Malware Analysis Report

2024-11-30 05:27

Sample ID 240711-mq534ssgqq
Target https://www.mediafire.com/file/9vpdcfgamjan4ku/E0lDr3Ff34yh32487q.zip/file
Tags
lumma stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

Threat Level: Known bad

The file https://www.mediafire.com/file/9vpdcfgamjan4ku/E0lDr3Ff34yh32487q.zip/file was found to be: Known bad.

Malicious Activity Summary

lumma stealer

Lumma Stealer

Executes dropped EXE

Checks computer location settings

Enumerates physical storage devices

Enumerates processes with tasklist

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies registry class

Delays execution with timeout.exe

Checks SCSI registry key(s)

Checks processor information in registry

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-11 10:41

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-11 10:41

Reported

2024-07-11 10:43

Platform

win10v2004-20240709-en

Max time kernel

135s

Max time network

93s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/9vpdcfgamjan4ku/E0lDr3Ff34yh32487q.zip/file

Signatures

Lumma Stealer

stealer lumma

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Downloads\E0lDr3Ff34yh32487q\Elr0nfF43g\EIect0nDf344h34uihywue\EIeCtR0n1R.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\taskmgr.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings C:\Windows\system32\taskmgr.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\550573\Championship.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\550573\Championship.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\550573\Championship.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\550573\Championship.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\550573\Championship.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\550573\Championship.pif N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\550573\Championship.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\550573\Championship.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\550573\Championship.pif N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3216 wrote to memory of 3536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 3536 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 3844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 3844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3216 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/9vpdcfgamjan4ku/E0lDr3Ff34yh32487q.zip/file

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb870146f8,0x7ffb87014708,0x7ffb87014718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,8796702660440277992,1700553620472214942,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,8796702660440277992,1700553620472214942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,8796702660440277992,1700553620472214942,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8796702660440277992,1700553620472214942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8796702660440277992,1700553620472214942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8796702660440277992,1700553620472214942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8796702660440277992,1700553620472214942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8796702660440277992,1700553620472214942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8796702660440277992,1700553620472214942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,8796702660440277992,1700553620472214942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6384 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,8796702660440277992,1700553620472214942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6384 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2184,8796702660440277992,1700553620472214942,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5652 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8796702660440277992,1700553620472214942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8796702660440277992,1700553620472214942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8796702660440277992,1700553620472214942,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8796702660440277992,1700553620472214942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8796702660440277992,1700553620472214942,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2184,8796702660440277992,1700553620472214942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\7-Zip\7zG.exe

"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\E0lDr3Ff34yh32487q\" -spe -an -ai#7zMap276:98:7zEvent10517

C:\Program Files\7-Zip\7zG.exe

"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\E0lDr3Ff34yh32487q\Elr0nfF43g\" -spe -an -ai#7zMap23286:120:7zEvent16940

C:\Users\Admin\Downloads\E0lDr3Ff34yh32487q\Elr0nfF43g\EIect0nDf344h34uihywue\EIeCtR0n1R.exe

"C:\Users\Admin\Downloads\E0lDr3Ff34yh32487q\Elr0nfF43g\EIect0nDf344h34uihywue\EIeCtR0n1R.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k copy Prefix Prefix.cmd & Prefix.cmd & exit

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 550573

C:\Windows\SysWOW64\findstr.exe

findstr /V "TARIFFGENESISRESERVATIONTATTOO" Partner

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Kirk + Accident + Harder 550573\I

