Malware Analysis Report

2024-11-15 06:25

Sample ID 240706-y9v8ssvakh
Target [email protected]
SHA256 c3030eb910a9a625cd7ccfb58c831efe98db82b6e20e294d101345c24c162a2e
Tags
lumma execution persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c3030eb910a9a625cd7ccfb58c831efe98db82b6e20e294d101345c24c162a2e

Threat Level: Known bad

The file [email protected] was found to be: Known bad.

Malicious Activity Summary

lumma execution persistence spyware stealer

Lumma Stealer

Downloads MZ/PE file

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Accesses cryptocurrency files/wallets, possible credential harvesting

Power Settings

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Command and Scripting Interpreter: PowerShell

Views/modifies file attributes

Suspicious use of SetWindowsHookEx

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SendNotifyMessage

Scheduled Task/Job: Scheduled Task

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-06 20:29

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-06 20:29

Reported

2024-07-06 20:33

Platform

win7-20240508-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\[email protected]"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\[email protected]

"C:\Users\Admin\AppData\Local\Temp\[email protected]"

C:\Windows\explorer.exe

"C:\Windows\explorer.exe"

Network

N/A

Files

memory/2008-0-0x000000013FAC0000-0x0000000140B6E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-06 20:29

Reported

2024-07-06 20:34

Platform

win10v2004-20240704-en

Max time kernel

210s

Max time network

213s

Command Line

"C:\Users\Admin\AppData\Local\Temp\[email protected]"

Signatures

Lumma Stealer

stealer lumma

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8CSO1S7HME9QSJ9OS.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1032 set thread context of 2028 N/A C:\Users\Admin\AppData\Local\Temp\[email protected] C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2480455240-981575606-1030659066-1000\{A6B388ED-B9D8-49D1-8E12-343D8F3C4C19} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A
N/A N/A C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A
N/A N/A C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A
N/A N/A C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\[email protected] N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\powercfg.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1032 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\[email protected] C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
PID 1032 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\[email protected] C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
PID 1032 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\[email protected] C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
PID 1032 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\[email protected] C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
PID 1032 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\[email protected] C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
PID 2028 wrote to memory of 4980 N/A C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Users\Admin\AppData\Local\Temp\8CSO1S7HME9QSJ9OS.exe
PID 2028 wrote to memory of 4980 N/A C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Users\Admin\AppData\Local\Temp\8CSO1S7HME9QSJ9OS.exe
PID 2028 wrote to memory of 4980 N/A C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Users\Admin\AppData\Local\Temp\8CSO1S7HME9QSJ9OS.exe
PID 4980 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\8CSO1S7HME9QSJ9OS.exe C:\Windows\system32\cmd.exe
PID 4980 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\8CSO1S7HME9QSJ9OS.exe C:\Windows\system32\cmd.exe
PID 3320 wrote to memory of 3636 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mode.com
PID 3320 wrote to memory of 3636 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mode.com
PID 3320 wrote to memory of 1576 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 3320 wrote to memory of 1576 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 3320 wrote to memory of 5004 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 3320 wrote to memory of 5004 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 3320 wrote to memory of 5044 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 3320 wrote to memory of 5044 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 3320 wrote to memory of 4364 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 3320 wrote to memory of 4364 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 3320 wrote to memory of 4140 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 3320 wrote to memory of 4140 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 3320 wrote to memory of 3184 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 3320 wrote to memory of 3184 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 3320 wrote to memory of 2616 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 3320 wrote to memory of 2616 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 3320 wrote to memory of 5116 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 3320 wrote to memory of 5116 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 3320 wrote to memory of 2068 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\Installer.exe
PID 3320 wrote to memory of 2068 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\Installer.exe
PID 3320 wrote to memory of 2068 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\Installer.exe
PID 2068 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe C:\Windows\SysWOW64\cmd.exe
PID 2068 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe C:\Windows\SysWOW64\cmd.exe
PID 2068 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe C:\Windows\SysWOW64\cmd.exe
PID 5012 wrote to memory of 2200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5012 wrote to memory of 2200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5012 wrote to memory of 2200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2068 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe C:\Windows\SysWOW64\cmd.exe
PID 2068 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe C:\Windows\SysWOW64\cmd.exe
PID 2068 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe C:\Windows\SysWOW64\cmd.exe
PID 2068 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe C:\Windows\SysWOW64\cmd.exe
PID 2068 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe C:\Windows\SysWOW64\cmd.exe
PID 2068 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\main\Installer.exe C:\Windows\SysWOW64\cmd.exe
PID 5012 wrote to memory of 2928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\powercfg.exe
PID 5012 wrote to memory of 2928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\powercfg.exe
PID 5012 wrote to memory of 2928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\powercfg.exe
PID 1332 wrote to memory of 636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1332 wrote to memory of 636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1332 wrote to memory of 636 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3280 wrote to memory of 5080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3280 wrote to memory of 5080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3280 wrote to memory of 5080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 5012 wrote to memory of 2960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\powercfg.exe
PID 5012 wrote to memory of 2960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\powercfg.exe
PID 5012 wrote to memory of 2960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\powercfg.exe
PID 5012 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\powercfg.exe
PID 5012 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\powercfg.exe
PID 5012 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\powercfg.exe
PID 5012 wrote to memory of 1448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\powercfg.exe
PID 5012 wrote to memory of 1448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\powercfg.exe
PID 5012 wrote to memory of 1448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\powercfg.exe
PID 5012 wrote to memory of 1712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\powercfg.exe
PID 5012 wrote to memory of 1712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\powercfg.exe
PID 5012 wrote to memory of 1712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\powercfg.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\[email protected]

"C:\Users\Admin\AppData\Local\Temp\[email protected]"

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

C:\Users\Admin\AppData\Local\Temp\8CSO1S7HME9QSJ9OS.exe

"C:\Users\Admin\AppData\Local\Temp\8CSO1S7HME9QSJ9OS.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"

C:\Windows\system32\mode.com

mode 65,10

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e file.zip -p1404753551733818025492326517 -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_6.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_5.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_4.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_3.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_2.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_1.zip -oextracted

C:\Windows\system32\attrib.exe

attrib +H "Installer.exe"

C:\Users\Admin\AppData\Local\Temp\main\Installer.exe

"Installer.exe"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C powershell -EncodedCommand "PAAjAEsANgBXADMAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBMAG8ATwAwAE4ASgBKACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAFoAUgBmADUAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbgBWAEgAVQAjAD4A" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -EncodedCommand "PAAjAEsANgBXADMAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBMAG8ATwAwAE4ASgBKACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAFoAUgBmADUAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbgBWAEgAVQAjAD4A"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk3131" /TR "C:\ProgramData\Dllhost\dllhost.exe"

C:\Windows\SysWOW64\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\SysWOW64\schtasks.exe

SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"

C:\Windows\SysWOW64\schtasks.exe

SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk3131" /TR "C:\ProgramData\Dllhost\dllhost.exe"

C:\Windows\SysWOW64\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\SysWOW64\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\SysWOW64\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\SysWOW64\powercfg.exe

powercfg /hibernate off

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe38b746f8,0x7ffe38b74708,0x7ffe38b74718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5248 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4024 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=212 /prefetch:1

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x510 0x518

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5164 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2784 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7064 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2796 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7380 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7372 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7780 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8068 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7720 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8404 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7728 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7352 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7996 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1456 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2184,3134575422011046465,17816465061719523687,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6616 /prefetch:8

