad5d1b911b116ebd3e2.exe

"C:\Users\Admin\AppData\Local\Temp\576d8054195fadf28509e5caa4669318527bedf88ed48ad5d1b911b116ebd3e2.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9df8b46f8,0x7ff9df8b4708,0x7ff9df8b4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3748 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3748 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5352 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4720 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5588 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2164 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1848 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14509651462293070711,8349839660542345328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\AppData\Local\Temp\Temp1_Deskbottom.zip\[email protected]

"C:\Users\Admin\AppData\Local\Temp\Temp1_Deskbottom.zip\[email protected]"

Network

Country Destination Domain Proto
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 203.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
GB 92.123.128.181:443 www.bing.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 181.128.123.92.in-addr.arpa udp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 r.bing.com udp
GB 92.123.128.181:443 r.bing.com tcp
GB 92.123.128.181:443 r.bing.com tcp
GB 92.123.128.169:443 r.bing.com tcp
GB 92.123.128.169:443 r.bing.com tcp
US 8.8.8.8:53 login.microsoftonline.com udp
IE 20.190.159.71:443 login.microsoftonline.com tcp
US 8.8.8.8:53 169.128.123.92.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
DE 140.82.121.3:443 github.com tcp
DE 140.82.121.3:443 github.com tcp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 8.8.8.8:53 github.githubassets.com udp
US 8.8.8.8:53 services.bingapis.com udp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 185.199.108.133:443 avatars.githubusercontent.com tcp
US 8.8.8.8:53 user-images.githubusercontent.com udp
US 13.107.5.80:443 services.bingapis.com tcp
US 8.8.8.8:53 3.121.82.140.in-addr.arpa udp
US 8.8.8.8:53 camo.githubusercontent.com udp
US 8.8.8.8:53 154.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 80.5.107.13.in-addr.arpa udp
US 8.8.8.8:53 collector.github.com udp
US 140.82.114.21:443 collector.github.com tcp
US 140.82.114.21:443 collector.github.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 140.82.114.21:443 collector.github.com tcp
US 8.8.8.8:53 api.github.com udp
DE 140.82.121.5:443 api.github.com tcp
DE 140.82.121.5:443 api.github.com tcp
US 8.8.8.8:53 21.114.82.140.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 5.121.82.140.in-addr.arpa udp
US 8.8.8.8:53 codeload.github.com udp
DE 140.82.121.10:443 codeload.github.com tcp
US 8.8.8.8:53 10.121.82.140.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 140.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
DE 140.82.121.5:443 api.github.com tcp
US 8.8.8.8:53 github.com udp
DE 140.82.121.3:443 github.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

C:\Program Files\Common Files\System\symsrv.dll

MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

memory/1948-5-0x0000000010000000-0x0000000010030000-memory.dmp

memory/1948-7-0x00000000007B0000-0x0000000000868000-memory.dmp

memory/1948-8-0x0000000010000000-0x0000000010030000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 e0811105475d528ab174dfdb69f935f3
SHA1 dd9689f0f70a07b4e6fb29607e42d2d5faf1f516
SHA256 c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c
SHA512 8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

\??\pipe\LOCAL\crashpad_5064_SQWTSIXCAHWIROGY

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 47b2c6613360b818825d076d14c051f7
SHA1 7df7304568313a06540f490bf3305cb89bc03e5c
SHA256 47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac
SHA512 08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e509b8c1fea036cb5cf58470db37f182
SHA1 e47e7d39d05caf3304bea8a565322e7f23e3780f
SHA256 d7cd968c0d6f79d9ff713e01931273997bdae36db5951f37e77c73f688c040b3
SHA512 a77b13346142a024fe3c23a58e6f4e4be772aceb705114fc30b00251db9721067fcdacf3a59a5a065ed91bb46a17a565e5fd08f5fdc4822d00986e574953f8a2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 a784e8eb3a8e4566f234590c341e5ca6
SHA1 b1902b88bba355894c071c36b00987d3304737f7
SHA256 2ed0728642cc606ec937ab0c845e3264f078601c0a6fea34c6e8bd2f1d3064b5
SHA512 6082b3fe774ee6d1e38005b551d7a6f756406b246a4c8516559cb2c358c51a8dff2fd2b320db1fb3e1bf49ae98f3e09b3cbc0c1483ca14ac3aaf60b76a2a0930

