Malware Analysis Report

2024-11-15 08:37

Sample ID 240901-n2jvpazdkm
Target http://hi
Tags
agilenet credential_access discovery pyinstaller spyware stealer
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

Threat Level: Likely malicious

The file http://hi was found to be: Likely malicious.

Malicious Activity Summary

agilenet credential_access discovery pyinstaller spyware stealer

Credentials from Password Stores: Credentials from Web Browsers

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Obfuscated with Agile.Net obfuscator

Unsecured Credentials: Credentials In Files

Drops startup file

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Enumerates processes with tasklist

Detects Pyinstaller

Browser Information Discovery

Suspicious use of SetWindowsHookEx

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Enumerates system info in registry

NTFS ADS

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-01 11:53

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-01 11:53

Reported

2024-09-01 11:58

Platform

win10v2004-20240802-en

Max time kernel

298s

Max time network

302s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hi

Signatures

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Downloads MZ/PE file

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Moon Predictor V2 (1).exe C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Moon Predictor V2 (1).exe C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Moon Predictor V2 (1).exe C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Moon Predictor V2 (1).exe C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A
N/A N/A C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe N/A

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Browser Information Discovery

discovery

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{819F4A72-83A1-4696-9545-3BBE720A290F} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\Unconfirmed 179911.crdownload:SmartScreen C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Users\Admin\Downloads\Unconfirmed 409537.crdownload:SmartScreen C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Users\Admin\Downloads\Unconfirmed 905887.crdownload:SmartScreen C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4252 wrote to memory of 5088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 5088 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 1808 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 3564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 3564 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 2032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 2032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 2032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 2032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 2032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 2032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 2032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 2032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 2032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 2032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 2032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 2032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 2032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 2032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 2032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 2032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 2032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 2032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 2032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4252 wrote to memory of 2032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hi

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c68146f8,0x7ff9c6814708,0x7ff9c6814718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3232 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4152 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1984 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1768 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1816 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6920 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4808 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6396 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7060 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7448 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7160 /prefetch:8

C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe

"C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe"

C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe

"C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe

"C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe"

C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe

"C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe

"C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe"

C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe

"C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1352 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6688 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7240 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7232 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1500 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7244 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,7059314351861998760,12587488734880221017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7020 /prefetch:8

C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe

"C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe"