C:\Users\Admin\AppData\Local\Temp\550573\Championship.pif

550573\Championship.pif 550573\I

C:\Windows\SysWOW64\timeout.exe

timeout 5

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.mediafire.com udp
US 104.16.113.74:443 www.mediafire.com tcp
US 8.8.8.8:53 the.gatekeeperconsent.com udp
US 172.67.199.186:443 the.gatekeeperconsent.com tcp
US 8.8.8.8:53 static.mediafire.com udp
US 8.8.8.8:53 btloader.com udp
US 8.8.8.8:53 translate.google.com udp
US 8.8.8.8:53 www.ezojs.com udp
US 8.8.8.8:53 privacy.gatekeeperconsent.com udp
US 172.67.41.60:443 btloader.com tcp
US 8.8.8.8:53 static.cloudflareinsights.com udp
US 8.8.8.8:53 cdn.amplitude.com udp
US 172.67.170.144:443 www.ezojs.com tcp
US 172.67.199.186:443 privacy.gatekeeperconsent.com tcp
GB 142.250.200.14:443 translate.google.com tcp
US 104.16.80.73:443 static.cloudflareinsights.com tcp
GB 18.154.84.60:443 cdn.amplitude.com tcp
US 8.8.8.8:53 74.113.16.104.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 8.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 186.199.67.172.in-addr.arpa udp
US 8.8.8.8:53 cdn.otnolatrnup.com udp
US 8.8.8.8:53 g.ezoic.net udp
US 104.16.53.110:443 cdn.otnolatrnup.com tcp
FR 13.37.187.223:443 g.ezoic.net tcp
US 8.8.8.8:53 ad-delivery.net udp
US 8.8.8.8:53 api.btloader.com udp
US 8.8.8.8:53 go.ezodn.com udp
US 8.8.8.8:53 translate.googleapis.com udp
US 104.26.2.70:443 ad-delivery.net tcp
US 104.26.2.70:443 ad-delivery.net tcp
US 130.211.23.194:443 api.btloader.com tcp
US 104.21.87.79:443 go.ezodn.com tcp
US 104.21.87.79:443 go.ezodn.com tcp
US 104.21.87.79:443 go.ezodn.com tcp
GB 216.58.212.202:443 translate.googleapis.com tcp
US 8.8.8.8:53 www.mediafiredls.com udp
US 104.26.3.173:443 www.mediafiredls.com tcp
US 8.8.8.8:53 region1.analytics.google.com udp
US 8.8.8.8:53 stats.g.doubleclick.net udp
US 8.8.8.8:53 www.google.co.uk udp
BE 74.125.71.157:443 stats.g.doubleclick.net tcp
US 216.239.34.36:443 region1.analytics.google.com tcp
US 8.8.8.8:53 api.amplitude.com udp
US 8.8.8.8:53 otnolatrnup.com udp
GB 172.217.16.227:443 www.google.co.uk tcp
US 130.211.23.194:443 api.btloader.com udp
US 52.41.50.171:443 api.amplitude.com tcp
US 8.8.8.8:53 securepubads.g.doubleclick.net udp
US 8.8.8.8:53 g.ezodn.com udp
GB 172.217.169.34:443 securepubads.g.doubleclick.net tcp
BE 74.125.71.157:443 stats.g.doubleclick.net udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 60.41.67.172.in-addr.arpa udp
US 8.8.8.8:53 144.170.67.172.in-addr.arpa udp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 73.80.16.104.in-addr.arpa udp
US 8.8.8.8:53 60.84.154.18.in-addr.arpa udp
US 8.8.8.8:53 6.39.156.108.in-addr.arpa udp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 110.53.16.104.in-addr.arpa udp
US 8.8.8.8:53 223.187.37.13.in-addr.arpa udp
US 8.8.8.8:53 70.2.26.104.in-addr.arpa udp
US 8.8.8.8:53 102.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 194.23.211.130.in-addr.arpa udp
US 8.8.8.8:53 3.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 202.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 79.87.21.104.in-addr.arpa udp
US 8.8.8.8:53 173.3.26.104.in-addr.arpa udp
US 8.8.8.8:53 157.71.125.74.in-addr.arpa udp
US 8.8.8.8:53 36.34.239.216.in-addr.arpa udp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 34.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 226.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 171.50.41.52.in-addr.arpa udp
GB 172.217.169.34:443 securepubads.g.doubleclick.net udp
US 8.8.8.8:53 bshr.ezodn.com udp
GB 172.217.16.227:443 www.google.co.uk udp
US 104.21.87.79:443 bshr.ezodn.com tcp
US 8.8.8.8:53 tags.crwdcntrl.net udp
US 8.8.8.8:53 ad.crwdcntrl.net udp
US 8.8.8.8:53 bcp.crwdcntrl.net udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.180.4:443 www.google.com tcp
US 8.8.8.8:53 translate-pa.googleapis.com udp
IE 52.50.240.62:443 bcp.crwdcntrl.net tcp
IE 52.49.45.15:443 bcp.crwdcntrl.net tcp
GB 18.245.143.58:443 tags.crwdcntrl.net tcp
US 8.8.8.8:53 fundingchoicesmessages.google.com udp
