Malware Analysis Report

2024-11-30 05:12

Sample ID 240519-pmfp6ahb22
Target https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbTZSYWJBaUdLd2FlTTZTOGpObkhZSjJPTjFBd3xBQ3Jtc0trVFQyRHdwa3EtTTl2VmxjbW5JZFlwaGotOXgtZ1ViaDFTakZiR0RHZlk4eHNyaUluVi1LVUNkOHI5SEx5YjNiRVhIMGlhRmlneXdKSGtSSUYwb1dBcW82WTl5M2NhRVBjUmlpVHFDWDJXNXcwV05wMA&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Fw4w7jgg3vk6qb%2FCheat%2Blauncher&v=rKLwAhQYsQ0
Tags
lumma discovery persistence stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

Threat Level: Known bad

The file https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbTZSYWJBaUdLd2FlTTZTOGpObkhZSjJPTjFBd3xBQ3Jtc0trVFQyRHdwa3EtTTl2VmxjbW5JZFlwaGotOXgtZ1ViaDFTakZiR0RHZlk4eHNyaUluVi1LVUNkOHI5SEx5YjNiRVhIMGlhRmlneXdKSGtSSUYwb1dBcW82WTl5M2NhRVBjUmlpVHFDWDJXNXcwV05wMA&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Fw4w7jgg3vk6qb%2FCheat%2Blauncher&v=rKLwAhQYsQ0 was found to be: Known bad.

Malicious Activity Summary

lumma discovery persistence stealer

Lumma Stealer

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Suspicious use of SetThreadContext

Drops file in Program Files directory

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-19 12:26

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-19 12:26

Reported

2024-05-19 12:34

Platform

win10v2004-20240426-en

Max time kernel

460s

Max time network

462s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbTZSYWJBaUdLd2FlTTZTOGpObkhZSjJPTjFBd3xBQ3Jtc0trVFQyRHdwa3EtTTl2VmxjbW5JZFlwaGotOXgtZ1ViaDFTakZiR0RHZlk4eHNyaUluVi1LVUNkOHI5SEx5YjNiRVhIMGlhRmlneXdKSGtSSUYwb1dBcW82WTl5M2NhRVBjUmlpVHFDWDJXNXcwV05wMA&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Fw4w7jgg3vk6qb%2FCheat%2Blauncher&v=rKLwAhQYsQ0

Signatures

Lumma Stealer

stealer lumma

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Wondershare Helper Compact.exe = "C:\\Program Files (x86)\\Common Files\\Wondershare\\Wondershare Helper Compact\\WSHelper.exe" C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\is-5HCVC.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Languages\is-4QQ6I.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\is-H086V.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File opened for modification C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.ini C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-A4PM3.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-4P18B.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Wondershare Helper Compact.exe C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File opened for modification C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Wondershare Helper Compact.exe C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe_temp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-UOO3Q.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\is-C1QP0.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-PNID2.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\is-68L2I.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\is-5QTPP.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-DDKDG.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\is-R6K6N.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-CKGPH.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-T28SA.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File opened for modification C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-47GE6.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-UL5RT.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\is-7DMS0.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\is-67V65.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\is-N1MQR.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\is-I5SM5.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-3SR6E.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-QGIL8.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\is-EKDST.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-GI324.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-U55GJ.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-FSOBG.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-T0I0D.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-AB5H8.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-MJD89.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\is-O4GSN.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\is-3BN3V.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-MQ4TM.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-07M0I.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\is-7OCUO.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\is-GRR17.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A
File created C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-MK6QK.tmp C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D85C6069-D628-4276-93C3-9A94E5338D8B}\1.1 C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0ABE7E0-32E3-472E-924C-162B1996DC23}\TypeLib\Version = "1.1" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B76550E2-048B-4D8C-B432-4668A54EDEA3}\TypeLib\ = "{D85C6069-D628-4276-93C3-9A94E5338D8B}" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{225BE4D8-64CA-49B1-9630-917F2D92F452}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D85C6069-D628-4276-93C3-9A94E5338D8B} C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5610D1A9-5B54-4E77-9190-94FF9E59AFBA}\ProxyStubClsid32 C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0ABE7E0-32E3-472E-924C-162B1996DC23} C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WSCustomerServicePlatform.CustomerService\Clsid C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5CAFA8E-F69D-4E6F-9BF3-1F4522AFD4BE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E90BA470-0728-47E6-B2E7-0ED0C0CFEA8F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{55DB3C89-37B9-41E8-87CC-7C578D2F5374}\TypeLib\Version = "1.1" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WSCustomerServicePlatform.CustomerService C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B76550E2-048B-4D8C-B432-4668A54EDEA3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E90BA470-0728-47E6-B2E7-0ED0C0CFEA8F}\ = "IContactCustomService" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0477E5C9-0877-499A-8A7C-154C777293DC} C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}\AppID = "{1CF333F0-7FDC-4160-AAA1-6C9A98D05D70}" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E90BA470-0728-47E6-B2E7-0ED0C0CFEA8F}\TypeLib\ = "{D85C6069-D628-4276-93C3-9A94E5338D8B}" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{225BE4D8-64CA-49B1-9630-917F2D92F452}\ProxyStubClsid32 C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}\Version C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E5E91D68-955D-4DE1-AB8E-89B26DF6A331}\TypeLib\Version = "1.1" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{46884330-13BA-4AC9-BEDC-3A2E955EB8DA} C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0FA988D3-BA51-48AD-A518-6462CD5FF547}\ProxyStubClsid32 C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1CF333F0-7FDC-4160-AAA1-6C9A98D05D70} C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E1839CDE-A191-4DA4-9FCE-178A88318DF4}\TypeLib C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0ABE7E0-32E3-472E-924C-162B1996DC23}\TypeLib\ = "{D85C6069-D628-4276-93C3-9A94E5338D8B}" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36B0BA4B-20B5-4369-BBCA-9FAADC8EAC19}\TypeLib C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{46884330-13BA-4AC9-BEDC-3A2E955EB8DA}\TypeLib\ = "{D85C6069-D628-4276-93C3-9A94E5338D8B}" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E90BA470-0728-47E6-B2E7-0ED0C0CFEA8F} C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{225BE4D8-64CA-49B1-9630-917F2D92F452} C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}\ProgID C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}\ProgID\ = "WSCustomerServicePlatform.CustomerService" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E90BA470-0728-47E6-B2E7-0ED0C0CFEA8F}\ProxyStubClsid32 C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0477E5C9-0877-499A-8A7C-154C777293DC} C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70AC1FC1-A22B-4327-9A54-754B9301A056}\TypeLib\ = "{D85C6069-D628-4276-93C3-9A94E5338D8B}" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96} C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55DB3C89-37B9-41E8-87CC-7C578D2F5374}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0ABE7E0-32E3-472E-924C-162B1996DC23}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D85C6069-D628-4276-93C3-9A94E5338D8B}\1.1\0\win32\ = "C:\\Program Files (x86)\\Common Files\\Wondershare\\Wondershare Helper Compact\\WSHelper.exe" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D85C6069-D628-4276-93C3-9A94E5338D8B}\1.1\HELPDIR\ = "C:\\Program Files (x86)\\Common Files\\Wondershare\\Wondershare Helper Compact\\" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4D3609D2-1D8A-4E9F-884B-438AFDDECB86}\TypeLib\ = "{D85C6069-D628-4276-93C3-9A94E5338D8B}" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5610D1A9-5B54-4E77-9190-94FF9E59AFBA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5CAFA8E-F69D-4E6F-9BF3-1F4522AFD4BE}\ = "IEventSink" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{225BE4D8-64CA-49B1-9630-917F2D92F452}\ = "ISilentInstallProduct" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0FA988D3-BA51-48AD-A518-6462CD5FF547}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WSCustomerServicePlatform.CustomerService\ = "CustomServicePlatform Object" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{46884330-13BA-4AC9-BEDC-3A2E955EB8DA}\TypeLib\Version = "1.1" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55DB3C89-37B9-41E8-87CC-7C578D2F5374} C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0477E5C9-0877-499A-8A7C-154C777293DC}\TypeLib C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{55DB3C89-37B9-41E8-87CC-7C578D2F5374}\ProxyStubClsid32 C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55DB3C89-37B9-41E8-87CC-7C578D2F5374}\TypeLib\ = "{D85C6069-D628-4276-93C3-9A94E5338D8B}" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F0ABE7E0-32E3-472E-924C-162B1996DC23}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F0ABE7E0-32E3-472E-924C-162B1996DC23}\TypeLib\ = "{D85C6069-D628-4276-93C3-9A94E5338D8B}" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4D3609D2-1D8A-4E9F-884B-438AFDDECB86}\TypeLib\Version = "1.1" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E5E91D68-955D-4DE1-AB8E-89B26DF6A331}\TypeLib\ = "{D85C6069-D628-4276-93C3-9A94E5338D8B}" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{46884330-13BA-4AC9-BEDC-3A2E955EB8DA}\TypeLib\Version = "1.1" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E90BA470-0728-47E6-B2E7-0ED0C0CFEA8F}\TypeLib\ = "{D85C6069-D628-4276-93C3-9A94E5338D8B}" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5610D1A9-5B54-4E77-9190-94FF9E59AFBA}\ = "IUploadVideoFile" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E1839CDE-A191-4DA4-9FCE-178A88318DF4}\TypeLib\Version = "1.1" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}\ = "CustomServicePlatform Object" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0477E5C9-0877-499A-8A7C-154C777293DC}\ = "INewCheckUpdate" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0FA988D3-BA51-48AD-A518-6462CD5FF547}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4D3609D2-1D8A-4E9F-884B-438AFDDECB86}\TypeLib C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B76550E2-048B-4D8C-B432-4668A54EDEA3}\ = "IRegister" C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E90BA470-0728-47E6-B2E7-0ED0C0CFEA8F}\TypeLib C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1524 wrote to memory of 1920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1920 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 2236 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 2236 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 2236 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 2236 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 2236 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 2236 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 2236 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 2236 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 2236 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 2236 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 2236 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 2236 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 2236 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 2236 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 2236 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 2236 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 2236 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 2236 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 2236 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1524 wrote to memory of 2236 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbTZSYWJBaUdLd2FlTTZTOGpObkhZSjJPTjFBd3xBQ3Jtc0trVFQyRHdwa3EtTTl2VmxjbW5JZFlwaGotOXgtZ1ViaDFTakZiR0RHZlk4eHNyaUluVi1LVUNkOHI5SEx5YjNiRVhIMGlhRmlneXdKSGtSSUYwb1dBcW82WTl5M2NhRVBjUmlpVHFDWDJXNXcwV05wMA&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Fw4w7jgg3vk6qb%2FCheat%2Blauncher&v=rKLwAhQYsQ0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6d1046f8,0x7ffd6d104708,0x7ffd6d104718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1048 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2476 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7368 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7244 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6952 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6876 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7660 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7676 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7964 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8164 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=8328 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6704 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9036 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9024 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9256 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9484 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9288 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9436 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9868 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9268 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10188 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=8932 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6936 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8708 /prefetch:1

