Malware Analysis Report

2025-05-05 21:13

Sample ID 240626-tpt3sasbpa
Target EXEC MASS DM.rar
SHA256 2b28af2697d7233c51bb46b88a04fd02765ea6cf475b2da18ec27944ebfb9617
Tags
pyinstaller
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

2b28af2697d7233c51bb46b88a04fd02765ea6cf475b2da18ec27944ebfb9617

Threat Level: Shows suspicious behavior

The file EXEC MASS DM.rar was found to be: Shows suspicious behavior.

Malicious Activity Summary

pyinstaller

Loads dropped DLL

Detects Pyinstaller

Unsigned PE

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-26 16:14

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-26 16:14

Reported

2024-06-26 16:16

Platform

win10v2004-20240508-fr

Max time kernel

81s

Max time network

79s

Command Line

"C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\GPU C:\Windows\system32\wwahost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\GPU C:\Windows\system32\wwahost.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Windows\system32\wwahost.exe N/A
Key created \REGISTRY\USER\S-1-5-19 C:\Windows\system32\wwahost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software C:\Windows\system32\wwahost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft C:\Windows\system32\wwahost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography C:\Windows\system32\wwahost.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost = "1" C:\Windows\system32\wwahost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings C:\Windows\system32\wwahost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperienceh = "0" C:\Windows\system32\wwahost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\system32\wwahost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheVersion = "1" C:\Windows\system32\wwahost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CacheVersion = "1" C:\Windows\system32\wwahost.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost C:\Windows\system32\wwahost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix C:\Windows\system32\wwahost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheLimit = "51200" C:\Windows\system32\wwahost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage C:\Windows\system32\wwahost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState C:\Windows\system32\wwahost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\MuiCache C:\Windows\system32\wwahost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache C:\Windows\system32\wwahost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies C:\Windows\system32\wwahost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer C:\Windows\system32\wwahost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpState = "0" C:\Windows\system32\wwahost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheVersion = "1" C:\Windows\system32\wwahost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage C:\Windows\system32\wwahost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost = "0" C:\Windows\system32\wwahost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content C:\Windows\system32\wwahost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost C:\Windows\system32\wwahost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History C:\Windows\system32\wwahost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" C:\Windows\system32\wwahost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CacheLimit = "1" C:\Windows\system32\wwahost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpCleanupState = "0" C:\Windows\system32\wwahost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperienceh C:\Windows\system32\wwahost.exe N/A
Key deleted \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperienceh C:\Windows\system32\wwahost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache C:\Windows\system32\wwahost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheLimit = "1" C:\Windows\system32\wwahost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\wwahost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wwahost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\wwahost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\wwahost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2372 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe
PID 2372 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe
PID 2852 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe C:\Windows\system32\cmd.exe
PID 2852 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe C:\Windows\system32\cmd.exe
PID 4020 wrote to memory of 3480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 3480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1492 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 3664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 3664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4020 wrote to memory of 1620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe

"C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe"

C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe

"C:\Users\Admin\AppData\Local\Temp\EXEC MASS DM\EXEC MASS DM.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c title [EXEC MassDM] By Naams - Main Menu

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault2e084f69h3070h489fhade3h27b9abb51f62

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffaa66f46f8,0x7ffaa66f4708,0x7ffaa66f4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,15529456994774002018,12853225807733285903,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,15529456994774002018,12853225807733285903,131072 --lang=fr --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,15529456994774002018,12853225807733285903,131072 --lang=fr --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\system32\wwahost.exe

"C:\Windows\system32\wwahost.exe" -ServerName:App.wwa

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -s LxpSvc

Network

Country Destination Domain Proto
US 8.8.8.8:53 cxcs.microsoft.net udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI23722\python310.dll

MD5 7e45e4d723e4775f6e26628315f370ad
SHA1 76a8104c5d073c6f7619872426d440bcabd18bb9
SHA256 7cc15b7440710f8fecaa67396b83436b3b2962e3757482dfbaf926ee74f86882
SHA512 4e11316ebbf6af953dcf991148cca98a155d48d4f8b5ee068f2bc7a56aa14c8a7661d52ecce9bc3c4aa5495868503b81010d81c4fe3a15fa789f13ce081c82fb