GB 142.250.187.202:443 translate-pa.googleapis.com tcp
GB 142.250.200.14:443 fundingchoicesmessages.google.com udp
US 8.8.8.8:53 195.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 4.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 62.240.50.52.in-addr.arpa udp
US 8.8.8.8:53 58.143.245.18.in-addr.arpa udp
US 8.8.8.8:53 15.45.49.52.in-addr.arpa udp
US 8.8.8.8:53 202.187.250.142.in-addr.arpa udp
FR 13.37.187.223:443 g.ezoic.net tcp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 download2300.mediafire.com udp
US 199.91.155.41:443 download2300.mediafire.com tcp
US 199.91.155.41:443 download2300.mediafire.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 41.155.91.199.in-addr.arpa udp
US 8.8.8.8:53 233.38.18.104.in-addr.arpa udp
US 8.8.8.8:53 sys.ctrackapp.com udp
GB 108.138.233.7:443 sys.ctrackapp.com tcp
GB 108.138.233.7:443 sys.ctrackapp.com tcp
US 8.8.8.8:53 track.donecperficiam.com udp
GB 18.165.227.107:443 track.donecperficiam.com tcp
GB 18.165.227.107:443 track.donecperficiam.com tcp
US 8.8.8.8:53 go.etoro.com udp
NL 104.109.249.151:443 go.etoro.com tcp
NL 104.109.249.151:443 go.etoro.com tcp
US 8.8.8.8:53 7.233.138.108.in-addr.arpa udp
US 8.8.8.8:53 107.227.165.18.in-addr.arpa udp
US 8.8.8.8:53 151.249.109.104.in-addr.arpa udp
US 8.8.8.8:53 marketing.etorostatic.com udp
US 8.8.8.8:53 etoro-cdn.etorostatic.com udp
GB 142.250.180.4:443 www.google.com udp
NL 92.122.63.182:443 etoro-cdn.etorostatic.com tcp
NL 92.122.63.182:443 etoro-cdn.etorostatic.com tcp
NL 92.122.63.182:443 etoro-cdn.etorostatic.com tcp
NL 92.122.63.182:443 etoro-cdn.etorostatic.com tcp
NL 92.122.63.182:443 etoro-cdn.etorostatic.com tcp
NL 92.122.63.182:443 etoro-cdn.etorostatic.com tcp
NL 92.122.63.182:443 etoro-cdn.etorostatic.com tcp
NL 92.122.63.182:443 etoro-cdn.etorostatic.com tcp
NL 92.122.63.182:443 etoro-cdn.etorostatic.com tcp
NL 92.122.63.182:443 etoro-cdn.etorostatic.com tcp
US 8.8.8.8:53 182.63.122.92.in-addr.arpa udp
US 216.239.34.36:443 region1.analytics.google.com udp
GB 216.58.212.202:443 translate.googleapis.com udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 216.239.34.36:443 region1.analytics.google.com udp
GB 216.58.212.202:443 translate.googleapis.com udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 paVreNfuwowPeCCYQnZQ.paVreNfuwowPeCCYQnZQ udp
US 8.8.8.8:53 beginningboundewk.xyz udp
US 172.67.223.102:443 beginningboundewk.xyz tcp
US 8.8.8.8:53 102.223.67.172.in-addr.arpa udp
US 8.8.8.8:53 bouncedgowp.shop udp
US 172.67.214.52:443 bouncedgowp.shop tcp
US 8.8.8.8:53 bannngwko.shop udp
US 104.21.81.196:443 bannngwko.shop tcp
US 8.8.8.8:53 bargainnykwo.shop udp
US 172.67.146.97:443 bargainnykwo.shop tcp
US 8.8.8.8:53 affecthorsedpo.shop udp
US 104.21.6.254:443 affecthorsedpo.shop tcp
US 8.8.8.8:53 196.81.21.104.in-addr.arpa udp
US 8.8.8.8:53 52.214.67.172.in-addr.arpa udp
US 8.8.8.8:53 97.146.67.172.in-addr.arpa udp
US 8.8.8.8:53 radiationnopp.shop udp
US 172.67.196.169:443 radiationnopp.shop tcp
US 8.8.8.8:53 answerrsdo.shop udp
US 172.67.203.63:443 answerrsdo.shop tcp
US 8.8.8.8:53 publicitttyps.shop udp
US 172.67.134.88:443 publicitttyps.shop tcp
US 8.8.8.8:53 254.6.21.104.in-addr.arpa udp
US 8.8.8.8:53 169.196.67.172.in-addr.arpa udp
US 8.8.8.8:53 benchillppwo.shop udp
US 104.21.81.128:443 benchillppwo.shop tcp
US 8.8.8.8:53 steamcommunity.com udp
GB 104.82.234.109:443 steamcommunity.com tcp
US 8.8.8.8:53 reinforcedirectorywd.shop udp
US 104.21.83.48:443 reinforcedirectorywd.shop tcp
US 8.8.8.8:53 63.203.67.172.in-addr.arpa udp
US 8.8.8.8:53 88.134.67.172.in-addr.arpa udp
US 8.8.8.8:53 128.81.21.104.in-addr.arpa udp
US 8.8.8.8:53 109.234.82.104.in-addr.arpa udp
US 8.8.8.8:53 48.83.21.104.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 10fa19df148444a77ceec60cabd2ce21
SHA1 685b599c497668166ede4945d8885d204fd8d70f
SHA256 c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b
SHA512 3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef

\??\pipe\LOCAL\crashpad_3216_QSQKBWIMTEZQQFXO

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 75c9f57baeefeecd6c184627de951c1e
SHA1 52e0468e13cbfc9f15fc62cc27ce14367a996cff
SHA256 648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f
SHA512 c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8025b9823a0ff7d6d83c1ed17b2ea77c
SHA1 9a1f3cebd565b2da537670c12df447d28eac8516
SHA256 956cafeadb00e3c8f57ce3bdd3209a4f7aa97d9454de0835e49b07d5f6c2c582
SHA512 d3f284e9d0cb9ceaa2cfdbfe53ebb321051f6f9e208ebfe862982443a75374e9eb41364d605352f07508c971d3f60f5f133bc8cc7d08595300cc7d5cb6ca6449

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 b7b4052d8d32845134ecc3cce66867d3
SHA1 9ed05d42994ff73eadfb8df6839e4baa2ad5d477
SHA256 8c45faeb8ea9b93d23b8550e552b79209512da2c2ea9964e1bb58f7100723a64
SHA512 735f70fc00f84042e3087ef459c3720be811ce692ce72357a6e0bb6d39f38c80d75107aca16f595bc1f46e4736b7950e81436cb32dd6cbe0baa02b33063ac036

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 1ac9fb172347cadc22d40b487254bf14
SHA1 5ed4162d65257625c668cc87ccbb1ecba17cd051
SHA256 169b1fbaba4564864c66428281ddf0b852f1b9b1254fd98d07f06c5ea510b848
SHA512 01aa15ea06e4c047092d4f13a041ef943570942f02443a14d9d146eb1c20fbbba27fcfa726ab4465aa767837244ec08b39d8bb220d9cf97752aecdece0ce1037

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 020096362c01ecd5f5d6b25702758121
SHA1 c0262dcfff38162891ea2f41539b0385f05e5dd7
SHA256 8530032570c630abb4bcd0293c029df512f90500092cdddbd6442708002e16cb
SHA512 69e5a1303c45f417e0a894cb73f7c4b7824751f787e0983391c329c5e1867964ee06a43f36ae26a47553bf4023d52d8c426bc02a6c2eb6aea0b62acfbb0bb852

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 88fd17e8f6c67abb20299b3ea927efcc
SHA1 ca50d750ab5b933611f86e655a9eeca6fe9c340d
SHA256 5e1ff0974d9ee1c46fd5b8937395d4a4e601dac3d5e52269bac1c72d730f7273
SHA512 29492264498286ac772d44b06af6e2463d8a8ca99a21ecb88f850a3d902cb1644f59be4c281cd7a4bd0872f3012bd5e77cc3a4307107a6d23a03dee4f734a298

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 fae520ac88d7d1a580f357a902969d01
SHA1 e3694a006267f5462bc91ccabbbd7b6b387b8cf9
SHA256 b97192fe248e0e7d2ca738d18c5843223d3d313cf4cb8a61a6aae676bc6c3804
SHA512 b19fdb38fa27a65d6a5dd53337d6d8d823f6d9b08d46c7f9f9fdfa2d01540fdab64d27e903a72a0d9ba05cf0a5595c5375d880bd5a10cccb1f77868d4899699c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 9749e2c05f60927fc8da90858373e46a
SHA1 86b4002bacdf67fa6671ee0aa3d5936ac7ee71d7
SHA256 b2e987021e7a7cce379130f8d5d408726e3443b2802f602c2bdfe5e1c91d1ba3
SHA512 964059138060ecbe18faeab2964e3bbe119cb918d4704a8bc35e6d4a1aa7848d5aa737f4bdc403662dbaed70fe29ababc2bb6fa6a47662d8749bb1d56589179c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 23a07a6ddb778399e8ac730104b23ada
SHA1 458281a4b0862d76e727ef95146ecc7d9a065954
SHA256 3198b5c9ae5e4dbc43056cc2f7ccde4ca62e0738f487dd0b319574a29306dc63
SHA512 e5b4a81f0ffb06211697b7801605ddc27f1fd7a2d4b2678deaeedb5a248b0a5441ee98f4714cb9ff480c3fa1ceb2da3fdb1119f108a014750c11a72ef4be9e6a

C:\Users\Admin\Downloads\E0lDr3Ff34yh32487q.zip

MD5 ca2d0ed7b0e4cc617927722793d508eb
SHA1 6f3680fd4a90d21504b67c3c9c0e59950eea9aa8
SHA256 ae848df6ee1217cfa6ef6b8c52efe5789ca62513997d66e7146bd5606bd49bc0
SHA512 83f28b920edf5f23594bd88fb6965ede00d5b051c70aed31c9c29a8e70ee27a398285ffa1199b57185120958b973599d8f3cedd3766baa57d2b4763ef7ee6c6b

C:\Users\Admin\Downloads\E0lDr3Ff34yh32487q\Elr0nfF43g.zip

MD5 e7abc763fbb63320affea46fc59ae24e
SHA1 df77dfc19a851449bb846a570c10929bc9ac4a72
SHA256 3b914f69a5dc89ade34bb890ee460a1addc585fa8d7bf4622447ff083ec6f85d
SHA512 c4cc9ae3810a66d61e1b6dfb49b3b90248c2b3b78db90c101c0d05144f534633f8fae99f1560833aa9e8d5e5b3150ddfed01112effda4d260dd1766b59d6331a

C:\Users\Admin\Downloads\E0lDr3Ff34yh32487q\Elr0nfF43g\EIect0nDf344h34uihywue\EIeCtR0n1R.exe