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a9ec543833cc5d71c02e0917e9b8886c
SHA1 23f5ce10e54232d6ad9c7e4bbbe3310fd4bf10ef
SHA256 1dc7afa16da11dd1c089d725851e51e12cacf060b7a1515ecac721810875f58d
SHA512 704ec29fbdf6299e7e174b0f9ab1b20286439b1a6397041bc127d8fa4439f891f45ceed4232bbc164cba28697fc0d56226e456ad8361ca63c6af12dd67d720a4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 6afcd23deb7002966c7ed8c62fa1e08b
SHA1 3f8c1db9c1ccd0305e040350aa7a44d6541ae086
SHA256 18afef14ece11e8477e314b5ff4bdcb837df785326ad23613000b9f72c71dd20
SHA512 97e2b6cace557a3c821fa39edbb83da8f72500fdce387df583e93b82c1ad234bff7757e5da90c34ffbf5ca5a032f49b0646a63389cb55171ec9e189c15d897a2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 36db9f57aff8bdd40915d2561c42e740
SHA1 68fa6aaa226c0971a29c6d0b19f76a1f2152a7e0
SHA256 aeecffc69524322dadbf5f4755e01ddc146699e4826d6ffe70a03d06a1b3ec5f
SHA512 fe757980b83e540e16dbb095b499be04707799cd3d04cc801a72e7665721afa6bb9c44d7a748801e98a8d0f7627659989038bec4bab174a553d0a7692d40ef7c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 9488bdc1f7d2b4f9928ed535881f5893
SHA1 dc627952155b3569280e85bfb1ebd84ac4006711
SHA256 945c7bce57d207a853cd4bf3433426464215c3a650648450ccabc72f5881df7d
SHA512 d06962ed50557b3c212a8374946a0eccad6f4dabab98fc18cb85cb5a67811ef1f4e9f25a57d71483a6927091a5ab8f037b363995cc7aecb5bc7ac45b2ef5bff3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 22bd056361cb617080f450804c85fa36
SHA1 f13514fc59d9e3909b76ad33e5d73f489d2f88ef
SHA256 3e8d8a01539125c6b33594b20ab02ae2c88bc860b96abb165feca50b9121eefa
SHA512 b06f578515fe0408f21fbbe2d730e0f504c47f767810dd1906519ef22a91d6e7b6a8c19ccadeaa40fb5cce9bf8f67f490782a025474d66fbfaf50b473ff93b8d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5867dd.TMP

MD5 187191e7e33782318e2a9f7fd1635c6c
SHA1 14e3bf726845b9ac12e75d8f9d573a2bd93fdf2c
SHA256 e062e895b335c9ba85a3582991dda6e583a323446202347a23b70a743ef8f0ac
SHA512 76e26c3bbffbe8ccc9942c3c7cea1ed7e25759b5eb87eabdf15697377bbb8d160c455b083098d4d7724fb915326d32d6435cfee01d97e8c6de4c17587b2ca54b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 0202db1dbb624427b4b68f3cf83417fa
SHA1 3b2246792cafe4d1aaffd5aaa4e0f9fcf504e98d
SHA256 a08c3000fb9ab2e58f8e55f38107fffb8dcc58e16f5dcff53e7d499c5d4b636e
SHA512 f4df2c6968bbe66247ffa2d24dd9947fa76a38e096e7bb65e5f3f395379c33eaeb3d7b909b475741a03820f98737a589a54b743e2e5bbc72525ced082959eda5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 011e84e4ca96aada57477ad702505745
SHA1 bb6f980b1fdaf40c11e249acf3114387110086c2
SHA256 218abd62ea55c6a10f6e831d2edfe2db527480fbbdc3dd7aeda6c9e630944b14
SHA512 50fe55329abb5932fa9fa31811a2d33a7109aa6b85708db6bd68bd500e537ef39434476d4c9a9c2780aca1c057175f92a8b0ee9e62cdf2b70d9ab25d852fa49d