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 100.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 answerrsdo.shop udp
US 104.21.44.192:443 answerrsdo.shop tcp
US 8.8.8.8:53 192.44.21.104.in-addr.arpa udp
US 104.21.44.192:443 answerrsdo.shop tcp
US 104.21.44.192:443 answerrsdo.shop tcp
US 104.21.44.192:443 answerrsdo.shop tcp
US 104.21.44.192:443 answerrsdo.shop tcp
US 104.21.44.192:443 answerrsdo.shop tcp
US 104.21.44.192:443 answerrsdo.shop tcp
DE 147.45.47.81:80 147.45.47.81 tcp
US 8.8.8.8:53 81.47.45.147.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 235.4.20.104.in-addr.arpa udp
DE 147.45.47.81:80 147.45.47.81 tcp
DE 147.45.47.81:80 147.45.47.81 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
GB 184.28.176.96:443 www.bing.com tcp
GB 184.28.176.96:443 www.bing.com tcp
GB 184.28.176.96:443 www.bing.com tcp
GB 184.28.176.96:443 www.bing.com tcp
US 8.8.8.8:53 96.176.28.184.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 r.bing.com udp
GB 184.28.176.96:443 r.bing.com tcp
GB 184.28.176.96:443 r.bing.com tcp
GB 184.28.176.49:443 r.bing.com tcp
GB 184.28.176.49:443 r.bing.com tcp
US 8.8.8.8:53 49.176.28.184.in-addr.arpa udp
GB 184.28.176.96:443 r.bing.com tcp
GB 184.28.176.96:443 r.bing.com tcp
GB 184.28.176.96:443 r.bing.com tcp
GB 184.28.176.96:443 r.bing.com tcp
GB 184.28.176.96:443 r.bing.com tcp
US 8.8.8.8:53 aefd.nelreports.net udp
GB 173.222.211.41:443 aefd.nelreports.net tcp
GB 173.222.211.41:443 aefd.nelreports.net tcp
GB 173.222.211.41:443 aefd.nelreports.net udp
US 8.8.8.8:53 login.microsoftonline.com udp
US 8.8.8.8:53 services.bingapis.com udp
US 8.8.8.8:53 41.211.222.173.in-addr.arpa udp
US 13.107.5.80:443 services.bingapis.com tcp
NL 40.126.32.136:443 login.microsoftonline.com tcp
NL 40.126.32.136:443 login.microsoftonline.com tcp
US 8.8.8.8:53 80.5.107.13.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 172.64.154.167:443 www2.bing.com tcp
US 172.64.154.167:443 www2.bing.com tcp
US 172.64.154.167:443 www2.bing.com tcp
US 8.8.8.8:53 167.154.64.172.in-addr.arpa udp
US 172.64.154.167:443 www2.bing.com tcp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 99.58.20.217.in-addr.arpa udp
GB 172.217.169.46:443 www.youtube.com tcp
GB 172.217.169.46:443 www.youtube.com tcp
GB 172.217.169.46:443 www.youtube.com tcp
GB 172.217.169.46:443 www.youtube.com udp
US 8.8.8.8:53 i.ytimg.com udp
GB 216.58.204.86:443 i.ytimg.com tcp
GB 216.58.204.86:443 i.ytimg.com tcp
US 8.8.8.8:53 46.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 86.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.102.84:443 accounts.google.com tcp
NL 142.250.102.84:443 accounts.google.com udp
US 8.8.8.8:53 234.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.180.4:443 www.google.com tcp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 84.102.250.142.in-addr.arpa udp
US 8.8.8.8:53 4.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
GB 142.250.178.10:443 jnn-pa.googleapis.com tcp
US 8.8.8.8:53 play.google.com udp
GB 142.250.178.10:443 jnn-pa.googleapis.com tcp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
GB 142.250.200.46:443 play.google.com tcp
GB 142.250.178.10:443 jnn-pa.googleapis.com udp
GB 142.250.200.46:443 play.google.com udp
US 8.8.8.8:53 10.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 46.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 consent.youtube.com udp
GB 216.58.201.110:443 consent.youtube.com tcp
GB 216.58.204.86:443 i.ytimg.com udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 110.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 226.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 static.doubleclick.net udp
US 8.8.8.8:53 102.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 suggestqueries-clients6.youtube.com udp
GB 142.250.200.46:443 suggestqueries-clients6.youtube.com udp
US 8.8.8.8:53 youtube.com udp
GB 216.58.201.110:443 youtube.com tcp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
GB 142.250.180.4:443 www.google.com udp
US 8.8.8.8:53 yt3.ggpht.com udp
US 8.8.8.8:53 lh5.googleusercontent.com udp
GB 142.250.187.193:443 yt3.ggpht.com tcp
GB 142.250.187.193:443 yt3.ggpht.com tcp
GB 142.250.187.225:443 lh5.googleusercontent.com tcp
US 8.8.8.8:53 193.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 225.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 rr2---sn-aigzrnld.googlevideo.com udp
GB 74.125.97.71:443 rr2---sn-aigzrnld.googlevideo.com tcp
GB 74.125.97.71:443 rr2---sn-aigzrnld.googlevideo.com udp
GB 142.250.187.193:443 yt3.ggpht.com udp
US 8.8.8.8:53 71.97.125.74.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
GB 142.250.200.46:443 suggestqueries-clients6.youtube.com udp
US 8.8.8.8:53 tinyurl.com udp
US 104.18.111.161:443 tinyurl.com tcp
US 104.18.111.161:443 tinyurl.com tcp
US 8.8.8.8:53 apps.identrust.com udp
GB 2.18.190.80:80 apps.identrust.com tcp
US 8.8.8.8:53 www.mediafire.com udp
US 104.16.114.74:443 www.mediafire.com tcp
US 8.8.8.8:53 161.111.18.104.in-addr.arpa udp
US 8.8.8.8:53 80.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 static.mediafire.com udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 cdn.amplitude.com udp
GB 18.154.84.60:443 cdn.amplitude.com tcp
US 8.8.8.8:53 connect.facebook.net udp
US 8.8.8.8:53 translate.google.com udp
NL 157.240.247.8:443 connect.facebook.net tcp
GB 172.217.169.46:443 translate.google.com tcp
US 8.8.8.8:53 74.114.16.104.in-addr.arpa udp
US 8.8.8.8:53 72.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 60.84.154.18.in-addr.arpa udp
US 8.8.8.8:53 107.39.156.108.in-addr.arpa udp
US 8.8.8.8:53 8.247.240.157.in-addr.arpa udp
US 8.8.8.8:53 api.amplitude.com udp
US 52.26.54.77:443 api.amplitude.com tcp
US 8.8.8.8:53 translate.googleapis.com udp
US 8.8.8.8:53 region1.analytics.google.com udp
GB 142.250.178.10:443 translate.googleapis.com tcp
US 216.239.34.36:443 region1.analytics.google.com tcp
US 8.8.8.8:53 77.54.26.52.in-addr.arpa udp
US 8.8.8.8:53 36.34.239.216.in-addr.arpa udp
US 8.8.8.8:53 stats.g.doubleclick.net udp
US 8.8.8.8:53 www.google.co.uk udp
US 8.8.8.8:53 www.facebook.com udp
GB 74.125.71.156:443 stats.g.doubleclick.net tcp
GB 74.125.71.156:443 stats.g.doubleclick.net tcp
GB 172.217.16.227:443 www.google.co.uk tcp
NL 157.240.247.35:443 www.facebook.com tcp
US 8.8.8.8:53 translate-pa.googleapis.com udp
GB 142.250.180.4:443 www.google.com udp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 156.71.125.74.in-addr.arpa udp
US 8.8.8.8:53 35.247.240.157.in-addr.arpa udp
US 216.239.34.36:443 region1.analytics.google.com udp
GB 142.250.178.10:443 translate-pa.googleapis.com udp
US 8.8.8.8:53 the.gatekeeperconsent.com udp