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Launcher.rar"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,3429581662106412005,6955082068372117935,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:1

C:\Users\Admin\Desktop\Launcher\Launcher.exe

"C:\Users\Admin\Desktop\Launcher\Launcher.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\Desktop\Launcher\dll\helper.exe

"C:\Users\Admin\Desktop\Launcher\dll\helper.exe"

C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp

"C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp" /SL5="$30232,2101212,54272,C:\Users\Admin\Desktop\Launcher\dll\helper.exe"

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe

"C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe" /regserver

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Launcher\About\plugins\PEiD-0.95-20081103_ExeinfoPE\PEiD-0.95-20081103_ExeinfoPE\pluginsdk\MASM\compile.bat" "

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Launcher\About\plugins\PEiD-0.95-20081103_ExeinfoPE\PEiD-0.95-20081103_ExeinfoPE\pluginsdk\readme.txt

C:\Users\Admin\Desktop\Launcher\Launcher.exe

"C:\Users\Admin\Desktop\Launcher\Launcher.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\Desktop\Launcher\Launcher.exe

"C:\Users\Admin\Desktop\Launcher\Launcher.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 www.youtube.com udp
GB 216.58.204.78:443 www.youtube.com tcp
GB 216.58.204.78:443 www.youtube.com tcp
GB 216.58.204.78:443 www.youtube.com udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 78.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 227.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
N/A 224.0.0.251:5353 udp
BE 2.17.196.96:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 96.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
BE 2.17.196.96:443 www.bing.com tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 www.mediafire.com udp
US 104.16.114.74:443 www.mediafire.com tcp
US 104.16.114.74:443 www.mediafire.com tcp
US 8.8.8.8:53 static.mediafire.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
GB 142.250.187.196:443 www.google.com tcp
GB 216.58.213.10:443 ajax.googleapis.com tcp
US 8.8.8.8:53 cdn.amplitude.com udp
IT 108.139.243.84:443 cdn.amplitude.com tcp
US 8.8.8.8:53 74.114.16.104.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 connect.facebook.net udp
US 8.8.8.8:53 10.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 104.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 84.243.139.108.in-addr.arpa udp
US 8.8.8.8:53 translate.google.com udp
GB 163.70.151.21:443 connect.facebook.net tcp
GB 142.250.187.238:443 translate.google.com tcp
US 8.8.8.8:53 translate.googleapis.com udp
US 8.8.8.8:53 21.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 107.39.156.108.in-addr.arpa udp
US 8.8.8.8:53 238.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 14.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
GB 142.250.200.10:443 translate.googleapis.com tcp
US 8.8.8.8:53 region1.analytics.google.com udp
US 8.8.8.8:53 api.amplitude.com udp
US 8.8.8.8:53 stats.g.doubleclick.net udp
US 8.8.8.8:53 www.google.co.uk udp
US 54.203.204.223:443 api.amplitude.com tcp
GB 142.250.200.3:443 www.google.co.uk tcp
BE 108.177.15.156:443 stats.g.doubleclick.net tcp
US 216.239.32.36:443 region1.analytics.google.com tcp
US 8.8.8.8:53 www.facebook.com udp
GB 157.240.221.35:443 www.facebook.com tcp
BE 108.177.15.156:443 stats.g.doubleclick.net udp
GB 142.250.187.196:443 www.google.com udp
GB 142.250.200.3:443 www.google.co.uk udp
US 8.8.8.8:53 translate-pa.googleapis.com udp
US 8.8.8.8:53 10.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 36.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 156.15.177.108.in-addr.arpa udp
US 8.8.8.8:53 35.221.240.157.in-addr.arpa udp
US 8.8.8.8:53 223.204.203.54.in-addr.arpa udp
US 216.239.32.36:443 region1.analytics.google.com udp
GB 216.58.213.10:443 ajax.googleapis.com udp
GB 142.250.187.196:443 www.google.com udp
GB 142.250.200.10:443 translate-pa.googleapis.com udp
US 8.8.8.8:53 the.gatekeeperconsent.com udp
US 8.8.8.8:53 www.ezojs.com udp
US 172.67.199.186:443 the.gatekeeperconsent.com tcp
US 172.67.170.144:443 www.ezojs.com tcp
GB 142.250.187.238:443 translate.google.com udp
US 8.8.8.8:53 static.cloudflareinsights.com udp
US 8.8.8.8:53 privacy.gatekeeperconsent.com udp
US 104.16.80.73:443 static.cloudflareinsights.com tcp
US 104.21.42.32:443 privacy.gatekeeperconsent.com tcp
US 8.8.8.8:53 g.ezoic.net udp
FR 13.39.145.251:443 g.ezoic.net tcp
US 8.8.8.8:53 go.ezodn.com udp
US 8.8.8.8:53 186.199.67.172.in-addr.arpa udp
US 8.8.8.8:53 144.170.67.172.in-addr.arpa udp
US 8.8.8.8:53 73.80.16.104.in-addr.arpa udp
US 8.8.8.8:53 32.42.21.104.in-addr.arpa udp
US 8.8.8.8:53 251.145.39.13.in-addr.arpa udp
US 104.21.87.79:443 go.ezodn.com tcp
US 104.21.87.79:443 go.ezodn.com tcp