MD5 dcb2e1be222342908a12a20d0dea55f4
SHA1 92dbd7afa1f6407f30a8ec6868c3a96b4cb0d6e1
SHA256 6b9082806796e3036984cb78ba6b9dfb1e07ee08371209a0f64ce90b895824df
SHA512 595d92f2eac519bad2ce34c1458daac28e2835808c97167ebfd84a87641da96d9e2fd39ee679a5ed280d6a0eaa4ff6c24bb693feafd28f70ef6784d00a6f6fec

C:\Users\Admin\AppData\Local\Temp\Prefix

MD5 25ed18702317f7a0ce36a451d6e9d7b4
SHA1 77301e72a2242056ceb09dc875332e142f3b20e9
SHA256 00f1f4297d7391bae816238a0c6bf3ad1073cdae22a985b8b94b28a44ee043b1
SHA512 a1589d68eb6498b6fc0c94301f84a7192ed20480f9b1487ca63766debb7a465e731234cbade3f544c20e87b2b10efbe9efc653e1e93b2e9a9fe8afe704d79144

C:\Users\Admin\AppData\Local\Temp\Partner

MD5 8dce895b03a65c29c7a941a662fb22c6
SHA1 1e5a908ee71fb4ab3593105b027ffbe175f588cb
SHA256 ad3b53c07f54ceb8c7466f911fb1cdd92586541cb49266d8e91e555fd9b2cb2c
SHA512 839af4dc7bbc8156bfebba4b26e88186ddf735fa5da43447face31132236b73de1ac2dc9e57a7f2718f46c5ba9415ad930f4fd3f88b9bca7de59a6aca63982a3

C:\Users\Admin\AppData\Local\Temp\Donations

MD5 b7e4b224611476ca86d3daf4f289aed0
SHA1 09039ce9525e01334ec1c526e1c4eb7e45567b1f
SHA256 fb6c6cea1be22442c96beed6773634df4bb637888e7aff2eb615a22332fc701f
SHA512 7b27be2d30b2569c2e5ebc8bd410ee8f9afdf8f5a11febf62a5aedd0310af7d8c72d95d3d78ec77d77634acebb12e7ec47021018707ba2ddc9f49a0017d24a0a

C:\Users\Admin\AppData\Local\Temp\Passengers

MD5 306f4659fe535892033d12b1139cfb45
SHA1 91d3cdd0a7fd699d043c311d9a1d66fbf6d28936
SHA256 d52afb86c6e67267aa9aca6680ab833d218dbac6a6abc4871993fc16e7233bb4
SHA512 48c085a612b6104d834dfeb21744429bd84d4ae1f7fc386fdb2e962796269b5c7ed5ba1c40b7492606ec21d33d33f684d711c0539979767b3e064fde56e85ace

C:\Users\Admin\AppData\Local\Temp\Refinance

MD5 0ff6766256d5970fea59a0cba3ffe2ed
SHA1 655862efc2bc2605dd41d8d58783b4c652795624
SHA256 6258e48909e61b744c65d81ba157d2b86229a4c48b12d29e338ef8b1b1c047de
SHA512 2b45e23a1a5e9c609a6a84eeb8d93ddf5f5867d2a071fb57faa87d1efa985f5a0b0c5a316a259f18d73ac98abfdd1deff7d9849dd8c3b43a35eed19430039fc1

C:\Users\Admin\AppData\Local\Temp\Hq

MD5 8d563cf15e88a52c84f0b5c0204d0ed7
SHA1 2e6910b9c350b1674f52bd8195e329579546f706
SHA256 69112c4130a5c4c97fcbb29e75aa99539b8fdbd8fc050a4d04e35ec478585c4f
SHA512 4cefc5b0d0f68eec58240796b3e302aa17a542774a8233eeb15cfd1f6e3f6d855ba246775036fe1274896fb4970dea4f37d3b036fac3f85f600c4bb69e18e32a

C:\Users\Admin\AppData\Local\Temp\Surgeon

MD5 21b2608c0788a6196a5645f9a926a76d
SHA1 fee3ef5643ba447e025688d7a2cc31ad8992727d
SHA256 c91f0d59d241d35369dbb4bdbbc22088de2b87b3d4e4dcef826eb52f91240f22
SHA512 c59dd04ee8a7827a8cf4d89e74fade801d111d5e5d32e61e83f79885cc215543e9d3ad8d6a1418bd986634f137884a154c5af6463cd4510e0fb8efd3132e0fb1

C:\Users\Admin\AppData\Local\Temp\Armed

MD5 6314cff44d33c40603ed8aab312819f7
SHA1 bc93745b21e3fc82cc2fc91ad68cfea6ee55d644
SHA256 ef92c4570d24e2de4c4ecee12781b2d002893b02630f7c485578f7e8daf77dff
SHA512 0e54cd63c7a87178add3b8168245d64cf0110fa5de7072c2bf1826ee2759ab71aeabfd6fb82da9ef11292fe1303621906cdd53234ee34b77034d33538f7da3c6