US 104.21.42.32:443 the.gatekeeperconsent.com tcp
US 8.8.8.8:53 btloader.com udp
US 104.22.75.216:443 btloader.com tcp
US 8.8.8.8:53 www.ezojs.com udp
GB 172.217.169.46:443 translate.google.com udp
US 8.8.8.8:53 privacy.gatekeeperconsent.com udp
US 8.8.8.8:53 static.cloudflareinsights.com udp
US 172.67.170.144:443 www.ezojs.com tcp
US 172.67.199.186:443 privacy.gatekeeperconsent.com tcp
US 104.16.80.73:443 static.cloudflareinsights.com tcp
US 8.8.8.8:53 cdn.otnolatrnup.com udp
US 8.8.8.8:53 ad-delivery.net udp
US 8.8.8.8:53 api.btloader.com udp
US 104.16.53.110:443 cdn.otnolatrnup.com tcp
US 130.211.23.194:443 api.btloader.com tcp
US 104.26.2.70:443 ad-delivery.net tcp
US 104.26.2.70:443 ad-delivery.net tcp
US 8.8.8.8:53 g.ezoic.net udp
FR 15.188.219.54:443 g.ezoic.net tcp
US 8.8.8.8:53 32.42.21.104.in-addr.arpa udp
US 8.8.8.8:53 216.75.22.104.in-addr.arpa udp
US 8.8.8.8:53 144.170.67.172.in-addr.arpa udp
US 8.8.8.8:53 186.199.67.172.in-addr.arpa udp
US 8.8.8.8:53 110.53.16.104.in-addr.arpa udp
US 8.8.8.8:53 73.80.16.104.in-addr.arpa udp
US 8.8.8.8:53 70.2.26.104.in-addr.arpa udp
US 8.8.8.8:53 194.23.211.130.in-addr.arpa udp
US 8.8.8.8:53 go.ezodn.com udp
US 8.8.8.8:53 www.mediafiredls.com udp
US 130.211.23.194:443 api.btloader.com udp
US 8.8.8.8:53 otnolatrnup.com udp
US 172.67.142.121:443 go.ezodn.com tcp
US 172.67.142.121:443 go.ezodn.com tcp
US 172.67.142.121:443 go.ezodn.com tcp
US 172.67.73.78:443 www.mediafiredls.com tcp
US 8.8.8.8:53 g.ezodn.com udp
US 8.8.8.8:53 securepubads.g.doubleclick.net udp
GB 172.217.169.34:443 securepubads.g.doubleclick.net tcp
US 8.8.8.8:53 bshr.ezodn.com udp
US 8.8.8.8:53 bcp.crwdcntrl.net udp
US 8.8.8.8:53 tags.crwdcntrl.net udp
US 8.8.8.8:53 ad.crwdcntrl.net udp
US 172.67.142.121:443 bshr.ezodn.com tcp
IE 52.49.45.15:443 ad.crwdcntrl.net tcp
GB 18.245.143.83:443 tags.crwdcntrl.net tcp
IE 108.128.111.241:443 ad.crwdcntrl.net tcp
US 8.8.8.8:53 54.219.188.15.in-addr.arpa udp
US 8.8.8.8:53 121.142.67.172.in-addr.arpa udp
US 8.8.8.8:53 78.73.67.172.in-addr.arpa udp
US 8.8.8.8:53 34.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 83.143.245.18.in-addr.arpa udp
US 8.8.8.8:53 15.45.49.52.in-addr.arpa udp
US 8.8.8.8:53 241.111.128.108.in-addr.arpa udp
US 8.8.8.8:53 194.187.250.142.in-addr.arpa udp
GB 172.217.169.34:443 securepubads.g.doubleclick.net udp
US 8.8.8.8:53 fundingchoicesmessages.google.com udp
FR 15.188.219.54:443 g.ezoic.net tcp
US 8.8.8.8:53 id.a-mx.com udp
US 8.8.8.8:53 id5-sync.com udp
US 8.8.8.8:53 gum.criteo.com udp
US 8.8.8.8:53 ups.analytics.yahoo.com udp
US 8.8.8.8:53 id.hadron.ad.gt udp
US 8.8.8.8:53 api.rlcdn.com udp
US 8.8.8.8:53 static.criteo.net udp
US 8.8.8.8:53 oa.openxcdn.net udp
US 8.8.8.8:53 match.adsrvr.org udp
US 8.8.8.8:53 cdn.id5-sync.com udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 8.8.8.8:53 id.crwdcntrl.net udp
US 8.8.8.8:53 invstatic101.creativecdn.com udp
US 8.8.8.8:53 cdn.prod.uidapi.com udp
US 8.8.8.8:53 cdn-ima.33across.com udp
NL 79.127.227.46:443 id.a-mx.com tcp
US 172.64.152.89:443 cdn-ima.33across.com tcp
US 104.22.52.86:443 cdn.id5-sync.com tcp
US 104.22.4.69:443 id.hadron.ad.gt tcp
DE 3.71.149.231:443 ups.analytics.yahoo.com tcp
US 34.120.133.55:443 api.rlcdn.com tcp
DE 162.19.138.117:443 id5-sync.com tcp
US 151.101.65.229:443 cdn.jsdelivr.net tcp
NL 178.250.1.11:443 gum.criteo.com tcp
NL 178.250.1.3:443 static.criteo.net tcp
US 34.96.70.87:443 invstatic101.creativecdn.com tcp
US 34.102.146.192:443 oa.openxcdn.net tcp
US 35.71.131.137:443 match.adsrvr.org tcp
US 8.8.8.8:53 tpc.googlesyndication.com udp
GB 18.245.255.11:443 cdn.prod.uidapi.com tcp
GB 142.250.178.1:443 tpc.googlesyndication.com tcp
US 8.8.8.8:53 btlr.sharethrough.com udp
US 8.8.8.8:53 hbopenbid.pubmatic.com udp
US 8.8.8.8:53 ghb.adtelligent.com udp
US 8.8.8.8:53 htlb.casalemedia.com udp
US 8.8.8.8:53 hb.yellowblue.io udp
US 8.8.8.8:53 prebid.a-mo.net udp
US 8.8.8.8:53 onetag-sys.com udp
US 8.8.8.8:53 prebid.smilewanted.com udp
US 8.8.8.8:53 oajs.openx.net udp
NL 185.64.189.112:443 hbopenbid.pubmatic.com tcp
US 172.64.151.101:443 htlb.casalemedia.com tcp
US 8.8.8.8:53 lb.eu-1-id5-sync.com udp
DE 18.196.200.186:443 btlr.sharethrough.com tcp
DE 18.196.200.186:443 btlr.sharethrough.com tcp
DE 18.196.200.186:443 btlr.sharethrough.com tcp
DE 18.196.200.186:443 btlr.sharethrough.com tcp
DE 18.196.200.186:443 btlr.sharethrough.com tcp
US 8.8.8.8:53 dnacdn.net udp
US 104.22.31.209:443 prebid.smilewanted.com tcp
US 104.22.31.209:443 prebid.smilewanted.com tcp
US 104.22.31.209:443 prebid.smilewanted.com tcp
US 104.22.31.209:443 prebid.smilewanted.com tcp
US 104.22.31.209:443 prebid.smilewanted.com tcp
GB 142.250.178.1:443 tpc.googlesyndication.com udp
GB 108.138.217.110:443 hb.yellowblue.io tcp
US 34.120.135.53:443 oajs.openx.net tcp
NL 147.75.84.158:443 prebid.a-mo.net tcp
DE 51.38.120.206:443 onetag-sys.com tcp
DE 162.19.138.120:443 lb.eu-1-id5-sync.com tcp
NL 178.250.1.11:443 dnacdn.net tcp
DE 142.132.249.188:443 ghb.adtelligent.com tcp
DE 51.38.120.206:443 onetag-sys.com udp
US 8.8.8.8:53 ghb1.adtelligent.com udp
US 23.227.151.242:443 ghb1.adtelligent.com tcp
US 34.120.135.53:443 oajs.openx.net udp
US 8.8.8.8:53 46.227.127.79.in-addr.arpa udp
US 8.8.8.8:53 229.65.101.151.in-addr.arpa udp
US 8.8.8.8:53 89.152.64.172.in-addr.arpa udp
US 8.8.8.8:53 86.52.22.104.in-addr.arpa udp
US 8.8.8.8:53 69.4.22.104.in-addr.arpa udp
US 8.8.8.8:53 55.133.120.34.in-addr.arpa udp
US 8.8.8.8:53 87.70.96.34.in-addr.arpa udp
US 8.8.8.8:53 192.146.102.34.in-addr.arpa udp
US 8.8.8.8:53 137.131.71.35.in-addr.arpa udp
US 8.8.8.8:53 11.1.250.178.in-addr.arpa udp
US 8.8.8.8:53 3.1.250.178.in-addr.arpa udp
US 8.8.8.8:53 231.149.71.3.in-addr.arpa udp
US 8.8.8.8:53 117.138.19.162.in-addr.arpa udp
US 8.8.8.8:53 11.255.245.18.in-addr.arpa udp
US 8.8.8.8:53 1.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 226.21.18.104.in-addr.arpa udp
US 8.8.8.8:53 101.151.64.172.in-addr.arpa udp
US 8.8.8.8:53 209.31.22.104.in-addr.arpa udp
US 8.8.8.8:53 112.189.64.185.in-addr.arpa udp
US 8.8.8.8:53 186.200.196.18.in-addr.arpa udp
US 8.8.8.8:53 110.217.138.108.in-addr.arpa udp
US 8.8.8.8:53 53.135.120.34.in-addr.arpa udp
US 8.8.8.8:53 158.84.75.147.in-addr.arpa udp
US 8.8.8.8:53 206.120.38.51.in-addr.arpa udp
US 8.8.8.8:53 120.138.19.162.in-addr.arpa udp
US 8.8.8.8:53 188.249.132.142.in-addr.arpa udp
US 8.8.8.8:53 31d8b704ed17cae1825c640b5cc86ae6.safeframe.googlesyndication.com udp
GB 142.250.180.1:443 31d8b704ed17cae1825c640b5cc86ae6.safeframe.googlesyndication.com tcp
US 8.8.8.8:53 google-bidout-d.openx.net udp
US 35.244.159.8:443 google-bidout-d.openx.net tcp
US 8.8.8.8:53 s0.2mdn.net udp