US 104.21.87.79:443 go.ezodn.com tcp
US 8.8.8.8:53 cdn.otnolatrnup.com udp
US 104.16.53.110:443 cdn.otnolatrnup.com tcp
US 8.8.8.8:53 apps.identrust.com udp
US 104.21.87.79:443 go.ezodn.com tcp
US 104.21.87.79:443 go.ezodn.com tcp
US 104.21.87.79:443 go.ezodn.com tcp
US 8.8.8.8:53 g.ezodn.com udp
US 8.8.8.8:53 securepubads.g.doubleclick.net udp
US 2.18.190.80:80 apps.identrust.com tcp
US 8.8.8.8:53 www.mediafiredls.com udp
GB 142.250.200.34:443 securepubads.g.doubleclick.net tcp
US 104.21.87.79:443 g.ezodn.com tcp
US 104.26.2.173:443 www.mediafiredls.com tcp
US 8.8.8.8:53 otnolatrnup.com udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 bshr.ezodn.com udp
GB 142.250.200.34:443 securepubads.g.doubleclick.net udp
US 104.21.87.79:443 bshr.ezodn.com tcp
US 8.8.8.8:53 fundingchoicesmessages.google.com udp
US 8.8.8.8:53 tags.crwdcntrl.net udp
US 8.8.8.8:53 ad.crwdcntrl.net udp
US 8.8.8.8:53 bcp.crwdcntrl.net udp
GB 18.245.143.118:443 tags.crwdcntrl.net tcp
IE 52.17.40.72:443 bcp.crwdcntrl.net tcp
IE 52.211.28.170:443 bcp.crwdcntrl.net tcp
US 8.8.8.8:53 79.87.21.104.in-addr.arpa udp
US 8.8.8.8:53 110.53.16.104.in-addr.arpa udp
US 8.8.8.8:53 80.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 34.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 98.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 173.2.26.104.in-addr.arpa udp
US 8.8.8.8:53 118.143.245.18.in-addr.arpa udp
US 8.8.8.8:53 72.40.17.52.in-addr.arpa udp
US 8.8.8.8:53 170.28.211.52.in-addr.arpa udp
FR 13.39.145.251:443 g.ezoic.net tcp
US 8.8.8.8:53 script.4dex.io udp
US 8.8.8.8:53 ghb.adtelligent.com udp
US 8.8.8.8:53 hbopenbid.pubmatic.com udp
US 8.8.8.8:53 htlb.casalemedia.com udp
US 8.8.8.8:53 rt.marphezis.com udp
US 104.26.8.169:443 script.4dex.io tcp
US 8.8.8.8:53 bidder.criteo.com udp
US 8.8.8.8:53 prebid.a-mo.net udp
US 8.8.8.8:53 hb.yellowblue.io udp
US 8.8.8.8:53 prebid.smilewanted.com udp
US 8.8.8.8:53 ap.lijit.com udp
US 8.8.8.8:53 onetag-sys.com udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 8.8.8.8:53 cdn.id5-sync.com udp
US 8.8.8.8:53 static.criteo.net udp
US 8.8.8.8:53 cdn.prod.uidapi.com udp
US 8.8.8.8:53 oa.openxcdn.net udp
US 8.8.8.8:53 cdn-ima.33across.com udp
US 8.8.8.8:53 invstatic101.creativecdn.com udp
US 8.8.8.8:53 tpc.googlesyndication.com udp
US 172.64.151.101:443 htlb.casalemedia.com tcp
US 178.128.135.204:443 rt.marphezis.com tcp
GB 185.64.190.77:443 hbopenbid.pubmatic.com tcp
US 107.151.11.18:443 ghb.adtelligent.com tcp
NL 178.250.1.8:443 bidder.criteo.com tcp
DE 51.75.86.98:443 onetag-sys.com tcp
US 151.101.1.229:443 cdn.jsdelivr.net tcp
IE 99.80.216.153:443 ap.lijit.com tcp
NL 145.40.97.67:443 prebid.a-mo.net tcp
US 34.102.146.192:443 oa.openxcdn.net tcp
US 104.22.30.209:443 prebid.smilewanted.com tcp
US 104.22.30.209:443 prebid.smilewanted.com tcp
US 104.22.30.209:443 prebid.smilewanted.com tcp
US 104.22.30.209:443 prebid.smilewanted.com tcp
US 104.22.30.209:443 prebid.smilewanted.com tcp
US 34.96.70.87:443 invstatic101.creativecdn.com tcp
IT 108.157.194.71:443 hb.yellowblue.io tcp
GB 172.217.16.225:443 tpc.googlesyndication.com tcp
US 104.22.53.86:443 cdn.id5-sync.com tcp
US 104.18.35.167:443 cdn-ima.33across.com tcp
IT 99.86.160.110:443 cdn.prod.uidapi.com tcp
NL 178.250.1.3:443 static.criteo.net tcp
US 104.26.8.169:443 script.4dex.io tcp
US 8.8.8.8:53 cadmus.script.ac udp
US 8.8.8.8:53 oajs.openx.net udp
GB 172.217.16.225:443 tpc.googlesyndication.com udp
US 178.128.135.204:443 rt.marphezis.com tcp
US 104.18.23.145:443 cadmus.script.ac tcp
US 34.120.107.143:443 oajs.openx.net tcp
DE 51.75.86.98:443 onetag-sys.com udp
US 8.8.8.8:53 ghb1.adtelligent.com udp
US 107.151.11.18:443 ghb1.adtelligent.com tcp
US 8.8.8.8:53 id5-sync.com udp
DE 141.95.33.120:443 id5-sync.com tcp
US 34.120.107.143:443 oajs.openx.net udp
US 8.8.8.8:53 google-bidout-d.openx.net udp
US 35.244.159.8:443 google-bidout-d.openx.net tcp
US 8.8.8.8:53 169.8.26.104.in-addr.arpa udp
US 8.8.8.8:53 101.151.64.172.in-addr.arpa udp
US 8.8.8.8:53 77.190.64.185.in-addr.arpa udp
US 8.8.8.8:53 229.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 192.146.102.34.in-addr.arpa udp
US 8.8.8.8:53 87.70.96.34.in-addr.arpa udp
US 8.8.8.8:53 8.1.250.178.in-addr.arpa udp
US 8.8.8.8:53 225.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 67.97.40.145.in-addr.arpa udp
US 8.8.8.8:53 167.35.18.104.in-addr.arpa udp
US 8.8.8.8:53 209.30.22.104.in-addr.arpa udp
US 8.8.8.8:53 153.216.80.99.in-addr.arpa udp
US 8.8.8.8:53 86.53.22.104.in-addr.arpa udp
US 8.8.8.8:53 98.86.75.51.in-addr.arpa udp
US 8.8.8.8:53 3.1.250.178.in-addr.arpa udp
US 8.8.8.8:53 71.194.157.108.in-addr.arpa udp
US 8.8.8.8:53 110.160.86.99.in-addr.arpa udp
US 8.8.8.8:53 204.135.128.178.in-addr.arpa udp
US 8.8.8.8:53 18.11.151.107.in-addr.arpa udp
US 8.8.8.8:53 226.20.18.104.in-addr.arpa udp
US 8.8.8.8:53 145.23.18.104.in-addr.arpa udp