C:\Users\Admin\AppData\Local\Temp\_MEI23722\VCRUNTIME140.dll

MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0

C:\Users\Admin\AppData\Local\Temp\_MEI23722\base_library.zip

MD5 7bd70abdc1266a590ed1dd4976b2685e
SHA1 b88e9b9ad030436c157d18f2645450542d98d7d8
SHA256 02ab244fabdb5fcdca62eecc3cfc30512928eb120d0490da0bbf1db653237eca
SHA512 61b231d9b5061499f939594021d108c56d16a2d2efb361dc9987eefea14f18ec3fe380d5ef455c6cd3218aa409f976dcfb236e99c9eec1a7fda6abe4360983da

C:\Users\Admin\AppData\Local\Temp\_MEI23722\python3.dll

MD5 f5cb0f83f8a825d4bedcddae9d730804
SHA1 07385f55b69660b8abc197cfab7580072da320ea
SHA256 a62a9c7966cf614b3083740dc856ca9a1151ddcc0b110ebc3494799511ed392b
SHA512 2bfa35eb4b8fff821b4504eccad94ed8591ef42e0cdb39a18458395789508b4d2da76f0de3708d963c3187b8b1ced66b37c66834f17eeca0ceb45a62b3a69974

C:\Users\Admin\AppData\Local\Temp\_MEI23722\_ctypes.pyd

MD5 b754feac42b118dbeb2d005bcf8036e3
SHA1 c48d63eea9868ed2f071e8baeb8faa7d323b48d9
SHA256 e880e94d0035bcca283a071bd5f18024d247564c2c68f41b381270eae08e1f7c
SHA512 1f6212e63bcfe562dcf611c8bd794318e76f702483cfd039062dddb0356742776d3efce96196b820a7c06208a35f4bb12cfa27996a9dc7d4e549912c9b9cb8f1

C:\Users\Admin\AppData\Local\Temp\_MEI23722\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

C:\Users\Admin\AppData\Local\Temp\_MEI23722\_socket.pyd

MD5 b85ad6a94540aa911f19c325e5930963
SHA1 3237b849265802124197a48c84bf320612e1197e
SHA256 7dadd3b369db35cd752e11c901a7f77329cdfb9bf027120e224446453a1463a2
SHA512 c9675e4b994ade44828c7f2d5e8e0085c09abc83a08ea4716aebf2aca93ab3c4b9478228247945ebb5fe8ffffb109568d862419e61e1776410c2bb61db8562f9

C:\Users\Admin\AppData\Local\Temp\_MEI23722\select.pyd

MD5 a67a37cd1f39e95ced02b6f3e7a0c17c
SHA1 4c261ca2e826b9ec54ecae706545206f5b6c5f72
SHA256 f060ecc836852323d69d9fed9457528de58a841ad1d48130863f9a0a917014fb
SHA512 409290b6b40c27e3bdcd95675fa002fdff6dcb3f4c734521c350373e6d4f634dc7c02f67d060607d14e2c4b91f17dea6ffa415c33e167c3cfaf1d84ff5d65a31

C:\Users\Admin\AppData\Local\Temp\_MEI23722\libssl-1_1.dll

MD5 de72697933d7673279fb85fd48d1a4dd
SHA1 085fd4c6fb6d89ffcc9b2741947b74f0766fc383
SHA256 ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
SHA512 0fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c

C:\Users\Admin\AppData\Local\Temp\_MEI23722\libcrypto-1_1.dll

MD5 ab01c808bed8164133e5279595437d3d
SHA1 0f512756a8db22576ec2e20cf0cafec7786fb12b
SHA256 9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
SHA512 4043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2

C:\Users\Admin\AppData\Local\Temp\_MEI23722\_ssl.pyd

MD5 f540e92976041ff33b224e50bef20126
SHA1 e77f0afb4cb8aea2fd18c3c8e4ac3efdc9101b8b
SHA256 f1377098d32690a8a62c275bf0581417e9f179dfe97671eb98fc4bf565daddca
SHA512 277ad1284ec41d2a063d254453ffe3c11a968e4afb7f03dc10d4a01fa22b4a57e5874d1b3cd59db9c65fbf28e2d47da754676fdfe6a0ada0e2e04e62f8b4e7d2

C:\Users\Admin\AppData\Local\Temp\_MEI23722\_asyncio.pyd

MD5 26a31284164c902d12bfa524b65c4905
SHA1 e64f1a95a58a2840e8d82e0ecc9becdd1288895a
SHA256 447007ff246edf18bfe20d88d964f9bb4c30816f21ea7baae6b1036195fe54ff
SHA512 64e61b5271263bceef74ca6ad0b788806895878e677ca3fa9b8141056554598462485bcb0eba884fb767eceb4497fc87b040ba0f71f240fad68dfe92be98dd2a