GB 142.250.187.230:443 s0.2mdn.net tcp
US 8.8.8.8:53 download2388.mediafire.com udp
US 199.91.155.129:443 download2388.mediafire.com tcp
US 199.91.155.129:443 download2388.mediafire.com tcp
US 8.8.8.8:53 bucket.cdnwebcloud.com udp
GB 142.250.187.230:443 s0.2mdn.net udp
US 8.8.8.8:53 googleads4.g.doubleclick.net udp
GB 142.250.200.2:443 googleads4.g.doubleclick.net tcp
US 8.8.8.8:53 242.151.227.23.in-addr.arpa udp
US 8.8.8.8:53 1.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 8.159.244.35.in-addr.arpa udp
US 8.8.8.8:53 230.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 cdn.ampproject.org udp
GB 13.224.245.70:443 bucket.cdnwebcloud.com tcp
GB 216.58.201.97:443 cdn.ampproject.org tcp
GB 216.58.201.97:443 cdn.ampproject.org tcp
GB 216.58.201.97:443 cdn.ampproject.org tcp
GB 216.58.201.97:443 cdn.ampproject.org tcp
GB 216.58.201.97:443 cdn.ampproject.org tcp
US 8.8.8.8:53 neural40.cdnwebcloud.com udp
US 8.8.8.8:53 sys.ctrackapp.com udp
IE 54.77.129.199:443 neural40.cdnwebcloud.com tcp
IE 54.77.129.199:443 neural40.cdnwebcloud.com tcp
GB 142.250.200.2:443 googleads4.g.doubleclick.net udp
GB 142.250.178.1:443 tpc.googlesyndication.com udp
GB 108.138.233.10:443 sys.ctrackapp.com tcp
GB 108.138.233.10:443 sys.ctrackapp.com tcp
US 8.8.8.8:53 track.donecperficiam.com udp
GB 18.165.227.105:443 track.donecperficiam.com tcp
GB 18.165.227.105:443 track.donecperficiam.com tcp
US 8.8.8.8:53 129.155.91.199.in-addr.arpa udp
US 8.8.8.8:53 70.245.224.13.in-addr.arpa udp
US 8.8.8.8:53 2.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 97.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 199.129.77.54.in-addr.arpa udp
US 8.8.8.8:53 10.233.138.108.in-addr.arpa udp
US 8.8.8.8:53 go.etoro.com udp
NL 104.109.249.151:443 go.etoro.com tcp
NL 104.109.249.151:443 go.etoro.com tcp
US 8.8.8.8:53 etoro-cdn.etorostatic.com udp
US 8.8.8.8:53 marketing.etorostatic.com udp
NL 23.51.74.151:443 marketing.etorostatic.com tcp
NL 23.51.74.151:443 marketing.etorostatic.com tcp
NL 23.51.74.151:443 marketing.etorostatic.com tcp
NL 23.51.74.151:443 marketing.etorostatic.com tcp
NL 23.51.74.151:443 marketing.etorostatic.com tcp
NL 23.51.74.151:443 marketing.etorostatic.com tcp
NL 23.51.74.151:443 marketing.etorostatic.com tcp
NL 23.51.74.151:443 marketing.etorostatic.com tcp
NL 23.51.74.151:443 marketing.etorostatic.com tcp
NL 23.51.74.151:443 marketing.etorostatic.com tcp
US 8.8.8.8:53 105.227.165.18.in-addr.arpa udp
US 8.8.8.8:53 151.249.109.104.in-addr.arpa udp
US 8.8.8.8:53 151.74.51.23.in-addr.arpa udp
US 8.8.8.8:53 cdn.cookielaw.org udp
US 104.19.178.52:443 cdn.cookielaw.org tcp
US 8.8.8.8:53 bat.bing.com udp
US 8.8.8.8:53 static.ads-twitter.com udp
US 8.8.8.8:53 amplify.outbrain.com udp
US 8.8.8.8:53 static.hotjar.com udp
US 8.8.8.8:53 c0.adalyser.com udp
US 8.8.8.8:53 cdn.taboola.com udp
US 104.19.178.52:443 cdn.cookielaw.org tcp
GB 2.18.109.60:443 amplify.outbrain.com tcp
GB 199.232.56.157:443 static.ads-twitter.com tcp
IE 34.249.128.149:443 c0.adalyser.com tcp
GB 13.224.245.27:443 static.hotjar.com tcp
US 204.79.197.237:443 bat.bing.com tcp
US 151.101.1.44:443 cdn.taboola.com tcp
GB 74.125.71.156:443 stats.g.doubleclick.net udp
GB 172.217.16.227:443 www.google.co.uk udp
US 8.8.8.8:53 9944765.fls.doubleclick.net udp
GB 172.217.16.230:443 9944765.fls.doubleclick.net tcp
US 8.8.8.8:53 geolocation.onetrust.com udp
US 172.64.155.119:443 geolocation.onetrust.com tcp
US 8.8.8.8:53 t.co udp
US 8.8.8.8:53 tr.outbrain.com udp
PL 93.184.221.165:443 t.co tcp
US 8.8.8.8:53 analytics.twitter.com udp
US 8.8.8.8:53 wave.outbrain.com udp
US 8.8.8.8:53 52.178.19.104.in-addr.arpa udp
US 8.8.8.8:53 60.109.18.2.in-addr.arpa udp
US 8.8.8.8:53 157.56.232.199.in-addr.arpa udp
US 8.8.8.8:53 27.245.224.13.in-addr.arpa udp
US 50.31.142.255:443 tr.outbrain.com tcp
US 50.31.142.255:443 tr.outbrain.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 44.1.101.151.in-addr.arpa udp
US 8.8.8.8:53 149.128.249.34.in-addr.arpa udp
US 8.8.8.8:53 230.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 119.155.64.172.in-addr.arpa udp
GB 2.18.109.60:443 wave.outbrain.com tcp
GB 2.18.109.60:443 wave.outbrain.com tcp
GB 2.18.109.60:443 wave.outbrain.com tcp
GB 2.18.109.60:443 wave.outbrain.com tcp
GB 2.18.109.60:443 wave.outbrain.com tcp
GB 2.18.109.60:443 wave.outbrain.com tcp
GB 172.217.16.230:443 9944765.fls.doubleclick.net udp
GB 142.250.178.10:443 translate-pa.googleapis.com udp
US 104.244.42.3:443 analytics.twitter.com tcp
US 8.8.8.8:53 trc.taboola.com udp
US 8.8.8.8:53 script.hotjar.com udp
US 8.8.8.8:53 ag.gbc.criteo.com udp
US 8.8.8.8:53 gem.gbc.criteo.com udp
GB 18.245.253.79:443 script.hotjar.com tcp
FR 185.235.86.179:443 gem.gbc.criteo.com tcp
FR 185.235.86.188:443 gem.gbc.criteo.com tcp
US 8.8.8.8:53 165.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 255.142.31.50.in-addr.arpa udp
US 8.8.8.8:53 3.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 79.253.245.18.in-addr.arpa udp
US 8.8.8.8:53 179.86.235.185.in-addr.arpa udp
US 8.8.8.8:53 188.86.235.185.in-addr.arpa udp
US 8.8.8.8:53 226.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 dc.services.visualstudio.com udp
NL 20.50.88.234:443 dc.services.visualstudio.com tcp
US 8.8.8.8:53 privacyportal-de.onetrust.com udp
US 104.18.32.137:443 privacyportal-de.onetrust.com tcp
US 8.8.8.8:53 234.88.50.20.in-addr.arpa udp
US 8.8.8.8:53 137.32.18.104.in-addr.arpa udp
US 8.8.8.8:53 ade.googlesyndication.com udp
GB 142.250.200.34:443 ade.googlesyndication.com tcp
US 8.8.8.8:53 34.200.250.142.in-addr.arpa udp
GB 142.250.200.34:443 ade.googlesyndication.com udp
DE 18.196.200.186:443 btlr.sharethrough.com tcp
US 8.8.8.8:53 ghb2.adtelligent.com udp
US 23.227.151.194:443 ghb2.adtelligent.com tcp
DE 142.132.249.188:443 ghb2.adtelligent.com tcp
GB 172.217.169.34:443 securepubads.g.doubleclick.net udp
US 8.8.8.8:53 194.151.227.23.in-addr.arpa udp
GB 142.250.178.1:443 tpc.googlesyndication.com udp
US 216.239.34.36:443 region1.analytics.google.com udp
GB 172.217.169.46:443 fundingchoicesmessages.google.com udp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 8.8.8.8:53 1.80.190.35.in-addr.arpa udp
GB 142.250.200.34:443 ade.googlesyndication.com udp
US 8.8.8.8:53 btlr.sharethrough.com udp
US 23.227.151.242:443 ghb2.adtelligent.com tcp
DE 18.197.202.95:443 btlr.sharethrough.com tcp
US 23.227.151.194:443 ghb2.adtelligent.com tcp
US 8.8.8.8:53 securepubads.g.doubleclick.net udp
GB 172.217.169.34:443 securepubads.g.doubleclick.net udp
GB 172.217.16.227:443 www.google.co.uk udp
GB 142.250.178.1:443 tpc.googlesyndication.com udp
GB 142.250.180.4:443 www.google.com udp
US 8.8.8.8:53 95.202.197.18.in-addr.arpa udp