US 8.8.8.8:53 143.107.120.34.in-addr.arpa udp
US 8.8.8.8:53 120.33.95.141.in-addr.arpa udp
US 8.8.8.8:53 2.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 8.159.244.35.in-addr.arpa udp
US 8.8.8.8:53 f236d6cf49d2bf420003728c1f27adc3.safeframe.googlesyndication.com udp
US 8.8.8.8:53 gum.criteo.com udp
GB 172.217.169.65:443 f236d6cf49d2bf420003728c1f27adc3.safeframe.googlesyndication.com tcp
NL 178.250.1.11:443 gum.criteo.com tcp
US 8.8.8.8:53 download2292.mediafire.com udp
US 199.91.155.33:443 download2292.mediafire.com tcp
US 199.91.155.33:443 download2292.mediafire.com tcp
US 8.8.8.8:53 dnacdn.net udp
US 8.8.8.8:53 ag.gbc.criteo.com udp
US 8.8.8.8:53 gem.gbc.criteo.com udp
NL 185.235.87.45:443 gem.gbc.criteo.com tcp
NL 178.250.1.11:443 dnacdn.net tcp
NL 185.235.87.50:443 gem.gbc.criteo.com tcp
US 8.8.8.8:53 65.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 11.1.250.178.in-addr.arpa udp
US 8.8.8.8:53 33.155.91.199.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 104.16.52.110:80 otnolatrnup.com tcp
US 104.16.52.110:80 otnolatrnup.com tcp
US 8.8.8.8:53 45.87.235.185.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 50.87.235.185.in-addr.arpa udp
US 8.8.8.8:53 110.52.16.104.in-addr.arpa udp
US 8.8.8.8:53 woreppercomming.com udp
GB 18.165.227.8:443 woreppercomming.com tcp
US 8.8.8.8:53 www.ovardu.com udp
US 104.21.96.72:443 www.ovardu.com tcp
US 8.8.8.8:53 www.opera.com udp
DE 18.194.80.201:443 www.opera.com tcp
US 8.8.8.8:53 8.227.165.18.in-addr.arpa udp
US 8.8.8.8:53 72.96.21.104.in-addr.arpa udp
US 8.8.8.8:53 201.80.194.18.in-addr.arpa udp
US 8.8.8.8:53 cdn-production-opera-website.operacdn.com udp
US 8.8.8.8:53 www.googleoptimize.com udp
BE 104.68.66.120:443 cdn-production-opera-website.operacdn.com tcp
BE 104.68.66.120:443 cdn-production-opera-website.operacdn.com tcp
BE 104.68.66.120:443 cdn-production-opera-website.operacdn.com tcp
BE 104.68.66.120:443 cdn-production-opera-website.operacdn.com tcp
BE 104.68.66.120:443 cdn-production-opera-website.operacdn.com tcp
BE 104.68.66.120:443 cdn-production-opera-website.operacdn.com tcp
GB 172.217.16.238:443 www.googleoptimize.com tcp
US 8.8.8.8:53 id.a-mx.com udp
US 8.8.8.8:53 csync.smilewanted.com udp
DE 79.127.216.47:443 id.a-mx.com tcp
US 8.8.8.8:53 id.hadron.ad.gt udp
US 8.8.8.8:53 ups.analytics.yahoo.com udp
US 8.8.8.8:53 match.adsrvr.org udp
US 8.8.8.8:53 id.crwdcntrl.net udp
US 8.8.8.8:53 lb.eu-1-id5-sync.com udp
US 8.8.8.8:53 ads.pubmatic.com udp
US 52.223.40.198:443 match.adsrvr.org tcp
DE 3.71.149.231:443 ups.analytics.yahoo.com tcp
US 8.8.8.8:53 js-sec.indexww.com udp
SE 23.34.232.193:443 ads.pubmatic.com tcp
SE 23.34.232.193:443 ads.pubmatic.com tcp
DE 162.19.138.117:443 lb.eu-1-id5-sync.com tcp
US 104.22.5.69:443 id.hadron.ad.gt tcp
US 172.64.149.180:443 js-sec.indexww.com tcp
US 8.8.8.8:53 s.adtelligent.com udp
GB 185.83.69.226:443 s.adtelligent.com tcp
US 8.8.8.8:53 ce.lijit.com udp
IE 54.171.72.23:443 ce.lijit.com tcp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 47.216.127.79.in-addr.arpa udp
US 8.8.8.8:53 120.66.68.104.in-addr.arpa udp
US 8.8.8.8:53 198.40.223.52.in-addr.arpa udp
US 8.8.8.8:53 231.149.71.3.in-addr.arpa udp
US 8.8.8.8:53 69.5.22.104.in-addr.arpa udp
US 8.8.8.8:53 117.138.19.162.in-addr.arpa udp
US 8.8.8.8:53 180.149.64.172.in-addr.arpa udp
US 8.8.8.8:53 193.232.34.23.in-addr.arpa udp
US 8.8.8.8:53 assets.a-mo.net udp
US 104.19.159.19:443 assets.a-mo.net tcp
US 8.8.8.8:53 rtb.mfadsrvr.com udp
US 8.8.8.8:53 sync.mathtag.com udp
US 8.8.8.8:53 pixel-eu.rubiconproject.com udp
US 8.8.8.8:53 ib.adnxs.com udp
US 8.8.8.8:53 pixel.rubiconproject.com udp
US 8.8.8.8:53 ads.stickyadstv.com udp
US 8.8.8.8:53 cs.admanmedia.com udp
US 8.8.8.8:53 t.adx.opera.com udp
US 8.8.8.8:53 image8.pubmatic.com udp
US 8.8.8.8:53 ssbsync-global.smartadserver.com udp
US 216.200.232.249:443 sync.mathtag.com tcp
DE 37.252.171.53:443 ib.adnxs.com tcp
NL 69.173.156.148:443 pixel.rubiconproject.com tcp
GB 185.64.190.79:443 image8.pubmatic.com tcp
US 80.77.87.161:443 cs.admanmedia.com tcp
NL 69.173.156.149:443 pixel.rubiconproject.com tcp
DE 18.158.184.198:443 rtb.mfadsrvr.com tcp
NL 82.145.213.8:443 t.adx.opera.com tcp
FR 178.32.210.231:443 ssbsync-global.smartadserver.com tcp
FR 154.54.250.81:443 ads.stickyadstv.com tcp
US 104.19.159.19:443 assets.a-mo.net tcp
US 8.8.8.8:53 spl.zeotap.com udp
US 104.22.51.98:443 spl.zeotap.com tcp
US 8.8.8.8:53 cm.g.doubleclick.net udp
GB 142.250.178.2:443 cm.g.doubleclick.net tcp
GB 142.250.178.2:443 cm.g.doubleclick.net tcp
US 8.8.8.8:53 s.amazon-adsystem.com udp
US 8.8.8.8:53 x.bidswitch.net udp
US 209.54.182.161:443 s.amazon-adsystem.com tcp
GB 142.250.178.2:443 cm.g.doubleclick.net udp
NL 35.214.149.91:443 x.bidswitch.net tcp
US 8.8.8.8:53 226.69.83.185.in-addr.arpa udp
US 8.8.8.8:53 23.72.171.54.in-addr.arpa udp
US 8.8.8.8:53 79.190.64.185.in-addr.arpa udp