C:\Users\Admin\AppData\Local\Temp\_MEI23722\_overlapped.pyd

MD5 d3de9c070cbce3409e96e23eefc7dc3e
SHA1 08baa741495d7166aeba5b07588bad9514792a7e
SHA256 8174da038e1a5668d77b5c7c203b26e540dd376b2a2ebc5508a93d1938cebd08
SHA512 2f2742aff97133047bc4e334440b274add4798cab73cf79062da5f72a2fd59ec60922be7d5a185cd6bab2847f4265d885cf32b9008b32006e35e27727fbc9a25

C:\Users\Admin\AppData\Local\Temp\_MEI23722\_bz2.pyd

MD5 f25a6086f553912823debfac50022783
SHA1 e7aa566b85990bc538b56cdea4b167675fe4d6f5
SHA256 460ba09fe832a852be740473343017321d3d1104d80896cd4b6e9c144c72433b
SHA512 841f3f5d13dd77ed9576f7dc4f944b45ee3113a77e2fa82711098829f7dec0bd2dc303bc07953dd08397cf4051cb2bd03c80a6c9c18af6708f20fdfa9e4d0443

C:\Users\Admin\AppData\Local\Temp\_MEI23722\_lzma.pyd

MD5 28cb83c31e2bc5cdb02091196d8cc249
SHA1 b8a22821889fd85cf1f332639e5ee7befad56823
SHA256 86ff13abf066184cb9a272541baf4e6b673d33643e104113e343876c65ec923e
SHA512 5299f35455050f431c8d7704c36c54adf2dfa6505fc5446bc98555739c648d4c245251f9edce43d87446470f85f44d281e58643bbfe99d0c872d1f775761c28c

C:\Users\Admin\AppData\Local\Temp\_MEI23722\_hashlib.pyd

MD5 4b4e3c144d07513be4c724741df080b7
SHA1 ee07182142982134237df15afd94c4034573bc6a
SHA256 0b2e389a4aaf10cde846629171926c87ff2d39e13bdfd2dc2a97b17f0cda659e
SHA512 b7e0399d0c855dee1a64bb50e72b278438c1cd59df7c78fa243e755eaa0d06172e6446f5bc4e8157603d91cea094246cabdfd7635a6885eb8b2967b90cc6a0fb

C:\Users\Admin\AppData\Local\Temp\_MEI23722\multidict\_multidict.cp310-win_amd64.pyd

MD5 1b59c87f0871fed4ff2be93c5d9234ab
SHA1 7e5c8827a5b2dec5417800ab0a2001af46ab8924
SHA256 b7151a6ffa3dc7436d09b1e35343801e11f423c6b391f1177254236ec47a3ad7
SHA512 6092628a4c73ca2d29b6f6a0d1ed34627795363c89b2a45bfc75951f8148a288707231575183ef73d4fb24c022883ab3ab30da61c92664295fffd8a36e9200df

C:\Users\Admin\AppData\Local\Temp\_MEI23722\unicodedata.pyd

MD5 686beb1c76bce6bff2985da9acc8aa53
SHA1 b3c8feba2d45ae77dee5aca599c9f29df15e0e93
SHA256 2350440b5db37cad0fbf65b4eea4f9254870d041436209eae5ae7012844615db
SHA512 ad2c42de8ca1d754f2ae5f206b1235fd412c1591475897459122115a12f5559c54ccb668308bbdd45c887e13f83116bea6e72e804e1c40014165e43d2beb581e

C:\Users\Admin\AppData\Local\Temp\_MEI23722\yarl\_quoting_c.cp310-win_amd64.pyd

MD5 7e620bd4ba53daae5df632f2774b9788
SHA1 28ec3b998f376b59483ad4391a0c2df2c634f308
SHA256 84c696ed1b5ba6a3819d73b6f27aee93bca72286b32307fe259e23dfc1cfacec
SHA512 e2d012dd9a7959c0e06340de3728d6e800b56cc0bc8d525c38dd49d9874095d2edc3ae06862d1a21e873c0da0678e8ab3bc95a57777d746f0d6d8b0c6c08c202

C:\Users\Admin\AppData\Local\Temp\_MEI23722\_brotli.cp310-win_amd64.pyd

MD5 6d44fd95c62c6415999ebc01af40574b
SHA1 a5aee5e107d883d1490257c9702913c12b49b22a
SHA256 58bacb135729a70102356c2d110651f1735bf40a602858941e13bdeabfacab4a
SHA512 59b6c07079f979ad4a27ec394eab3fdd2d2d15d106544246fe38f4eb1c9e12672f11d4a8efb5a2a508690ce2677edfac85eb793e2f6a5f8781b258c421119ff3