C:\Users\Admin\Downloads\MalwareDatabase-master.zip

MD5 324f1ced7ab187d28f8949181999216a
SHA1 06b6c8206482f855e8a1e78c6e8e1500d1fcf8a6
SHA256 8958b12524fe2dd23a2415792a0ce43a41f7b83bfee2720878319194d43001c4
SHA512 4dfe613964a4efdc22d1d25bc5533a1457d9647056b32c2d12728d10505fa7834160b2b4a17db85b679fad1ec7b19165ebf907c74f47d6756dd7c6475fe080db

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 dd40d8afbb1de95de048fb408d21e66d
SHA1 781e242a7bfa1261a73e8c2dd324f33874fb1618
SHA256 41dea7ceab58bf0b7c2c040d4e6ed472ba484e399f67c762e0ea77c0692468b6
SHA512 c63a6fecfca08e7a8ba99068b4730e77a587ebd481c735c0e47658cf0359069d4e0542797a5023091896db192d5fbe1fb6caa5b405ec23d6fbe07afdd80ef6f9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 2893db6461513dd1698858c859599768
SHA1 d6ed11aadfb75dc031b106662e851556919e2a63
SHA256 ac1758be4fe1b258cdc321c26119ac8424f7248812e18961d20c14123c72fdf4
SHA512 e3d9503d65fafbd4940f8c00961958d0feed4ea4be64015ac042e1df3d6f0e3f834f3728af090d3885cb9d70edb961c8d3da36e04c2907c5c08d8a47124c6fd0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 466e5511dc62043f5d11a3feec6b2baf
SHA1 ad98cb3ac403b5c8ffbbff079675be5b42482f54
SHA256 053f6282cf11de4068cb2f7f2526544224c6f6b215d6ae8028b34bfa41e73163
SHA512 dca7dcecd317660f859624ac60d253e59bf5d910395a43bdc27c038ba73b4a84609d20370808d994369097ea4025092cd242e458f7ef179f390a51623fc06bb3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 69fab2cf2575541e4f9d07644eda8814
SHA1 fa8c08a71ad7326ca6fb02238cc0c21f3e8078fd
SHA256 a86ea4e0c102ed4f93a8dc65cd1b08c56616af4cd8acd0534023bcae459fcb40
SHA512 2eb44ad0b658ad877b7ceb09b29ce6265f0333361bd90ad55127b5563016aee9b94c46ae3695556402b21be84f877e4a4dd99dcdbcbd4ad5d1e1e9c1db34b7c2

C:\Users\Admin\Desktop\CompressSplit.html

MD5 5cc5b7386a2d609445e366fe76d4b8eb
SHA1 f989fbfc435e28cf7c33668ceb974e016e31a199
SHA256 b3dfd6f848749413ca2cda6e930fe29363931c36a9a74d2f39d14f575190be54
SHA512 f1fe229054fdad0a91105edb96c1ca81df34751f2221d21746f2baf4d1b6ba155eb9b8d20f226357983b4ee94a8312bf6ec97b6aa76b5b6c09aa3ab7ff25af3b

C:\Users\Admin\Desktop\ConvertProtect.mhtml

MD5 a2d5e94b6bbe7251fa12d1051c67a2ca
SHA1 7de01ae1b51c113d3f33a1c33ab30ca3447d456c
SHA256 baa74f67bc68c6de3c28deb2b02885efcc20de90f99baf39cb1dba20b79d392b
SHA512 f159dbbe1a0da50d4b68c356ac9434ba699373d413cd7eeb3685831b8075f45460cf20df6b5d01f328ef66f6931703f453946c85bd1a4265debc48b646064015

C:\Users\Admin\Desktop\EnterSkip.docx

MD5 b36c42dcbda0c308e9a91dd25d9dbec8
SHA1 f248aa9986e9bd5403a3f9d8a1d7017b7d186caf
SHA256 1c257d1b90725561ff07e6ad4276967dc6ca3f144be6041280a9ec0f8109e6fa
SHA512 eb39bdda42ea7c809ccd1b93cf55a562b09b1023b9c7dd0322847ec9866898c68c2c8b9435cf6ac9194de6710a56ca709edcc17225ac0773f677c2c995117941