US 8.8.8.8:53 53.171.252.37.in-addr.arpa udp
US 8.8.8.8:53 148.156.173.69.in-addr.arpa udp
US 8.8.8.8:53 8.213.145.82.in-addr.arpa udp
US 8.8.8.8:53 149.156.173.69.in-addr.arpa udp
US 8.8.8.8:53 231.210.32.178.in-addr.arpa udp
US 8.8.8.8:53 198.184.158.18.in-addr.arpa udp
US 8.8.8.8:53 81.250.54.154.in-addr.arpa udp
US 8.8.8.8:53 161.87.77.80.in-addr.arpa udp
US 8.8.8.8:53 249.232.200.216.in-addr.arpa udp
US 8.8.8.8:53 98.51.22.104.in-addr.arpa udp
US 8.8.8.8:53 19.159.19.104.in-addr.arpa udp
US 8.8.8.8:53 2.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 161.182.54.209.in-addr.arpa udp
US 8.8.8.8:53 static.smilewanted.com udp
US 8.8.8.8:53 sync.smartadserver.com udp
FR 149.202.238.105:443 sync.smartadserver.com tcp
US 8.8.8.8:53 secure.adnxs.com udp
NL 185.89.210.90:443 secure.adnxs.com tcp
US 8.8.8.8:53 ow.pubmatic.com udp
US 8.8.8.8:53 prebid-server.rubiconproject.com udp
GB 185.64.190.84:443 ow.pubmatic.com tcp
NL 69.173.156.150:443 prebid-server.rubiconproject.com tcp
US 8.8.8.8:53 ice.360yield.com udp
IE 34.249.218.139:443 ice.360yield.com tcp
US 8.8.8.8:53 u.openx.net udp
US 8.8.8.8:53 sync.a-mo.net udp
US 8.8.8.8:53 cm.adform.net udp
US 34.98.64.218:443 u.openx.net udp
NL 147.75.84.158:443 sync.a-mo.net tcp
NL 147.75.84.158:443 sync.a-mo.net tcp
DK 37.157.4.29:443 cm.adform.net tcp
US 8.8.8.8:53 us.shb-sync.com udp
US 8.8.8.8:53 s.ad.smaato.net udp
US 8.2.110.33:443 us.shb-sync.com tcp
IT 18.66.218.113:443 s.ad.smaato.net tcp
US 8.8.8.8:53 ssum-sec.casalemedia.com udp
US 8.8.8.8:53 91.149.214.35.in-addr.arpa udp
US 8.8.8.8:53 105.238.202.149.in-addr.arpa udp
US 8.8.8.8:53 90.210.89.185.in-addr.arpa udp
US 8.8.8.8:53 84.190.64.185.in-addr.arpa udp
US 8.8.8.8:53 150.156.173.69.in-addr.arpa udp
US 8.8.8.8:53 139.218.249.34.in-addr.arpa udp
US 8.8.8.8:53 218.64.98.34.in-addr.arpa udp
US 8.8.8.8:53 158.84.75.147.in-addr.arpa udp
GB 142.250.200.10:443 translate-pa.googleapis.com udp
US 8.8.8.8:53 29.4.157.37.in-addr.arpa udp
US 8.8.8.8:53 113.218.66.18.in-addr.arpa udp
US 8.8.8.8:53 33.110.2.8.in-addr.arpa udp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 8.8.8.8:53 1.80.190.35.in-addr.arpa udp
US 216.239.32.36:443 region1.analytics.google.com udp
US 8.8.8.8:53 www.google.co.uk udp
GB 142.250.200.10:443 translate-pa.googleapis.com udp
GB 142.250.200.3:443 www.google.co.uk udp
US 8.8.8.8:53 csm.nl3.eu.criteo.net udp
US 8.8.8.8:53 g.ezoic.net udp
NL 178.250.1.25:443 csm.nl3.eu.criteo.net tcp
NL 178.250.1.25:443 csm.nl3.eu.criteo.net tcp
FR 35.181.89.222:443 g.ezoic.net tcp
US 8.8.8.8:53 25.1.250.178.in-addr.arpa udp
US 8.8.8.8:53 sideindexfollowragelrew.pw udp
US 8.8.8.8:53 museumtespaceorsp.shop udp
US 104.21.32.80:443 museumtespaceorsp.shop tcp
US 8.8.8.8:53 buttockdecarderwiso.shop udp
US 8.8.8.8:53 80.32.21.104.in-addr.arpa udp
US 172.67.218.187:443 buttockdecarderwiso.shop tcp
US 8.8.8.8:53 averageaattractiionsl.shop udp
US 172.67.220.163:443 averageaattractiionsl.shop tcp
US 8.8.8.8:53 femininiespywageg.shop udp
US 172.67.141.63:443 femininiespywageg.shop tcp
US 8.8.8.8:53 163.220.67.172.in-addr.arpa udp
US 8.8.8.8:53 187.218.67.172.in-addr.arpa udp
US 8.8.8.8:53 employhabragaomlsp.shop udp
US 172.67.203.218:443 employhabragaomlsp.shop tcp
US 8.8.8.8:53 stalfbaclcalorieeis.shop udp
US 104.21.3.197:443 stalfbaclcalorieeis.shop tcp
US 8.8.8.8:53 civilianurinedtsraov.shop udp
US 104.21.49.245:443 civilianurinedtsraov.shop tcp
US 8.8.8.8:53 218.203.67.172.in-addr.arpa udp
US 8.8.8.8:53 63.141.67.172.in-addr.arpa udp
US 8.8.8.8:53 197.3.21.104.in-addr.arpa udp
US 8.8.8.8:53 roomabolishsnifftwk.shop udp
US 104.21.55.87:443 roomabolishsnifftwk.shop tcp
US 8.8.8.8:53 245.49.21.104.in-addr.arpa udp
US 8.8.8.8:53 87.55.21.104.in-addr.arpa udp
US 8.8.8.8:53 91.16.208.104.in-addr.arpa udp
US 8.8.8.8:53 sideindexfollowragelrew.pw udp
US 104.21.32.80:443 museumtespaceorsp.shop tcp
US 172.67.218.187:443 buttockdecarderwiso.shop tcp
US 172.67.220.163:443 averageaattractiionsl.shop tcp
US 172.67.141.63:443 femininiespywageg.shop tcp
US 172.67.203.218:443 employhabragaomlsp.shop tcp
US 104.21.3.197:443 stalfbaclcalorieeis.shop tcp
US 104.21.49.245:443 civilianurinedtsraov.shop tcp
US 104.21.32.80:443 museumtespaceorsp.shop tcp
US 104.21.55.87:443 roomabolishsnifftwk.shop tcp
US 172.67.218.187:443 buttockdecarderwiso.shop tcp
US 172.67.220.163:443 averageaattractiionsl.shop tcp
US 172.67.141.63:443 femininiespywageg.shop tcp
US 172.67.203.218:443 employhabragaomlsp.shop tcp
US 104.21.3.197:443 stalfbaclcalorieeis.shop tcp
US 104.21.49.245:443 civilianurinedtsraov.shop tcp
US 104.21.55.87:443 roomabolishsnifftwk.shop tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ea98e583ad99df195d29aa066204ab56
SHA1 f89398664af0179641aa0138b337097b617cb2db
SHA256 a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512 e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