Files

memory/2028-4-0x0000000000780000-0x00000000007D7000-memory.dmp

memory/2028-7-0x0000000000780000-0x00000000007D7000-memory.dmp

memory/1032-5-0x00007FF77FB30000-0x00007FF780BDE000-memory.dmp

memory/2028-8-0x0000000000780000-0x00000000007D7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8CSO1S7HME9QSJ9OS.exe

MD5 b2e6a3d0bf3320b759c464ae6fa5b735
SHA1 cc9f5de7742b9c11f7c0c0e3f9d39b0c16b38cc1
SHA256 771b76ba28496c56d1d9c0fe67fdf7688a2f1b12a9eb428050551338945337a3
SHA512 bf2f09aebf6d4b07ec06ce37617361e149b26d7fc2f5c0715a5e479747eb5b1f8fc615c90d1e4d8d751e05dd566819facfef8a00cfb7acb61ec588b0c23b022a

memory/2028-13-0x0000000000780000-0x00000000007D7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\main\main.bat

MD5 893874465a8d9f68f0684fd61e9f1d3c
SHA1 866a58255ebab05d4ee2f2ed8383a6555ac1df03
SHA256 e0855b82ec99b14bdfa38dacf90dadb2071e0d413c6559c752e0b2c6e8cd08c0
SHA512 1cc878a3236a5ce4f3a89fae580b4d16a7842fd03dfe0a2c7d1d5da5be822528ea3826f659a70de727c9307fb15997f56b7204582043dc7efcc6c818f7aa2bd7

C:\Users\Admin\AppData\Local\Temp\main\file.bin

MD5 716459a6ceac7d310d4227ea3e9ddb59
SHA1 fa27addf18c197bf5fc054bfb5ae57de1caf3382
SHA256 ba5270891d3eef832fe34f9d67fbbb30ceb3873552ea859139914a6a783b0aa1
SHA512 3857cc099edd99f1c20d4c4456ec4577478afcbdb6073852c6df10775a4e6de0316ab68c6dacb7212d27f49057312ba1aeb0c35e695d84832f3e9f8d61f7d8c1

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

C:\Users\Admin\AppData\Local\Temp\main\7z.dll

MD5 72491c7b87a7c2dd350b727444f13bb4
SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_6.zip

MD5 a62944686498212b290eae637729a151
SHA1 2053660850d3f578f7b31e5ced16069d6f9c4ee0
SHA256 0bb07f0caab7e5539e7efeca5bee359d9f6b49237e0c908981d9168680fe2b3e
SHA512 ae6abd482552445cbf8c308948519227b0d1a82c1b3adb4800f8c9ac32c519c8d0aee8f3b4caada26d1976b63b032aad72d95e574adf205b947dada23a5b8ad3

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip

MD5 870a5535c79edcf782551514f48d89ab
SHA1 333d814d65753cdc4c4e8fb587c09af6960110d1
SHA256 814a92267e0d8867932afd625f2f8e55b04b88b2cfc31e91b6e45e473f1b057d
SHA512 f8743ca2f1ef2433b41adc41adf6a5836c1901bda70d5d76301cb06b471796b360544efa591c49b3a7d09eee12cef7ba20e79571f50d891d4729598210772b06

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip

MD5 6f7f4f7ed739e3ac5eee8d0876ff76d4
SHA1 9a65d52885624dc47f342b5a9875d7720540c755
SHA256 b61a321a8a1f4ca1d8c52a1ad0464ac5882073ac8da7c5585f04ce2330b78acc
SHA512 35cad901c3f77c58803372a2f230701469d99fb9d8b16d82b59416a62d215614ab044dcae123473cc5d9a4a09e23f2edaac53ef82bbd5b3556b9b187cff50021

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip

MD5 4a5f569872c858ede1c0c67500cfdd6d
SHA1 cdcac69d89b45a7903198467c2d2d32126c31661
SHA256 88b2d9a82c911ad61f3570aa31b360ae1649b117f6495459698d724f0c9638dc
SHA512 d9c6776829def517a253e9c60d0316dbc03092f850383305089dc1110b1abd19668ae47dca8188e96c6f12b66a8e5b5a783901f2115cadd5c1accf019c3bdb40

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip

MD5 a915fd2a4e2750ee9003e628294bf284
SHA1 f9adc1e65fc3d2cf39b2c5a89030f3225e21616d
SHA256 5e2e339dbee22d6c05d652646071bc81ad96a6422eb311453ca3905e7dfea285
SHA512 044d5370ec915fb488cf77c1b181f5a4f89833028266f922766b782ff445f61ab85b92980d6939d0e252a368eb846def27bcdea7f029999d6854a90c793b3a5f

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip

MD5 18f4fe969c4ba0517b403e28f7ad2b72
SHA1 9df09751ee1246db2ed6b6ed6fec87fb0891e077
SHA256 06d1004f28a87b42b1d7ac23ff2e4b43d736295abc2e84740504386f40a041f4
SHA512 9847b8e2b849b09a76e22ab0d76a1a7d29079676dbdf4277b712709af0ac6a6f0e3a473f144f0a8e247861111357027a758b95e4d096d24cec160192c5da32a4

C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT

MD5 6dd7f70cddc4310e047032d70550f72c
SHA1 e93c0d3a03dbe51eba117ea8e10bd0e8b6b27562
SHA256 e92508881b6d69c45897a58b4c7dc58ee68e438979604d7f7b6f6ff71f15444d
SHA512 1e6398a9739f57a3cf754a6e73f92cf67fe117440a6afe698767c578f396a4b8dab93b5568d02fa23fbcd3565b9017254625d58b1ea7a375c8537f2bab90f42c

C:\Users\Admin\AppData\Local\Temp\main\extracted\Installer.exe

MD5 4265bf9f9535ebb4e1830e2a50589285
SHA1 ddc45fe277a3b39179dd9e39e17d71b50a184607
SHA256 c07698b4c960b60d8a3c661887d6cc1f7fe74e31a24d4c2ae95d52d1c92ce403
SHA512 3a7a0a8a6b82d5e1b6c06c12250eb9b347ed024811467d6da5123f6d07a79836a4e414758cb5c708d0c96cc4a020f8743b2c1e4fa5f5ed448fc087772ab592be

memory/2068-75-0x0000000000EB0000-0x0000000000EBC000-memory.dmp

memory/2068-76-0x0000000005F20000-0x00000000064C4000-memory.dmp

memory/2068-77-0x0000000005890000-0x0000000005922000-memory.dmp

memory/2068-78-0x0000000005A60000-0x0000000005A6A000-memory.dmp

memory/2068-79-0x0000000005B20000-0x0000000005B86000-memory.dmp

memory/2200-80-0x0000000002500000-0x0000000002536000-memory.dmp

memory/2200-81-0x0000000004EC0000-0x00000000054E8000-memory.dmp

memory/2200-82-0x0000000004E20000-0x0000000004E42000-memory.dmp

memory/2200-83-0x00000000055F0000-0x0000000005656000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l15ncs2o.u1h.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2200-93-0x0000000005790000-0x0000000005AE4000-memory.dmp

memory/2200-94-0x0000000005DC0000-0x0000000005DDE000-memory.dmp

memory/2200-95-0x0000000005E10000-0x0000000005E5C000-memory.dmp

memory/2200-96-0x00000000063B0000-0x00000000063E2000-memory.dmp

memory/2200-97-0x0000000070480000-0x00000000704CC000-memory.dmp

memory/2200-107-0x0000000006FA0000-0x0000000006FBE000-memory.dmp

memory/2200-108-0x0000000006FD0000-0x0000000007073000-memory.dmp

memory/2200-109-0x0000000007750000-0x0000000007DCA000-memory.dmp

memory/2200-110-0x0000000007100000-0x000000000711A000-memory.dmp

memory/2200-111-0x0000000007170000-0x000000000717A000-memory.dmp

memory/2200-112-0x0000000007390000-0x0000000007426000-memory.dmp

memory/2200-113-0x0000000007300000-0x0000000007311000-memory.dmp

memory/2200-114-0x0000000007340000-0x000000000734E000-memory.dmp

memory/2200-115-0x0000000007350000-0x0000000007364000-memory.dmp

memory/2200-116-0x0000000007430000-0x000000000744A000-memory.dmp

memory/2200-117-0x0000000007380000-0x0000000007388000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 9abb787f6c5a61faf4408f694e89b50e
SHA1 914247144868a2ff909207305255ab9bbca33d7e
SHA256 ecfd876b653319de412bf6be83bd824dda753b4d9090007231a335819d29ea07
SHA512 0f8139c45a7efab6de03fd9ebfe152e183ff155f20b03d4fac4a52cbbf8a3779302fed56facc9c7678a2dcf4f1ee89a26efd5bada485214edd9bf6b5cd238a55

\??\pipe\LOCAL\crashpad_3784_VKCLUZNEAMWKMVNY

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 fe13485014a72e07072875088b143a2b
SHA1 8d1c9094d8140b40220a75eeb3077b41b116f6f8
SHA256 16d68c1df9745f03384a9c413dd9016f8693894b3de92fe296e654d00aa02b16
SHA512 a210496c20baf1a6b1d6537a415f826950a0172b8a988b447c9d0857854f57900a608b7c1eec36e0f2df55b21629602a54ae631a0d3935c82634a817c9dc4707