C:\Users\Admin\AppData\Local\Temp\_MEI23722\VCRUNTIME140_1.dll

MD5 37c372da4b1adb96dc995ecb7e68e465
SHA1 6c1b6cb92ff76c40c77f86ea9a917a5f854397e2
SHA256 1554b5802968fdb2705a67cbb61585e9560b9e429d043a5aa742ef3c9bbfb6bf
SHA512 926f081b1678c15dc649d7e53bfbe98e4983c9ad6ccdf11c9383ca1d85f2a7353d5c52bebf867d6e155ff897f4702fc4da36a8f4cf76b00cb842152935e319a6

C:\Users\Admin\AppData\Local\Temp\_MEI23722\MSVCP140.dll

MD5 bf78c15068d6671693dfcdfa5770d705
SHA1 4418c03c3161706a4349dfe3f97278e7a5d8962a
SHA256 a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb
SHA512 5b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372

C:\Users\Admin\AppData\Local\Temp\_MEI23722\_uuid.pyd

MD5 0d98febeb51ac1ccf107ae166aec31b9
SHA1 ec5bb535f505c96c326bc93229ba90e7e00045e5
SHA256 59b4d0b9c0390a402cbb2b174be4c425a3b63abaf7d4af8ec0e330296d531cdc
SHA512 2440b094b41e207a221024f0c12d92197a577efc031deea272612e92828bf999a9089389afac8ca3d7f495e6bcc4e41123ec98dcf09cf000a50735b084422fb1

C:\Users\Admin\AppData\Local\Temp\_MEI23722\nacl\_sodium.pyd

MD5 f2f8c186dbb91b3dddf6aa7b44ee05d4
SHA1 95eb61564c5191e59ca5e359646e9564d77a6f97
SHA256 ca83a6731e6d49ccb86d94601b148bd4cc36ad89f9cdaae6eec46481047d13ec
SHA512 ae2c2ef8abf304cd9132add4cc2f08c4c5486ad96058351fe101788d014a04cb554dec5fab779f9a2ccb9d13ffac45dca3db89e36de163076e5b4c9ff171738e

C:\Users\Admin\AppData\Local\Temp\_MEI23722\_cffi_backend.cp310-win_amd64.pyd

MD5 282b92ef9ed04c419564fbaee2c5cdbe
SHA1 e19b54d6ab67050c80b36a016b539cbe935568d5
SHA256 5763c1d29903567cde4d46355d3a7380d10143543986ca4eebfca4d22d991e3e
SHA512 3ddebdc28d0add9063ee6d41f14331898f92452a13762b6c4c9aa5a83dde89510176425c11a48591fa05c949cb35218bf421f1974e33eb8133a1b95ea74e4941

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

\??\pipe\LOCAL\crashpad_4020_NIPCGEZGKJKHFPXE

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 8e8986412720e9ee0081a43e4e90510c
SHA1 95f096c357f2f2d8dd2e9e80c0750b30283c5077
SHA256 cdaed5b1fe70e536dcb6f04627fa142c44f2ed3629d722180e1638ce69f45f3b
SHA512 79d316a80b4d2be7ebbaa0b4d6d8205c11f5dbae3ee73c38f31ee61663fd3c56a8a5d1c7b5b493136b5c7f105db049efc2c78314f70c707f34864d491407ebe2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 835e485b190a2278641e56dfab9c12f1
SHA1 f0e56455c57119ab8911daa74d868f9f1ba0825d
SHA256 673280e1213963658c8288e7b77f1a2ae3de9437320e2cdd05ca196fbee6de8e
SHA512 45e5d8e940e8d51ebd32a33e5f05407c7d04635fc956c2f6f75da38fe5ea02b73e707aa56e51ef94cf1526f88057e794759061bdbf1aa6a1dd1d89990a2ecb0d

memory/2916-146-0x0000018CA0600000-0x0000018CA0700000-memory.dmp

memory/2916-145-0x0000018CA0600000-0x0000018CA0700000-memory.dmp

memory/2916-340-0x0000018CB3DD0000-0x0000018CB3DF0000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\LocalState\_sessionState.json

MD5 ba91ca0d90d724c825ee438af9ab7b7c
SHA1 c0e550da94cafacb920ab187c2122160a5588bf2
SHA256 8e8db4463a65a277b013c64f994c3f8e7dfb0b441db7b8ab65c1add728b5da9f
SHA512 94def85662ac0e56c0eb3ba6eda8d346103abd1cfa976234a18d699c439e374a1c23133ab5735154e89bdfe4e870d36256dc6da1ec2d10a198d928fddabddcca