\??\pipe\LOCAL\crashpad_1524_HJXCGHSLPOCNTHZR

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4f7152bc5a1a715ef481e37d1c791959
SHA1 c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA512 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 841b1c055f6bdb760021a06a426c1b3d
SHA1 58d56340c1f4c11b203d2054fc80370de119b6d7
SHA256 8783b78e1cb569d5284c389ea138ce9aab88f4e818228a892e48df8e7b69eadf
SHA512 12a3ff19636fbe57370cf6e85b0e8448be90746526f43c3fe18b22850c9df10f9640cbee23ca6b8534916d7d489b2dd2d87574579b23f9dcd08da3f5578570d7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6a9adc0777d99e5a11641f9aaaa6104a
SHA1 173453a6a34f5b57f0d93d9a02f8f99711ac536e
SHA256 a7b3c8ee412e024a261b75f3147389b7944c2564e289fdb55dba20e9a028181f
SHA512 3d3dd43c7d7e698fb2f267c1aeea8a000beeb77b6f56d857f0507c70a01cff29bd4c09a498559c5d2bd5a2daf002a3b2b5737e4ed5ac12d1d74463a41dd53ba1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 45f2456dda82cdf0ed56038210365077
SHA1 828ff7a724ac1eee236e777d11cecd898ea73f8d
SHA256 9e4b3404a455e3047744a0bda70656a02faa1d1c388d13b45890d26e23c1e968
SHA512 83b5a8028e5cef1704d386d2bb5d3f9799fc9e5c7cb840514fb2b20f5a5815cc3459d34471bab7dbd7ae48a432940799de0567c6a602587efdd50f767cbe304d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 3b9ef569752cd776d12f3a04a03fa814
SHA1 1358e5d951e6a3e2c15b9f353ee41c1de03ad2c3
SHA256 696f4f0d373704fc1bb899febf09d0c7831afedfb089b31fb41540f817a0fa23
SHA512 6d276c1503310356b0d7a53d188fc1cb3f61e490651acef1324514ac8ccd802d017983f4c4009e2a9867fc7df61a5631bf363a415834bcbc4511141d776003e4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 7c5d57eb83abfe68489c56259daff19a
SHA1 bbe97d56dcf600b693d6dfe1eccbfd8da0fc46b7
SHA256 eb92d0de7d74d366f8676ffc418f4355870081a94e2deaee42f3ae234d2bcdb3
SHA512 9a5375c16ea65cff5e7c5ef7a7a0d8896661530b66597363e487781931e9c7b75df933ad883c05ba3ba85d86a2c9d799e535f640734eb309a194f7a7fd980580

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 b136570db262646b79c202bab420ed89
SHA1 041a251fad900dda4ee02e6b42219dde1c481652
SHA256 620ae4a10bc1f62d66fb4ea6e4ab899e34e8fcdf2d1bc3f3376f7df5be4b1b07
SHA512 520121e2a6f25e3f7086835a9f71f5249d8f021642211b9195fdc5740176bcda2e27029d2c4b6df9a1e8f578bf167b5a20c3aea0d9fb685bb0d830ad2753b6dc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58ff99.TMP