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 df9b16f254ab4b40b9207898a97c8116
SHA1 2f42588dcc177694fec404cc82497ce79b893e89
SHA256 3b8fb7e5d43b5d51e1d36afe8e66e8155c2406c208283dd6574d252b02ffc553
SHA512 6e35620d8db5675734fb0f9d539464993057c07266363e66306afceb741728e3ec5b321dad849444b2e67f52ea41ab24e6955bd6b1e587e8319bdc91ee65d4e5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 07f7da7c6ef2bcc28611540a815ad822
SHA1 40e824219cb14ba284373d2d6665f26f27b2d663
SHA256 b6f453af976344af3c51b51e5601705709746f63175d3384b29d8d35e79fef3a
SHA512 2085c83edca96a17f09a276452ef2c64e708f712c6dd9e40cbdfb136d2d1c69bd538665716ac2723fce7ce369220c181ec1e85a086b4bc00d93f59047a3b67aa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c0b68a5bc4c6e3be20c39e05227d1615
SHA1 1a366bb9f6f37fe9456dd9bd5b8bbbad9d0896eb
SHA256 4706df0578950dcda2c6517a065a28675e3e6076f8250296437d82a69420b68b
SHA512 bcebbdf87162c2978a85bbc0215f9867653bd2b55f961f04c0e5d47049002982dbbc773ba3d1af90b45c3dfac7730ca653cea06c20147ef44302a93c3aebbc5b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 f3408c434494615539f7c74726cead49
SHA1 b5b75ee717baf1db6e8755984b5c8868aa8fa3ea
SHA256 f4b71f63fe9fc6e4ceb3633e35264b1568dd3f79c0d90e7ac4a07220acad9b72
SHA512 e7ea362b0a86b179747b16b80a96ad4a9f461378e04588c9b5da670bf08e3dcbf25acd0e2f64a5f34b7758f6213fa344442e3b3d03dbb106813278b41c1724a8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 82031f8d55219d30c1038643abb903da
SHA1 c8e8ab35a24ca238c0f3dd118a836134158d3f54
SHA256 c93eb234d6406ee48ef59917bcb34c9d570dbc8f1671cc3890decdb0f10ab34b
SHA512 efb9f69980dc4b6826585ff1a161cc099fd651d432d471f43e6cdf41114bd46d83ed3362061f026408d147c21ca66867b995bf38eb837dab3296bad192b968be

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 665dfa8390bba9d29401426904880780
SHA1 cb5dac22cc87c4c55ccd079694ec12475f2700d4
SHA256 57ecbbdb137dacb97b308f4b8f4c512ec406fc50de2028141f55faaa0ed59802
SHA512 e94bbb97ab04cbd3a33f4d90d84a7407b5b685061b6fcab226e607b52d1984211a411e33673483e419af42c2ee03b76b7e1ee21a68e1bfebae03bb35a7ebd726

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5b8b1a2b-6e34-4866-a98a-aa9a1a8e58d9\index-dir\the-real-index~RFe58a0b0.TMP

MD5 56576b220e1ee4675b4c6028402eb574
SHA1 d191ccd8c78c6fc34e6bf721abcc7aaa643e17e0
SHA256 647d05da594f9105bbe847bcd7731676e15f4ab4611bb2fc472d42cbe52de1b5
SHA512 61981cfb1f34d0ddb4b895eaddbe03faa9870074eac7c8a77a5010827fb08e7ce8624b98162e433613dc8f29d8a1a7d1cc2ba8c0e4727139822c3491d830c88a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5b8b1a2b-6e34-4866-a98a-aa9a1a8e58d9\index-dir\the-real-index

MD5 d2b6dc8a560daa7d9685ad9a27f45323
SHA1 5d893e0b99e1223674b3e42f77ffb8ded1510498
SHA256 d4ea57fdf3b0dc4a0c1493d178d35180a49f13dd8d777a5a26d57bba5f93482e
SHA512 70622e76bc54a16da8cf11f6acda7f1d9cea5c386d1e99a992351ce4c08168a069140e4ed8560e7e81e162c0bfc4823dbc089b7c17325b8f9a3a5a41abe7d472

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 2892eee3e20e19a9ba77be6913508a54
SHA1 7c4ef82faa28393c739c517d706ac6919a8ffc49
SHA256 4f110831bb434c728a6895190323d159df6d531be8c4bb7109864eeb7c989ff2
SHA512 b13a336db33299ab3405e13811e3ed9e5a18542e5d835f2b7130a6ff4c22f74272002fc43e7d9f94ac3aa6a4d53518f87f25d90c29e0d286b6470667ea9336ae

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 632aa74645f7707fb340062203027d96
SHA1 17b699a1e9ccc10bb6969368a00ff399e1de2d8f
SHA256 b22a84196ec24c80276de6cf9f3c3e838d7f68d20dc33ae8f4942714b5d486b3
SHA512 176d7898573b7726e351d465e0fdbc6f936c5e7d05538764ab559973c09709fde57cf9c00c7a1f32789c6e11231788f11dba42cbe480b49ffd70680905320f43

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 dc354ba9298f5c38b80d6fda2c4ef108
SHA1 78604c268ed868be54167d50dd96b8d8e795df7b
SHA256 2e578df6558e1e6edcf5be625815fc8e4a6bd4d477e8bc95fb413c357cfb7886
SHA512 134f8e0fc174df685cd68104528f9b762fb3aa8a11ebf030fa7c517e32c776bd20ac4c3fe3005dda2f0a2082885898380cc84757b597576570779fb1e894f04a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\90193b9a-1b26-40f7-96d5-2331b939329e\index

MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 c5581852522152427791cf2f880902cc
SHA1 a5dcbd99e9224f7ff55b494125c526c5a927a0d4
SHA256 8bd958b61823dd9de93c229cd2aa0a96edf61a5b8c9183e4d5731b77fd5b6d2d
SHA512 75155d51a047c1c0faa2aac3d81de6998ffbd07db720aa18eee37b44a3a75ef92883727139d3a2a499cdac88ecc2a371d081129027e316cda5018b7aa9328e09

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 b013ae842cebd392a8f0430596010fb2
SHA1 0ec69525b18ad63d80cde70baa9538f57d8ffab9
SHA256 0acbc88b4f1a6dc0955280ac25dd66407348659965b2aeed80630fbd1838cf79
SHA512 03f9403576e5c4340d6f0aa32b9b7d650373fd034a434440fa8a3d3c53e4698e7b2f72676685910bd01232acc60b3392d60b4713464f608a26af09011637f3aa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

MD5 e09df5a23acd241007ec35851474a7f9
SHA1 9802085247211e3c82c5e6fefc003e7c1f21227d
SHA256 846921a45a6d2203548059f9b22a5a5513105e43098da955bf402e681020bf56
SHA512 765b7cfa03aa7d750a18ad63c072c069329f4a7f7a594051c01700934497533ad07dc503c8b3892d5ac97f14b8b85a6f4868c7e5a1a4d2e40a7ae4f7514d1009

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

MD5 c0637a08f2ba40c56260782d2bb3ace4
SHA1 a2bf4298414a764ff1342b3f48f45b4dc1669a96
SHA256 d6ab12688ec8cfe7f9235b18c7d7a4730d86278ba1efae0d715c0d054465781e
SHA512 736d1ac8987102028baef59d43ceb2fde71b3aab2f8f2d8d306846a457e2ac224908968ff7bfe34bb05beb7998223d393244cf5da84f9d64f8b71c9f0b2ca6e2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

MD5 af5bf693b92c0d2c8441b3a6640c4ad8
SHA1 12ed4ac73239e542ab8d7fa191dddc779808e202
SHA256 b9f2c3f2ec75955d96309f759eaf9fb6bf576c238377491dbb92de1768a26012
SHA512 c2ef099832fc5e8f1e67acbd550b0590c0fb5c291761280a2e74e6a97763906b9c0c1a2295f285462ba3a0ed7cd5658f296e5f0f9c5d11a97ba210f352f8a438

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

MD5 cd3756106418d9e83a2baff9904ba221
SHA1 4c2ed1c1ebe119027db0fbaf7a64b408f1779b4a
SHA256 57ec0895e1bcaf08c769e2d6872f3f3657972f87fac081063445213dae4541ee
SHA512 5bf43ccaaf99505f7e8ecf2eda18efe260125accbc12f655601e2acabd822513e153f4b81cbf03a65d13572f11e9f13fd471006a0ce8f2665e8a594ff2d769dd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

MD5 127b7a9f7009939d0ae5dd1a48386985
SHA1 f9e981f2fbc6df7e304803153fb6fe40f0dcb6ac
SHA256 9d8e3219c036313e8b27ecb7b91befc49de6a32352a5349656945a7525a89962
SHA512 b1a442d78f6adc7a67f8ee299d46817309798ff2a38a66af2ff03eaa276b3a7967fde34e801dc8488ed75b3110fd01b3a9763f792ce75e21fae190d4779c1287

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 72a72a1a40fc43a573a61fb93696fb6e
SHA1 d8a6c762dd4c5299fe99c026980f21165c1b2953
SHA256 23185c5a5c56fff38b564833fb61f79394a194b9e85c2566b26c8632db83d48d
SHA512 72df4350e1458418329e18d0141abd9d2170ad784d1eec219e87141bf1006d171e7c07873059b4d612b7a43feb511a685dfc33e396c8dc0e9a7200365a9424e8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58ab20.TMP