C:\Users\Admin\Desktop\FindExport.dot

MD5 dd2a721d3430ab87ca8c4e2e71143430
SHA1 373fdab02eaf57e2bd3c90bcf2f532019e8c29d5
SHA256 00d2af69da72c064dddb411651dc13043436bfd7bb895b54e5eb9644bdbabc21
SHA512 8c5a1a34fc4252597ddac80fd67bba0901aaac754fb9c486dbffb5545d6564aaa43cb7d4ac3b8029207900d30afc1e82b80554bbb146bc43cf1f707c8a779174

C:\Users\Admin\Desktop\DisableConnect.xht

MD5 949732ccaf4e4fd2529cd70d36aeabff
SHA1 a61a3d00f8e93f9f466e4885a9a98a41f79bbb70
SHA256 8b737af57b07bee3550efac39e1ef3260f16f2fee81e5c20d22b5345e04c4565
SHA512 97db55c187eaadefc5c78037e8389bf071ba75594ad3bdcfdf2210c93a06805a052b358b47707ea64fdce8b6a61823931fbb9eb4d83322875fbcc747e3f2e371

C:\Users\Admin\Desktop\TestDisconnect.rtf

MD5 f86c868dc6285621200609d15e23d56d
SHA1 076b9082b3569ef31b51d57e088a34c395a27b34
SHA256 a7cc4199c999e06fa375aa3f6f94d4f466094de3ed376d178c1346ce259e55f1
SHA512 deee6cb315c3f81e10ad2544eac8b044d72c22d0c5522ccfc6ed6c16d35c7af433d1abcffeedf358640b9e1d8b76d5d1728a04d60bb14e59a4b797d4e8adf7aa

C:\Users\Admin\Desktop\UnlockSet.easmx

MD5 26a8c93109bdd7184dc45d9ec5035eb4
SHA1 8234b218fdd27e55e3e3c8dfa6a5274593d40340
SHA256 00f3a47987bf0700be7a8c7ee2fa2c293794743b5a43b44a06a26b8c617978d4
SHA512 40c74ca9ab0e5ac90de0962e46398a048a5f2bf67aacde2afc1e5c90502078007f107e12b71035cbd9747265e3cf7a2a8650f6475d3594a44eabeb219ca90325

C:\Users\Admin\Desktop\TraceConvertTo.vsw

MD5 a1800c75512fdd77e3999984a33ee355
SHA1 4905f1d4b3ec515ce844acd091280b231339e542
SHA256 b921ca95a28be83b9aadb6eabaf0bf66d91ca575f9dd6e0c61ac39be6022695c
SHA512 80fe525d8feda578d2acf3911dfa7a62b913da4f5d8f70c3e33dce807414436e60a9712032af6cfbcac301ebcaf897de682d9f46882a52eb1a0dcf7346c2c3fb

C:\Users\Admin\Desktop\StartSkip.vssx

MD5 d07ee06cbbe728727576c3537bba2888
SHA1 b5a7ff44770c8c1090b540ef2cce8d1a1e988148
SHA256 e2e3c0b5dccfec28683e307eef94c21743db4cb954ec6ae364ca972fcf48bd31
SHA512 a8ae36502af53fc95725271415fbe4ff8b731e6e4d42bad14a628450104293ab6c16e275b317015953c29deadfcd4a8024ec21174ee45de9963e3e74fb917506

C:\Users\Admin\Desktop\SkipExit.vsx

MD5 49fb29af9733957be020bb7d35693a8f
SHA1 ef10d14dcfcc8e44601d06692880182ac1b42cda
SHA256 51ed3057bee44a456e3d726302be9a16743a29258831a7937fa751a83ce3bfbc
SHA512 114fa2d50745877325f584e5450e6e5d33d07766004c044d1fef186010df97365c54660116ea2cdb8ac9c1b8c06f3432bcf613ad9d094be34a0d93e82cdec85e