MD5 bfe840c52a02eaa3e828b8cebeed18b2
SHA1 877771688589bc50b19a1fb39eb0a285968ef6b5
SHA256 92a7c688e341dcfd18798887f8590300caf5e4024f8ee36abe89c9e69c3966a7
SHA512 d0666111a7764b9ac9e975c43ad4a08b912512f4ebbdf5d4ef766a9f35767eba43d7a2eb07268df564794faa4ad8655cf293310aae2b4b25d01bd4f1bbe8a4da

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c0bce2598c1b0cf51d5d5af9cec4d146
SHA1 5ca388dfb412ccdf65e060f89fed92b02d5a2b24
SHA256 ad6aa5686a5575953e4a3ca52bb4982008697ff617e59403c6033086d6362082
SHA512 b08dc2054b19c3c350ee3b6e439a6cd95810fbb1aeb14f4f105373d01166d6429278b295c44a6daba9479bccd8557e04f1f469e7ebd106cf1d9595a4649af18e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 8100d0251f5616d0a28f5ce7ce9ec8dd
SHA1 7bcdd0b64dc225a451a620256959af77f6925836
SHA256 9f53fcc806ed8914c30178099fbd010ca99cb80753f2791b5b256d9ef65a3606
SHA512 783eaf50a69279d51b858b0113f2b2be190eb6de7320ec3d37adf5e7a8f5552799d178814d8d4d04c22cb1a67c15d93b1b4dde8b66a648c3500b8168206940d8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 a07b8694db5087576cd734ba110166f1
SHA1 80409982274c5f5bd45629e2a443076efa66f384
SHA256 41941ae0236811c6443f453a2662f5e8835a975fb3a9f9a92d34b1d4fd40fb7f
SHA512 a53876d31fcab542a48ad4861152f66ccf2b20e62f61fd7ca9f26264fed9b5d372281ef1e61befd563da8b7d15585bf9c35c9615e6a2379cfa4688da8aa87733

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 30c1fb90e25844afb4e2a58992c50f9f
SHA1 c3cbc73352e876add067fc57776694a34992b9b6
SHA256 dc49488806628802808dbb2203c7303cb8cadc32b68b88d2a904b3a31d569b2b
SHA512 ee4817b7ba8069bd6af076ae3c5a6a67e695417d6cce3158e1e249d2366d46a0f98896d06e5a7234b536ddba7064d11c80f894e9565daff8a01f5eaf15d298c9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 8488df0ac2c1ccaa5b664559c4f13782
SHA1 4144d0a1100a4b915610644d03ab934edbdb970f
SHA256 593b7a43c583b7362e9cf9eeea47ce7e0b02dfb05d6af29e5316dfa8a3ae099b
SHA512 324f4adb38de67b64aa9187aebce92d9886bd0d786b638e37365281586e273a6925ccaad00073fe41bbf3047f1d92be8b5e17a3c05aaf29979120f2fe101e94b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 83421e6e7517866d079f8f3c68fa3b8e
SHA1 92171751a4ad155e7c545b06082ca7bd39300ca0
SHA256 04bd6cbdab9bbc672c4ae57e77ff614661f997f0c12e04b207ce4669448c9df8
SHA512 041a42a8a3f6eea4ad17499f1907fe34b8ef684d935431754e357bfdbef1fd6878581204d113b1a7965e0fdf05a3ba4acc50ae2a78110dc8cf510c5be38da573

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\026c5068-7469-4c20-8f78-53d15bdfb305.tmp

MD5 44bca81dc2c6e318126e3b0891d328f2
SHA1 8151fc901da5096eef4777a5b344c8a905a6220a
SHA256 f36fc1b1a7d707b70f8e66f1345ab94a0dc73aa5e2718b374690a7cfa2994d2c
SHA512 a58ffdfc0a07a257e10e4d7d1290f8c9392ff1977637118e9c4b37d5f5fc226d218cab2e8a8c20dc24dbd30efa00266f21f40a90355271e246f05ed39e4fd582

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 af0a16fd5343179aeefc48c04389eec5
SHA1 b65a150a7f0b03cb116335bebb08c6268f75ab0e
SHA256 9f04de30d98ef86e7399e9935cd0d3534757d182a03f915d3681311a9e7c1319
SHA512 8c4fd229d449b591951c458537b4935c6cbcf83ff499e7c809f9f9e47ecf67f2591f187f1a70ba4fd14746a2380d1ea3f67a8ffb818028a1b31ad7f63af0b318

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 3115a1a6df832d54012e0cf0e0eb07c6
SHA1 fe35be51c05b2ebddb5c888f31e0cb6fd7ea4802
SHA256 04439f97aa51c381bdb91cbe64a393459a47964fa63f016ba2f647f7142fef93
SHA512 c784a679ecf592e7620e7d5fe9f9cc6f58ad9567f7808606ee23d59e4d0d9999035894af3640a50b1bb456caba2af9f08180d769d390392503cf7cce1ce78158

memory/5776-1653-0x0000000001530000-0x0000000001531000-memory.dmp

memory/6060-1654-0x0000000000400000-0x0000000000454000-memory.dmp

memory/5776-1655-0x0000000001530000-0x0000000001531000-memory.dmp

memory/6060-1656-0x0000000000400000-0x0000000000454000-memory.dmp

C:\Users\Admin\Desktop\Launcher\dll\helper.exe

MD5 fa65a7aa5711dd8f6d16cfd45cec392f
SHA1 a88b05f1c4e3ebdd691aa8f2cded523d2f4dbc93
SHA256 893844308af014ec38999a21a801858e94359cb19149f64d60db29413f12ab43
SHA512 63d7b32a9fed13d25cdb890ff7f422622fc53933d065edd6e2e7615f4de103c60bb74dc7e05cf656c40e818ef354facd25b1156dd867e82badb33dd298c2c62e

memory/5376-1659-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-SILPL.tmp\helper.tmp

MD5 8aa8c628f7b7b7f3e96eff00557bd0bf
SHA1 9af9cf61707cbba7bf0d7cbed94e8db91aff8bd6
SHA256 14d4fa3ea6c3fbf6e9d284de717e73a1ebb5e77f3d5c8c98808e40ade359ea9d
SHA512 5e0a4765873684fce159af81310e37b6918c923ccede0c4de0bd1e2e221425109131830cff02e3f910f15b0401ee3b4ae68700b6d29a5e8466f6d4ee1dcd6eeb