MD5 9df69d6ae9954a64226a91ad4fa5b668
SHA1 ff7438148a3c4a198c283463928e031236c39d13
SHA256 b83255eace3501fa1b8541f1ddc4d9e14908c2b28cdbd1cd8cc998e94a68b062
SHA512 92a7573fd239654c199ea1d597629848ed7359af98a9e6d4a9ec538b556ff40f0b0d6f70d80ded7a21b56d52c6aebedd37bc2d92fd21a1e5056f45a8c22cfab3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 0d6f0ad1c15dd8bd04789bc523b9b4df
SHA1 5dedde0cab98d62a6274868778c2c6156a79d6ae
SHA256 0c3199d9e884beef653ed47392e6ca55864ea0b759f3f5e030cf945779c4d239
SHA512 0f38127b020fd443c7ff1cb1d9a35c963e1d61d3be2cb3db971151c05fdae71bac618d11b2f2cbb58798c11df1f0cd175c3b0ac416eeaca4b12a80d47c6be5d8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b759842c-123f-4026-8346-d3ed8bef6af4.tmp

MD5 0d2cdc820346eaccf81d034623630e78
SHA1 cea44837af18fc528db1901b9af8e0df8c7d6200
SHA256 0eced658f8445ec03d8071d942e531320df71964d70ebeb4bdf1793042b78daa
SHA512 e53fd1d827f62ffed5dd032038c07e4ec2d2f64c88dfa1a688397f4fefd8d25eff0ee118c711d939cb2a5fae1ba227215b9f373d3c13f08d4424db755d1f39a7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f279.TMP

MD5 6d91d2f267a68eb2cd18ba8d121d649f
SHA1 da2a38eac92b079d78b28b531e6a142b65cd7da2
SHA256 40a088ca38b898222f0b949e2cf903b1cf89d24fc2ebe697dc4d19f9960785d5
SHA512 f76bed625a53024d556c917e19e663605e64b214ebbe916278744ccf35556be8ce244274aeeea5173aaa7bc144c595ef82131d8237cb7b1fa4d1ab75a21a4ea0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 eeb30f4e9c4b71fb629ddff57ad3b65b
SHA1 1507333a6f0534d5a467a8db45d7f4b22335e044
SHA256 7713231cfa57a7455dfb6791ea711aced1742060e376f920fedb7bef7298a8e4
SHA512 f881580e9c88ccf25831838298569d0b56a3ac29ee3b2c537a1f9883f6a90164390c7a5a8fbf3575abefcab556e4a3253aab762556b539d48e78efdcc5310c2f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a9bffda6-ad82-4d2b-bed6-efb60cd90607\index-dir\the-real-index~RFe58f901.TMP

MD5 fee099812a0475a8999e3c4417eff7b5
SHA1 42b631d3753e2004dfb536617b11d29da93e6e53
SHA256 b8e056f0b716edfc74ef4403d106cb011b725a5826acd7c0dcb00bb9379c5de8
SHA512 568aed7f8f587f4b6ca9e68aaeff326bd0adfdf5af020153821c9aa995324e7f2a71b08ab9a68fa5919e7ff6106de5b76383a5a6e4be3e62e8276a59919298f9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a9bffda6-ad82-4d2b-bed6-efb60cd90607\index-dir\the-real-index

MD5 986a9ed07c96963b84bd3587bf77471c
SHA1 d452ea6fa55e600838d37360db558903976089ba
SHA256 228e10d3a790b848abe71385393990a258efd6400d0bb20debe31838ae521ab2
SHA512 3b46fed3a0fde272003dfe642ab1f0bf8c6dc42ade65d36220bd253c001346b4c3e56efaaf04d6101d78f09f69c648ae80029a9927b25acacf3be98c6242a7cd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

MD5 c81ecd0806667682b70013669e13cb3e
SHA1 b035554be89ffc3a6d4b61658f4d8cffb1cdd4bf
SHA256 1663586f372335976dce40ac11492c66d585d824917c41f2d0f66536af43eadc
SHA512 7aa8e6887742cde2b2bea5f029c4dec0e41234433cd4e622df3ae420283f93fa1f17f36a9adee44caad46cace0f6c617a08f95d36c87ec924ddbbc47c25c2d2f

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

MD5 64a52b81eebb07f52e1a1678989f3246
SHA1 0405347a8f51aedc1bef9db1ed3688915fe6df3d
SHA256 bf227675280b4ec00fe7d6598aaa105ae33519962689e58d5f7cc0f33f22e063
SHA512 870dda8564fe06fe880755b50c73f23c6e1a4f4249485509577c556985de193fd047f936b621aa2a4a9dd94534380e57902ee64056896cf88a7ee0ba752fdb90

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 d893da6cc7dd077139500b4db0dd9555
SHA1 4ca1a00c80943165ee7858c189a05ec792aad095
SHA256 29ec794e87b4a65d048729ac0f203e1e6cc1b760405bc891e3d2c1f08e3b1545
SHA512 9bdfd483d877e26939055333eecb594299f57e7f8efa61c7919451e8141eebc5a78122a7d8c3b877124c7d2196c032805d17432111b814cf799a81b296d035be

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 2e4205207f82159f574a5886ae84c703
SHA1 6b5e3e8831ac346d96e6e16647dd8b258242a758
SHA256 e3c22a30229e41078ceb83df15369ea20660f0ec4ff302d5adf947da35fcd0c6
SHA512 9b41694d781279ab4ed9999b60a61d9471bf6fbc7e38d6fca786218b59b5801b225464ff7761b0ad06d79b32b25762881bd91b18e7ac0727b027b526cafaf611

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0

MD5 f63137cd94333d89ac40a43cd546cd15
SHA1 771dd95e3220e53189c87d70d2aab4b86f1ecc61
SHA256 d759dc2458ce9e75d45e7c2e9c596c46005268e438e929d9738d1dbc5f34231a
SHA512 a9e0655dbb1e80f68c8d27ccfbda76252819e343bd666c2b76f172f92399f7bf215f4718d1a8e69cb87f99da72bb59fe707fd24885456b9122a19e4053d9e1f8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0

MD5 733c86e04193fa5fb65a1131d96398dc
SHA1 2d40564d2ae02aef2ba07e773ab7d14cf15f8584
SHA256 35afd7982caea8334eb9cb22418d93bf803c68bf4844cad88b84fe6a062699a5
SHA512 7cca88834a0fac24b7d6130fb3420cd6d1320a782437be475e379ef828380eae3e4cdd7a6d0ff9c5dc4fdd582bf884227701b8ac8060308cd6e4913332a73eba

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 3b8d215b5d59bf4e456727314ae9435f
SHA1 92a8855f60238f6ecccc76e0d224297641461b74
SHA256 a717c1c8d1cbd888f09ce9d1a3c7bb216be2a2575c0e76278dea499fe35a37d5
SHA512 a9a7aec6fec6af23747a0c097ebb2ce3912c38c7d8f0e8de6fbc926e3a979f96905f296454abae43d3b0d2891128be5ac2194ac48867a06ad6b8970f786db7f0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\90193b9a-1b26-40f7-96d5-2331b939329e\index-dir\the-real-index

MD5 b5406d6dd4ae61157779e7f6f9501f42
SHA1 746fb6e0ad600eaf29ee5b44f4ab242d32a9b993
SHA256 b74e128c9f438004b1ba45065dbf4a45f99151613b307d172401fd53ce4495b4
SHA512 76064cbcc405e35498e86b1eb5ff32fe688d4c6a8ce4801195b9acf308c96829a7a565e29b441ae9f3de685ee874a522f13ce8b2e6c21713b27c882991127250

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\90193b9a-1b26-40f7-96d5-2331b939329e\index-dir\the-real-index~RFe5934a3.TMP

MD5 c66dcce0a90e81000f2a6af1722e2bb3
SHA1 291d0b2d337446e433d20788ab25340f173062b8
SHA256 000b001b1a69c2074b89b5a90e694c8444b14ef1339797943f8ec8be5f02d5ca
SHA512 32217386709b1a63df94b608974e98757b33ac97eb59f35e55ba78728de73dcc2228f4429f06fb30ea4214bb8ceaf8203cc93487f77cf52447fddcc07a5c7c74

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 12c5142c869726fb864574f61d213674
SHA1 8301c362c64f763d776acd482d4d203aff908e4a
SHA256 755e32cf2692786dd3ccb810653e207e03d892661b32a8f63a3bff8443ad751d
SHA512 22010700e549642ed5d64534616ed5b621748150e742d3afa47c2780210748d6e1edf2a501ba25004dff5d757d2e3dc6b8a766f3d5b1f73df40a7bd1644d4d58

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

MD5 bfee4a36e3a67cd1970c80d2129b15f0
SHA1 783f03254996988e559258690f6228dd1a6f30db
SHA256 d2367455dfe25fcdeb824550e45a7176140472cf12a36df7a1d2b0196f8d21d4
SHA512 d7c9a7cc744a5bc0b2bbb91e497638b7ae9d315ae8ca77291e8fb994556675960a15b2b6b2973171b9c215c97e5f84744dc5a1856cc58a202ff1ff79defd2b04