C:\Users\Admin\Desktop\SendWrite.scf

MD5 cc6a515e23b3193032f55572899c25f4
SHA1 9c1061ed7a84e3d69bd10343a43a9e03810c735d
SHA256 042f11f5d29e88d547db2503c3ddf80dd12fd4f57a65e2786f034c842f79d016
SHA512 92cd3d715d74e385e083888fbb90db640f611b0448f3bf6723a4a469523b911771f413fa124c0d7b67d6f1fdfdd2353d7c1cc11f16bd954130258536c0ac1a59

C:\Users\Admin\Desktop\SaveResume.cfg

MD5 836aef5bfc849b5b3d578b31787b8ca2
SHA1 534cde681838758256276574b38b72ea44809021
SHA256 f8ee191f964d1e38e922f52cd79c19c15c54e471be3455c17359427edb000207
SHA512 23ed9277647770e6c894308fb51c1374ecb5425c906ead601ad992309d05564dd8feefb807e81dccf7f8dde086ac60fd114437c2fac9679b4ed2b177f39a9747

C:\Users\Admin\Desktop\ResumeEdit.mov

MD5 331667c02afef0f54a168838115b9a31
SHA1 fbed9de2ede93edec339c28cfb47f023505f848f
SHA256 ec732f996a0b7e7b28f7e515c43bb17cdf80c5f06d200ef655fbe6b82dd8a8e0
SHA512 944a854f81d782bc358cf680b9c0559678a8580af62bec14d7b4a163c2339e5b75c07dde0fa117fd69a8958cf9b71cae8d40d74933bd3b97974659963c34a05d

C:\Users\Admin\Desktop\RegisterClose.wmf

MD5 589c97c47aaccde22952ea30e39649ff
SHA1 3b8140916cb7f5a72f7522424db4739edbcc0a3c
SHA256 2b66408bc405f864354786a4f496dbfe7d4c072ecfe89a5c12b91625b2252319
SHA512 0615110c9ab8c825323a805adc4f6cd654aaa20285a86d10abd6cd125f72078d333bf0a95538b06924800a223aadec7040b4d276a20a2d707010dc1c811b6f1a

C:\Users\Admin\Desktop\RedoWrite.dwg

MD5 d6db6eb5ee65391c4b12cd3406fd22d4
SHA1 cf23ec704589acace557c90f36afb7a9bff14ad5
SHA256 a16e1b833c8baf5a9014d99241236827cbc6f8557796f6c84ee7e947b0eb0d6f
SHA512 c86a3af8a87eacd9f947e1479c828046dcf48fa4fe818e6115b7d2b302ca62a8711670f137f4e133cea430ffbc6c4711fbe7d92720a279c3cdc648694cd54d8a

C:\Users\Admin\Desktop\ReceiveRevoke.asx

MD5 361339065ccdd81661c1419e58d954ff
SHA1 003f2f6d741332bb4e050a6c6b8dad623fdc28bd
SHA256 01fbd02b38e8cc059c96944f99dd79d36ad912113bbdc3f07b0a9d284906f551
SHA512 d22346a0ca83474d21de4e4566dcee7de4fc84b54426f3e056cde7c5bbaaf4e8532cd8c698e1a368cb9afeb6bdbd0fad290789ddba420c07b7210fd08a73feb6

C:\Users\Admin\Desktop\ProtectUnblock.aifc

MD5 f7daa8e8ada7ee410e0d785c16c79270
SHA1 cb062f47d5db647149f02d9304947cf04681958d
SHA256 7816ab82901af6d8c1dcf31f70872957f52345e36513b008d8fd62ca3fb907fa
SHA512 d19a8bf3c74d0726cc0c3d67c17691e5437e6f69e8a4dc734a666bb6f998f4ee02feb9f5dc7b5dd61e443dade9da01969913198338044a80f21232a29571da83