C:\Users\Admin\AppData\Local\Temp\is-A5E53.tmp\TempkillProcess.dll

MD5 2d8ef1f86c38696abef55d64942a2c4a
SHA1 f6710bdda76a1cdb2669f49796f6c3161a895973
SHA256 e6be04c390cee6b4955c8af0c78221fdea3907ca5d0fb5f4f256fe7b05e8a332
SHA512 f668c37d9f722ce8217b87fe6cf2183ecc16451a1402a9d8d143ceac914e7b0056cf8d6aca8f81889cb954c85f12af304efe6d5d9121d4287e47aec2b6732da7

memory/2760-1674-0x0000000003930000-0x0000000003944000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-A5E53.tmp\KPByName.dll

MD5 4ef13e267ebbf804dd4157b447aa7059
SHA1 b9507c5b02bbae456ae5de7132ebafd27206b944
SHA256 2476d897a6d20653578fcb98737c85ccd96a42e57f67843ffbc431c0d05909a7
SHA512 81df3f309b6a734fae2e824a4535d9a7251d94885593c7c37ee70853f7c721062023d0d22ba1c92845c6fd14356048478b83c132aa9cec9360690a65b74bf360

memory/5376-1682-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2760-1684-0x0000000003930000-0x0000000003944000-memory.dmp

memory/2760-1683-0x0000000000400000-0x00000000004BE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-A5E53.tmp\WSHelper.ini

MD5 c3d37313bf465f6145bb6f9bd845622e
SHA1 1a27da4300e997e07da73f2916483862f9fe1fa4
SHA256 1b74775c8d88a46c6f1727029a4acbda6dd9cd1bf5298a3746ce104e0da8f8b6
SHA512 4e92ec23d618e8ef2559be1c5d2cb243e2eb074aad86ffb338e3584806953efdd22856847a35bdfee1aa77756dc2b34f526777bd6fedaf5e4b982391d31ad2d6

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe

MD5 fe84f125c65b81039acc9ea54b887ea8
SHA1 8d68d1fdd365f9fa40ef25d0ab1ead4361c7f9be
SHA256 546dbcc7a073099096a027efba2598b8242476a0ee20d7026ddee2251b0edf57
SHA512 188f81c6fe7d8839cf9b35e38512cec7ef63c1cf6a630ca5ed836023e2c1fc333a9f5dbd2446d9fa4d72f1044edbae981358062eec1951badf9626c8c7f518d8

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\DAQExp.dll

MD5 ead517fe26df369aa13cf9aa620b935e
SHA1 0797d65e0e90f9f2c9e6ae4a673261389aa8b2e5
SHA256 e57e457c56447640011298bf85d589964eacdfe8125b36d6ad0f12d2ec053efd
SHA512 61f3cda3fc26da9b6a98c1912c3df9fce056a7cd553ca365f6992d8ee91c4be18dc50d84f2c42c498326b76f36eb7ac406d0e566b30ba1b4e3f14004e9373cbe

memory/2984-1773-0x0000000000BF0000-0x0000000000CA8000-memory.dmp

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSProducstInfo.dll

MD5 e867ab7faf5462d37969565962275e3a
SHA1 6e33c444f016183dbf24117931130eebb02bc763
SHA256 c22d5cdca62e16567f8c130a5e9ddf7e77212904af5ae34c7888f3aac89e1bb1
SHA512 58710340fe2285179332bb34df544f49b54db3bf898557231c71c940b4427242f0d06e430ed25f71ced643d52d4586258830b3ed1cfc3a94eab4d9c9802c6cf1

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\Controls.xml

MD5 2ccd73ad418bc151d2cb71199c6b9810
SHA1 2c1a2e7279efdae213830bdcb592663b68c225e2
SHA256 2f6a09a26fcf3c420688e3a26c53b88b90554b6a5a08776d5bf341d17526949c
SHA512 b8895bc4b2ad080c034f68584a910f41cd57bd9aed38254e2e10182fee81badf4ac5b7dabf7996f06878c5ff3f83bd2cc746406a6cbed466fb496d33981e677c

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Languages\English.dat

MD5 f49b3dc0407d545259d7518171970c52
SHA1 9246cda22f90d743128250ccbdbcf06929c55d4b
SHA256 516482b3719d639bde4e134b09e227b51610d307ea9b53c425d70bc705043934
SHA512 809867a7ce7d4c784de7f51f3cbd61fbd5ac724c0745a327d51887d5140f26de2815b04beea4a76ab73057752ee443b865bee0d594a81d3d8227285bf1d28c65

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\TipFrm.xml

MD5 4a65425e52ccb800479f50424c368da1
SHA1 8adc6fd5077624cd38558ecc8194799680875b54
SHA256 c703ea1a52f1833d2498076460ea2a920713b8af2aaaf8dba8e1d07a7435d23f
SHA512 2229d2eb046b8f7830b593a20f0ff59de011de9a2f8a8c818a857faac82b4748ca2b894f3a3bbe5e5151a5242b590a0ffcfc8729681cf4b9cd9a62e39fc3b552

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.ini

MD5 82e3a04df52dba9bf65d0ad0f54e0a99
SHA1 74db555d6c6fc50143017a2e166ce27476bbbdb0
SHA256 193517b0756deab0c5b83d096576f86436527a52b40e02ab5fe872531a240d43
SHA512 e5e5d203b6154756005f5f7b847f03f17c263fd08163637b13b674be9d4568245ddc8e6ef9f107ece563aea1bc43a4d3f3016caf830385a9a5724a099c4cd51a

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\CBSCreateVC.dll

MD5 30ebdc01d3ab9fb3772445cb4a9ebbba
SHA1 f0eee5c8a4f416673ee5a0698075c124aefc5d14
SHA256 0ea512eac7298ed72e8d47da4db8d73557599cd2411f69657cc374cd0704e8e8
SHA512 4be686006d169dcd1f18dd85b0cbf0c13e1e6cfe6ec60f9cea32ba1afae811c0dd232de2d569de164a7c5a1108960551b04c28600f8959a51fc0bded78ca3fa9

memory/2984-1781-0x0000000000BF0000-0x0000000000CA8000-memory.dmp

memory/2984-1780-0x0000000000400000-0x0000000000612000-memory.dmp

C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.ini

MD5 65daaa150fe43826ca5f3038b4e5146e
SHA1 40b7343322b7de29f3bb9e0e3736959d26951dbf
SHA256 97a9f90b9185403685c46742c16daee7d4462bad70b25c68bfaa893521c0f453
SHA512 f2b628342986f200edba1135c9ebc647ef1d8f7fed641fdbd3d5abe0a1313c4fe54ffba508fb9df612964c58541a578c144f54d63426c96912eea18079af2ed7

memory/2760-1797-0x0000000000400000-0x00000000004BE000-memory.dmp

memory/5376-1798-0x0000000000400000-0x0000000000414000-memory.dmp

memory/5948-1802-0x0000000000C80000-0x0000000000C81000-memory.dmp

memory/5288-1807-0x0000000000D30000-0x0000000000D31000-memory.dmp