C:\Users\Admin\AppData\Local\Temp\Sending

MD5 8d50590f10257594abbb2f67924e3a54
SHA1 2a4183530077b11ce8ba0117cac8e9592964d85f
SHA256 c0e503542dbdb1d4f61c18b85be793800981554596e81ad77899ee8d4834392d
SHA512 b7480c611c2071a34629adcbbcd7f651dfdf36e3a58d2fed848ad08aa2634335fb02fceb839dfb856923aa1f629e0849f18e617405b6f6e5086ec783babdae23

C:\Users\Admin\AppData\Local\Temp\Christina

MD5 94982806c937d671141ba02b160b6b53
SHA1 abcd585ce25a6fe3f3ba483014e874ede5bb3d41
SHA256 fa901be46929a4477381c2afa661f8cc77ec871e85c77fc6df4ee27be6023a8c
SHA512 7fb2c5e2f5b530fcef573e13b28521a2a926b25c01c17932c3a202b532b80e74a01d1d0660c46cc95f4f912072ee5f0564a8c3015dc8f7641bc5205326af9204

C:\Users\Admin\AppData\Local\Temp\Mary

MD5 18dae45f8a8f64452877138297851980
SHA1 d4acb0ed37196b93776f608126c845bdb8cb9004
SHA256 e2e3df8902549f0d31e14f4f5d23172b91bf53e90db0cd437ed8fcc1c6763169
SHA512 afb974aa0993bd9a1d74e0b4844968510f4d3c0dfcd57500bb98da8b6c9d5c9bb0d49aa915fd0f79172b09c82c9b2eb9d2c4938db143daa5a9721fa29f1c22cd

C:\Users\Admin\AppData\Local\Temp\Silicon

MD5 d17dafa52302e03b0bc3cad6d6ed304e
SHA1 d106155eaba807772d198f6e4c7043d2cba4b4c9
SHA256 4ced1112a4c7deae6e19fe35d3350627c4158737e057c6c56b58ee2d06f4a8a0
SHA512 1e1708fbc32795053e875094564470556e6da717299934b928b0d73e7a76889cb3256756e9eff95790ed456ab1e60acc4fb6c368143a5d9ab1ae421c6023596a

C:\Users\Admin\AppData\Local\Temp\Push

MD5 4a130f77b0814e07a1674273778b9c6f
SHA1 5606840c37371bee116b465d17755da6d5125de6
SHA256 bac025911b8dc98ca3a40e98f1809e15e5822448499783db68443f65cdf096e0
SHA512 dafcadb929e85d3389e212ffdcfcb409fd459f9fa936c15dfb1f152bfbbd12a3e6e8f438937fe413f44c1b55819d797567231bdc7d3e091e2424f54f0b0dc4f1

C:\Users\Admin\AppData\Local\Temp\Andale

MD5 670daa69b43ebe8c4dd3903af4c7e257
SHA1 0088f27a5d1431e1b1048f7ad762756dcdcb308d
SHA256 bb2638c5c38dbb8b8356042fb728d76e50d7f6c132da5d21c8183528ca67b038
SHA512 ea590aed74f74c4ac707b708b27860a091f07f77ceaa6f08f345453ac00b83f120bc304841fcdecc59bc7d8cd0485cfebd9e5c26c8875634585bc0010bbef28f

C:\Users\Admin\AppData\Local\Temp\Wide

MD5 e9f46b016f9603754499e0214570822a
SHA1 91fd850140b21bc1a13fa20def408ab056343ce8
SHA256 fe146c90ca1524f8839e138852c42829ac6c129be57ffa58c656f1257cdc7520
SHA512 46992a3d803fedaeb2f972aee889cbdbe5c3e86143bc0b5d55c71212311de050c27befadbf56e62f8aa4ed1ce1a50e76184bdd0fb7d35e3d19158cc14855a29a

C:\Users\Admin\AppData\Local\Temp\Contemporary

MD5 1f9d75472c9be8452e41d4942094b57e
SHA1 3e7129ccefa0f17b6017b3f5898889afe95e797a
SHA256 d21ae30e035e664c125f101cc37e0f4428d86185b97369b306753c1d38f6ae99
SHA512 6f1c844b60165ee02f7076d48a1c5dba587f92b440d43b9ef54e0cf71ae4a134609a899f899bc628714c746b5e020271ba7708e984736aa6273a9571bc20155b

C:\Users\Admin\AppData\Local\Temp\Container

MD5 eaef96322c8afd41c7e78a08ab989dac
SHA1 184de0b19c140c7125fcf6c007be38796748e808
SHA256 b4fb0f05bbdbb42b7c58e120ff3d713aaefd7c5e161eb59f236a0c75c653c0ea
SHA512 75ce956f077d385df010fdaafbc17d7ef420e9dcfbfac0b4ff9e6b4fed3a6338daa4ca4d18cdd81925044b66668e905bc939abee0ad1350da578fda88347b904