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 ac43c123f6092fc4d0762464d55213b4
SHA1 c78c167b43a8e746e1768b102c03260c7ab2dde0
SHA256 074864385a8e4afb174393e84b64ca77a8c363111671cab69bd5bf62cf49bab1
SHA512 1600e6542b5d7631cdec5f7fca751cc5e2426dbb9c708bba9a00945a4765ae5b195ee6da4996c7c83d3465d5830cb076cceee6c6c0894c3a26f0178b3aa9b246

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 da0d95e67801694d65932deea38cf23f
SHA1 4e46f11544f202cf02d3b1da00b33137ab280b62
SHA256 ad486857703cf5af5d160fa1d0550dac8aede77c2c7bb4cfcc8e455f8c0a0e01
SHA512 a5303934a70ede77c27d07903079eb98fc477316836e429cdbdc880ca77069bd731686a1f4b3acf73f2e0d5db53caf4a3d00a6ed24edf31eb4f4d342d89d4adf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 cb4844df58e798c0ee2e9f16a52dc176
SHA1 f8d6127782dedbaa8cf5a916d1a5644f61f6f4a1
SHA256 9d5eae57d8875602872d5134331c1559878936bc680df198cb81a3ee3bf5b740
SHA512 772e32d85687134bb395a8f814057c0c0f66616e16a7b885cf7b91fe19aac0920b347392b02b7101f562a0a55b2f2450069791e4940cb1d3462cdd4ddd44f4a9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000044

MD5 f6c5f91182d258e81425b5814913051b
SHA1 b82c9fa9215cc431995b0d5a6a74f44945a8c008
SHA256 6978a3d3b264438b44353c188da1097721f8ae6bd6c42756f130de64b1034731
SHA512 2cca8e44477ab360a5bd7ca0af4e12e54714577e9edab90f7e0fbf079e81e15229f7e08419dc7f839a2cb00129211cc837df2c5da97a346e7c8db9fa174f8da7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 b6c11a2e74ef272858b9bcac8f5ebf97
SHA1 2a06945314ebaa78f3ede1ff2b79f7357c3cb36b
SHA256 f88faeb70e2a7849587be3e49e6884f5159ac76ef72b7077ac36e5fbf332d777
SHA512 d577a5b3a264829494f5520cc975f4c2044648d51438885f319c2c74a080ea5dd719b6a885ed4d3401fd7a32341f88f26da5e3f29214da9afbbbd5ee950e8ec3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005b

MD5 151fb811968eaf8efb840908b89dc9d4
SHA1 7ec811009fd9b0e6d92d12d78b002275f2f1bee1
SHA256 043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed
SHA512 83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 4703f443547b689731bf8e4593b7e63e
SHA1 10350d09d6e977d81308984a5d7562f7a31589e8
SHA256 1d2d6f8814a0e8d0c3ccb372976591decc4b8b0e0c7d60f0682131e4dcfc649e
SHA512 8e0630d4b67aca3bc932194a6d12b485c30ccd40e26ff417d5df21b335d6314e967b4684e09aa5d458d87f9c43fdf12e74525f918c8891203d5959f96f919a99

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000064

MD5 87e8230a9ca3f0c5ccfa56f70276e2f2
SHA1 eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7
SHA256 e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9
SHA512 37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 3654dafaa9c165f45afd5b95fffb991e
SHA1 32566ce0906359ad2c9bedd2399eae989394d083
SHA256 5bd53093f4a8faa0b9f92fe650891f22c11e0c9c4488afc9eb2baab67f298fbb
SHA512 8938d095ecb3a0ace6a897f0b8f283c123b91ac07ea70d1c9effcea9e0e313f3216dc321a479dfc84996e9a393e89363ad3bc9725747f265078328516f7b9f4a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 cc5f5a5680970b4c81d9847768bba32e
SHA1 e05ab4fbbfdb7dedb95f3ac7da8dc4091b0a9a6c
SHA256 0f7c89e1ef8d2b10ab02cdfdb5738517a3e80f140d84b643a977f7e06c182761
SHA512 a20a3be1b54177382d9ea568252c88dbedbb5966b15062eb7e4d12314f3dff8999d51492835d835d2c009702f1006e408d1e9137931da1cc60b542fb4a8131f5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 3f4c20214e6ff0314fbcb9b24a4bc980
SHA1 26acd5655c9bbed2177439162c3d4aacd64d5d90
SHA256 aefe830149d16f5aa36d99f1ea0a5cc1783f4d3333bc96c4e9e4a6014500202a
SHA512 c909a995e5c7a1820c241c72f516fadd74e8f3b67d6e0f6d6e43469eac08b1d48a8ee15e9f2ea54a0f95bbae4090c7ca77d17d5eb3a576307ae5652722e861d0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 93a2bc53024d2a4f956da5fa3930bfff
SHA1 9fdec51e45819ed23c701c4ec776eafaf3681d1d
SHA256 05374a12c74a1967c4ee8b22e8fef748918330743a18852da92e7ec02679609e
SHA512 ef052ab599ca9fde840068c896b2cdd229b21879eabaaf554266f4325b31836dfa63d5812f922e4f4aaf9346a5508a6d87527bfd7a008324f09e23c3dfb6a960

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 6d81dd4830047b5e3345769682c0babe
SHA1 789413125ad4824a909b1709a5a3597331495df1
SHA256 8699d661b665ba5f28488109947527a5573d07af56324900a87a0c58b86c9758
SHA512 8a6040f26f39eaf369c5023357361ab476d8bbef661ec8b43ebed3b65b820fd27f551134801d8edd79374f5e50e24a41c6e70c568a48d640a9a0ef38663c0ad3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004d

MD5 6b04ab52540bdc8a646d6e42255a6c4b
SHA1 4cdfc59b5b62dafa3b20d23a165716b5218aa646
SHA256 33353d2328ea91f6abf5fb5c5f3899853dcc724a993b9086cab92d880da99f4d
SHA512 4f3b417c77c65936486388b618a7c047c84fb2e2dd8a470f7fe4ffec1ad6699d02fa9c1bbd551414eef0f2e6747a9ee59ca87198b20f9f4a9a01394ae69fa730

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004e

MD5 c03ff64e7985603de96e7f84ec7dd438
SHA1 dfc067c6cb07b81281561fdfe995aca09c18d0e9
SHA256 0db8e9f0a185bd5dd2ec4259db0a0e89363afa953069f5238a0537671de6f526
SHA512 bb0fd94c5a8944a99f792f336bb8a840f23f6f0f1cb9661b156511a9984f0bb6c96baf05b7c1cf0efb83f43a224ecea52740432e3cfc85e0799428765eefb692

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_1

MD5 ec148531803043faba2866d17969240b
SHA1 0f913fd68dd0afbc0889db68d233c433b6757411
SHA256 b153126aaba041b9666153edb4f5225ece28294a0688631fc651e66d23438529
SHA512 2915b0e4f2244c19955d47b367b72e17c9bc8ab267a9c64dcb132919fbd126928230f244d7bad3f9452ac6a00c549900c655b25b86ee063b9c3faf331db8dae9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_1

MD5 379fcb4ff25b21f79b0f4f38ffa40f97
SHA1 b7a540a1c964d2fa3da9f5f49826fc5be665f18b
SHA256 bb0976ffe74a8a335bc001c257beefe8049c8306b64c9863de57197c14b60b0c
SHA512 7f675aba14f720a9526fb25c7876e0777bb9f326056fd161fee5abfa5ca9a6378dd85976e6ad792441325202e2685b5bdf3a654ee24a8fb8b268f8a7b71b09ba

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0d241d38-3bd5-42e0-b58c-88cfbb6d49c7.tmp

MD5 26727d46ca25ae85d560b62c7f9757a5
SHA1 9110a04f88485d7287041842c5020fc6c2fe0dc0
SHA256 9d5b0e3f44590077a4613d7a419dffd6c4612878aa52026f51da94fc22e0a8e2
SHA512 6c3c0343fe504c0958e3993da1f5cc1de288e88df1bc75640fca786201bf24903a4203cfd273158ddbb693cbefb99516688e51bfa01459615f40446b46de90f2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 fe4083283dff30472077e3d2ae01d14e
SHA1 086e10113b5b55f5174a64dc6564cc9902ed66ae
SHA256 b43a7f1f9cb5c4541a07f1df1d17d7fa2fdbfec4cc3cc9eca42dbe42d28d7dd5
SHA512 4e26665ab9876ed9f7c299fa1afb77eea5e9357547bbebf08f04b2ae8eab64ee18e6832ea797d66d7561e2c21b4097684faf5a99b3ec2befd7b8fa697e5099f4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 a6bf33093ece38e8a01563a7a1e88642
SHA1 badb88501969d87d9a4bd40693af8ad44e412109
SHA256 22a5817a16da2242800f0608d2e6fac267ffac06a435568f7959c5f9718e2d3c
SHA512 44e2eb03c257b1ce809e752ddcb79f29b8c8e47f54479850de0e6de832ea16f88b8ffc7cf3e4e38d47542f8a606e32ef42f4bf484ea9c56d181e2a03a6425e6f