C:\Users\Admin\Desktop\OutWrite.ini

MD5 ee66c3676077b9609b6eb0f6a2927b75
SHA1 7b32b642c96c6540395957b9751a5e3bc4b57714
SHA256 921583ca272c83c6a97a626126a062ec69e349aadb5fb09dc4674fe4556f4c25
SHA512 d40cd7821e6372889a8a0f4c00b1b78aa97498b3a57f57db48a75f0239c45f54bdb9de5416f7e5a8c8a4ca5b85454750379041ef30bb410218a537206036cd3b

C:\Users\Admin\Desktop\WatchConvertFrom.wps

MD5 b16476ac42154e3fc2068add43edb042
SHA1 ab6657f40b070660acc79f1e6b88c644f909c6de
SHA256 fabdab79342811de6c7cd3a109593b43d15fa8ff491072eb9848fa84dc60eb7c
SHA512 ba126dda476c7a0988445ca78dbaf714a9f3d6c74734cb4f8376c766a9d0aa64a6c556a858df3dc07bf1d13c3b1b23677245c630879a6b8128ff5c5863ceab69

C:\Users\Admin\Desktop\WaitUnpublish.cr2

MD5 0ce37103f6980ffe7d3ddf8f14b0b52e
SHA1 7210c2f468c06e41ad66d232b1cffbd56e70c72d
SHA256 38e237845932aa8641d80c543a6ce99be456249803ef39af1c03a3804a3688e2
SHA512 7aea42bf33ac87465d15bf6c266b23b9b0eceb8521dbc74c33ad9e4624beee4d49ca8c74a821010e223f3292becd4e424c9c7ea2c04fb91d5cacf737b3c8821b

C:\Users\Admin\Desktop\TestUnregister.mpv2

MD5 917a015a9da97d025ad85520c2694665
SHA1 ce8e67a85c296984bf1857307ff8b5334e2a067f
SHA256 9e9f3e47a0fed55ed1d9471ee940ec9db189105e14747dae8daceab805dc5d0e
SHA512 59cc8128bafa14c28a3e2559fa7bc1e909d2e021df3c1b701cb6abe86be3238d3c06c21cd97b309e72f856e4c7d35567cb2e616eeef02af02f2cca62253f162e

C:\Users\Admin\Desktop\WaitSync.ttc

MD5 56902bcb05898203df5b7b5a6077311d
SHA1 6723611fa4a6d9bc40afde468d9b677965ee841a
SHA256 6b353ff59193e702c6e04d253da98b8caf73ebe6032f24ef634342ca257ab335
SHA512 ace5cb1ee8ef803158c74e0a11488959fc4a56788be9a3a74eb68b91bcea81126e288a27c3f59c3147f2e6487cf8abd507bf6bdc878318eedced9779de2b4c9f

C:\Users\Admin\Desktop\WriteStop.eprtx

MD5 e384c413c1112039a8903bb9afa2d650
SHA1 41bdf77f0d5d810491a9525fa8532ac874aed648
SHA256 8e81ea424122da2e3773a1aec1755995852d2725fbb478e69adf1f300c14b343
SHA512 171a801e8430690e34649bda8bf0d3a571c542325505fb4414e0d06b0932b10d96fcb7935f43692544ee1c7e83aa1a535730a5509ccdb1e28d203e09e6e90f54

C:\Users\Admin\Desktop\Microsoft Edge.lnk

MD5 cff7e263d174541a347ec392aab798e7
SHA1 d5d184997f087684605e1ec77b82951656bf1599
SHA256 53d9d3002ca2ee8acb92a3c3233697c8bf3f7d04365c62e0fdd963a48f7ce6b7
SHA512 cd7fd1935694192fa7af02fcf655eb09128e1cfda92440344e6d46322398f768c798b4cf9bbd9cffd833787ba9ef3fa429b9de7e57d46b4f5ae226fadafa808a

C:\Users\Public\Desktop\Acrobat Reader DC.lnk

MD5 b0f869458ced3bac80c8adf82bfa00f1
SHA1 ab8de02f3659918277552e6fff7429961870f51b
SHA256 7fe16154d30a2515e344b61875f8267e2258eaa9c8c5ff87fa25f08f2404b56b
SHA512 ee87a8491f1c16bdfc923977ba00c111c9b61c86bdc43ae9cdfedb2b62a46e7c149bce887ba7090c011423a0308cfbdb0402eaecdabb8117df674df3b7c2b938