C:\Users\Admin\AppData\Local\Temp\Correctly

MD5 44f4b86bceed5140dbe8a8e8cfa79c69
SHA1 e02247bc7a77d3cabe9216b2adcb2a7a29eca03a
SHA256 73239a23b298310b9d6a2bd0ecc83394fb0538570c4f47d8dc3676c3f6069b99
SHA512 81ea027fb077f70eddc2304602ecfb2d3ea586b930005c814a1b9a6caa966b7fc153a564929877772ca381fc65a5faa0170f4b5038b1c2afaf9fbc3bd0d74300

C:\Users\Admin\AppData\Local\Temp\Melbourne

MD5 395b8138c8553c88907b9745457141ed
SHA1 7d9d7e53eb5d115ec864aac520143b2724872787
SHA256 fd09a440e9cd60df0fc75d9f04c53cc114a6a6aee49171a39edcd10fd495b666
SHA512 35aafc530af720b4b3549dd3abdb73970bae32febb01d3ac32532350107f806f755efe18e604e7bdd453bda3010422053ed771d0571cadb0227e0dc455fff3ae

C:\Users\Admin\AppData\Local\Temp\Co

MD5 d7425daa50d600e4f809e587d2928e7a
SHA1 d486a934004f326bea92ee741ed870ff84028279
SHA256 6a65866d67698db866251e05c7a8e01de2f593098788144e9cc7ff07f54ad2fe
SHA512 3655c74a555cde69803f3138d66612ab713f75215813015550024a2c530fcd3341d951f9c91f1573b2ff419949a6d004547a2682730e245f5b9aa341729a10aa

C:\Users\Admin\AppData\Local\Temp\Webster

MD5 1a2d6d1cdc8212a6ccc28d1f7f2f9ecd
SHA1 dbd14a3ea9afb4cb4eca6d1cfe611053be8e2d80
SHA256 99e60867bcc45de78188e2a30853d1ab0c433744613c646165a06edf935e96f0
SHA512 f2386f45d6e9fc8d5f8176d4db099523e010efdb8a3ce69251cb1bc7a1efb4605153019567d4c7c43c994ddaa50b0e4016f5fbdcbee1505c0efffef21feafda7

C:\Users\Admin\AppData\Local\Temp\Aimed

MD5 736acf209b6b277701d24b42a56df84b
SHA1 98e8cd85e32fe682ef49fcf852df77313c123705
SHA256 48168d70f8850a7a21dd62ddbdd26e45b9b75f9dd4e2208f8cd4a3f15b28a9d2
SHA512 79652703ba9e85a229b5648c38aae0782445b3f27271613760a3a32984b7db402b135f73e611927cf50402b44673e0fafd9f1603db5e75d1fa3a9190621b2b38

C:\Users\Admin\AppData\Local\Temp\Player

MD5 5c481ea4674100bf9a0beb25bef44867
SHA1 242552b16ea088e772afcce2222408fc55550ced
SHA256 c582d0251474d11af30057582a94f84408d3e35d457c708658c219731124f2c7
SHA512 23c7661c785846dc9e7cf76d335beff577b20687d3e23ad920633688769dd7ed6d0242a21a5de2a9f421583d9b7c8941a336eb4d93d98793239deab103698b2c

C:\Users\Admin\AppData\Local\Temp\Hungary

MD5 8091e5a8f1937abc1575aeb39f625617
SHA1 590d5db902ded9b954111a0d7c69308ce8dc6712
SHA256 3e630ae83f97d494e7ff62308e66de8aa99303bead11b34c13a9807d9f842460
SHA512 a8c75d1954c2afd15900b0f8eeec3ee92d35ce57b1f5f8e0af15f29e7d5defd718d3776abfa778bf820382c638a165fd3c0debf15ff89210f8f196cf6a2187ee

C:\Users\Admin\AppData\Local\Temp\Throwing

MD5 b83e7e1b470f11cc2a7188f61b1451f5
SHA1 80682668a93bd77e7420a69c8367d4b22c6d269f
SHA256 f2011812defcbabaccfdfac81b8f32eca2ee682c5b455a8ad86b14ff14b7a31d
SHA512 fb64f1119a09140e7eeceea36b21ae5225cad8b6e64187f61980446d543ec1d1f270144cf9e44db4c52ae3a7a4ab06d3fb6b2ff63c3b705be0ec87afee513881

C:\Users\Admin\AppData\Local\Temp\Woods

MD5 372606904857335772f21f549ce79c5e
SHA1 8eada8338fdf43b4b5936dfb4ae36777cf71ca50
SHA256 9cfa54c8f94adddd5c80a5a20f414ee8490eeaf558cb5c846a890cb4435e7148
SHA512 dd97dcaab5b5e34408f0ba9cb323852d12134188efbe15096c12fbc95e20b60232cc78104d78aa2af74fd8f8c2961fbf6649b2a80f1b83c127763aa10a600715

C:\Users\Admin\AppData\Local\Temp\Works

MD5 4f030b707cad194cf12785e84f89e88f
SHA1 b2bd054d06f077926a7718f650e430ee667bb90e
SHA256 01674ac2d404845dfee2f297b4adfbc233059adc2d6099d3cd217b6ca1d5c811
SHA512 7e987ba5b23ac5e73888084a268117b4196e59a31dae7de8d8783acd61e0b8d7e14b98517e8eac3a8688a31b8156123872d2a32f58499feb41e5c2ddb8badf94

C:\Users\Admin\AppData\Local\Temp\Singh

MD5 77988425ef310672c7f299762b7f538b
SHA1 7b1787e1da1ea5540c7c9ad5cae9263ec9ecc014
SHA256 345a742dd3d1f5b6e206760e3969ca62f41d4bea74224265d537c2c02dadfa64
SHA512 47bf9020e25d4b4eb501b32b7225fefefef53e9713c207b827ab84dc1c07273348b76e6fae43dec2a414d6ccf02fcfe1d1a1ea8ece19dbf53334e7beb7a449f9

C:\Users\Admin\AppData\Local\Temp\Kirk

MD5 44bca3600aa5eb7a312411ec2c10e3c0
SHA1 223c1f8cba747dca83202ad14d817ce3cfa056b1
SHA256 438af105addcbfb3c59ce64586246d2ea391a118c452eeb8f3d99b034be61592
SHA512 669f599e5f192ab06da95e892df4741ea86f5ececed43d5b9552e93974947ab194e10d5a69cfcd284bc19c55a8a6ca4ca34072f64d9e246ae0720082a472e57f

C:\Users\Admin\AppData\Local\Temp\Accident

MD5 fa829cd24566915f99afd6831eb019f4
SHA1 3e514dff2849eeaf568542353179078b76a11ebf
SHA256 03504eb2cbe22de8cbb98072b660ed096457ee54c8092f7d1e636f68f0a8643d
SHA512 de2a34839f348cd4b893b1115166aeed0d494621d67275dd31bf7daff0267973155752a92fd9820c8f2cdb33ff1cb69d3e9f44b99fb9765d5714911b4537c44c

C:\Users\Admin\AppData\Local\Temp\Harder

MD5 c22f7f6c5450f51c17315fb47a560474
SHA1 0f055b1daa18c1867273da78ade67431db382f53
SHA256 142ca2cb89e16b56b4b93d31d3cfff662323d0089b0b977524cd15bf51554be3
SHA512 6386e774bb9b8faf4092df930f19802c4bb2c03d33dbf736e4c381ff129c697289bace924fa45d8e908eb1f3821223cfc75f099e06757a1f6a3ce7f65b9249b2

C:\Users\Admin\AppData\Local\Temp\550573\Championship.pif

MD5 b06e67f9767e5023892d9698703ad098
SHA1 acc07666f4c1d4461d3e1c263cf6a194a8dd1544
SHA256 8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb
SHA512 7972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943

C:\Users\Admin\AppData\Local\Temp\550573\I

MD5 17ff69c0124df746b063431c1c520942
SHA1 6243e1965254d0e0fe6d6d34aff76e422a509473
SHA256 7691a9bd3d338e799956b50a226d35cdf3ef1434c0ae9ea02a2722aeac1f47f9
SHA512 6649d76de211eacac64f3b8be91c5d8d9b90415eced714f85621c41b8419d444f8c5bd1b5c20d0b6ba431b534ead3c9ca291b5ef33b82f158108813695b6665d

memory/3248-677-0x00000000041E0000-0x000000000422F000-memory.dmp

memory/3248-678-0x00000000041E0000-0x000000000422F000-memory.dmp

memory/3248-679-0x00000000041E0000-0x000000000422F000-memory.dmp

memory/3248-680-0x00000000041E0000-0x000000000422F000-memory.dmp

memory/3248-681-0x00000000041E0000-0x000000000422F000-memory.dmp

memory/3612-682-0x0000021E10110000-0x0000021E10111000-memory.dmp

memory/3612-684-0x0000021E10110000-0x0000021E10111000-memory.dmp

memory/3612-683-0x0000021E10110000-0x0000021E10111000-memory.dmp

memory/3612-694-0x0000021E10110000-0x0000021E10111000-memory.dmp

memory/3612-693-0x0000021E10110000-0x0000021E10111000-memory.dmp

memory/3612-692-0x0000021E10110000-0x0000021E10111000-memory.dmp

memory/3612-691-0x0000021E10110000-0x0000021E10111000-memory.dmp

memory/3612-690-0x0000021E10110000-0x0000021E10111000-memory.dmp

memory/3612-689-0x0000021E10110000-0x0000021E10111000-memory.dmp

memory/3612-688-0x0000021E10110000-0x0000021E10111000-memory.dmp