C:\Users\Public\Desktop\VLC media player.lnk

MD5 80878b397abf6ebb058691fc2404e5b5
SHA1 6e54d8f08b6885101f486f764192e26b001e27ae
SHA256 bec8169c0bc65e9901dc1580f0e7c4b7a6ada2b3227792432edf3c5e3dd52e02
SHA512 e5d0629f1217423987bbeeb81e37b4169e0af085b2da76b1cc488bdc22cba481168092946a46a695c81a6dd0d9dc1f6b005a3f4fa9545a8cedbc116689d5f4f1

C:\Users\Public\Desktop\Firefox.lnk

MD5 adfdb491e4a8f583b6006097046fabc8
SHA1 90850e974a530b5238a12c07740901c1f83b93d3
SHA256 d4752d7766019dc6aeba9c8e962e826c4287d09fa519bc5dae34e4fd1f9b3569
SHA512 ef1fff0f561679c205b3cd674263147c223d3e0557fe14618aec94f2162db412ba81b087d75baf7a881a183a3482f95cf76360c16c02908db469ab490058346e

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 cad4431c598b042c589fb1ec55002c9f
SHA1 747d63a643f766638a0a5086223d728bb46bf976
SHA256 afc6c7e86d7fe3177e24f063d630a11ae6b69a0d662f348891433f7d038c6312
SHA512 4949c692960c4bc991dcb53ee53b2c2394359ab5a479fb2f340b9788c4cc41558cf4752b62083ee95bfdad57ecf2da8f7c84431f12e0f890c0aae44281ce3698

C:\Users\Admin\Desktop\OptimizePop.nfo

MD5 3dfb8605789fa6684189a8bcc91991bb
SHA1 213db9e1e08a0c42bf6db04d2ee00355de13bed2
SHA256 3a65df4d9f89ca4a1e86a1704f46ccbab825f70202389952a7942f02baa0c5ff
SHA512 ff97afb635b5db1e87864216aa197963fd9d2b5bb0da387e21f14802b01c781fd38176e702c2f7448f52b028837b497354a429fa498c41619bcb995a0ea0b795

C:\Users\Admin\Desktop\ShowResize.ttc

MD5 0773ad06af3356b97efb67b5ec78e73d
SHA1 6e87ed7ca77e3043f48b675050d59b1d74eddcbc
SHA256 bb31b75f1cda7fb51f833727cf671a761f1ba2081df33e347dbdd2fdf27065ef
SHA512 6ff6b9d0bca42f808bdf8acd77a7f9b9fd32c6f57f37fc5e395582ae3ea1e4529a1dd52e91b3da3b7924f74dd61c29b05ef1111d9f97f04d20d5c26cf6039b18

C:\Users\Admin\Desktop\StepCheckpoint.kix

MD5 159aa289d5e16681c52e21eb6adf8f73
SHA1 826c17357498d2c595628ee87bcfeaafcd56fab4
SHA256 25f7ddffe6f4c91ec6c7c7062c47a2775916dc7cd9f0ea7a6d818eae50b65949
SHA512 a8c13a6743a41eb2e664ce4f5145a748740f80a1fca9133770cb07134a40bf37471b7459cf577b3668d3c4990e82bba81ad95a99f3ab9e75caa36c7fd6b37250

C:\Users\Admin\Desktop\ResizeConvert.cab

MD5 74847c85a94e74d76dae2e6eea7a22fd
SHA1 9312b10f7b9f772d85b45141b7bcffb310b54cc8
SHA256 08c36a55a7867efa99b018ad233e34a45bc60568eeab80fe4a48f64121e3fc7c
SHA512 04e7cfcb0b64d2419b0e805aeeeb6810e29ef914a9c9c88d035a79b87c4c614a9a122ab8ed08d86db3eed1286cb2f9b610380f28faab55f66a865faeda84b366

memory/344-669-0x0000000000720000-0x0000000000721000-memory.dmp

memory/344-670-0x0000000000400000-0x0000000000479000-memory.dmp