C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe

"C:\Users\Admin\Downloads\Moon Predictor V2 (1).exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "ver"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
GB 88.221.135.0:443 www.bing.com tcp
US 8.8.8.8:53 0.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 th.bing.com udp
GB 88.221.135.0:443 th.bing.com tcp
US 8.8.8.8:53 chromewebstore.google.com udp
GB 88.221.135.0:443 th.bing.com tcp
GB 88.221.135.0:443 th.bing.com tcp
GB 88.221.135.0:443 th.bing.com tcp
GB 88.221.135.0:443 th.bing.com tcp
GB 88.221.135.0:443 th.bing.com tcp
GB 88.221.135.0:443 th.bing.com tcp
GB 88.221.135.0:443 th.bing.com tcp
GB 216.58.204.78:443 chromewebstore.google.com tcp
GB 216.58.204.78:443 chromewebstore.google.com tcp
US 8.8.8.8:53 aefd.nelreports.net udp
GB 2.19.252.146:443 aefd.nelreports.net tcp
GB 2.19.252.146:443 aefd.nelreports.net tcp
US 8.8.8.8:53 lh3.googleusercontent.com udp
US 8.8.8.8:53 ssl.gstatic.com udp
US 8.8.8.8:53 78.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 146.252.19.2.in-addr.arpa udp
US 8.8.8.8:53 195.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.178.250.142.in-addr.arpa udp
GB 216.58.201.99:443 ssl.gstatic.com tcp
GB 142.250.187.193:443 lh3.googleusercontent.com tcp
GB 142.250.187.193:443 lh3.googleusercontent.com tcp
GB 142.250.187.193:443 lh3.googleusercontent.com tcp
GB 142.250.187.193:443 lh3.googleusercontent.com tcp
GB 142.250.187.193:443 lh3.googleusercontent.com tcp
GB 142.250.187.193:443 lh3.googleusercontent.com tcp
GB 216.58.201.99:443 ssl.gstatic.com tcp
GB 142.250.187.193:443 lh3.googleusercontent.com udp
US 8.8.8.8:53 193.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
GB 216.58.201.99:443 ssl.gstatic.com udp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.187.206:443 apis.google.com tcp
US 8.8.8.8:53 play.google.com udp
GB 216.58.204.78:443 chromewebstore.google.com udp
GB 172.217.16.238:443 play.google.com tcp
GB 172.217.16.238:443 play.google.com tcp
GB 142.250.187.206:443 apis.google.com tcp
GB 172.217.16.238:443 play.google.com udp
GB 172.217.16.234:443 ogads-pa.googleapis.com tcp
GB 142.250.187.206:443 apis.google.com udp
GB 172.217.16.234:443 ogads-pa.googleapis.com udp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 206.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 234.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 8.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 scone-pa.clients6.google.com udp
GB 142.250.180.10:443 scone-pa.clients6.google.com tcp
US 8.8.8.8:53 region1.google-analytics.com udp
US 216.239.34.36:443 region1.google-analytics.com tcp
US 216.239.34.36:443 region1.google-analytics.com tcp
GB 142.250.180.10:443 scone-pa.clients6.google.com udp
US 8.8.8.8:53 10.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 36.34.239.216.in-addr.arpa udp
US 216.239.34.36:443 region1.google-analytics.com udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
GB 88.221.135.0:443 th.bing.com tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 www.youtube.com udp
US 8.8.8.8:53 login.microsoftonline.com udp
US 8.8.8.8:53 services.bingapis.com udp
US 13.107.5.80:443 services.bingapis.com tcp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 80.5.107.13.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 8.8.8.8:53 github.githubassets.com udp
US 185.199.109.133:443 avatars.githubusercontent.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 8.8.8.8:53 user-images.githubusercontent.com udp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 185.199.108.133:443 user-images.githubusercontent.com tcp
US 185.199.108.133:443 user-images.githubusercontent.com tcp
US 8.8.8.8:53 133.109.199.185.in-addr.arpa udp
US 8.8.8.8:53 154.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 104.18.33.89:443 www2.bing.com tcp
US 104.18.33.89:443 www2.bing.com tcp
US 8.8.8.8:53 collector.github.com udp
US 140.82.112.22:443 collector.github.com tcp
US 185.199.108.154:443 github.githubassets.com tcp
US 8.8.8.8:53 api.github.com udp
US 140.82.112.22:443 collector.github.com tcp
GB 20.26.156.210:443 api.github.com tcp
US 8.8.8.8:53 89.33.18.104.in-addr.arpa udp
US 8.8.8.8:53 22.112.82.140.in-addr.arpa udp
US 8.8.8.8:53 210.156.26.20.in-addr.arpa udp
GB 2.19.252.146:443 aefd.nelreports.net udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 104.18.33.89:443 www2.bing.com tcp
US 104.18.33.89:443 www2.bing.com tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 133.110.199.185.in-addr.arpa udp
US 8.8.8.8:53 api.ipify.org udp
US 8.8.8.8:53 api.gofile.io udp
US 104.26.13.205:443 api.ipify.org tcp
FR 45.112.123.126:443 api.gofile.io tcp
US 104.26.13.205:443 api.ipify.org tcp
US 8.8.8.8:53 geolocation-db.com udp
DE 159.89.102.253:443 geolocation-db.com tcp
DE 159.89.102.253:443 geolocation-db.com tcp
US 8.8.8.8:53 126.123.112.45.in-addr.arpa udp
US 8.8.8.8:53 205.13.26.104.in-addr.arpa udp
US 104.26.13.205:443 api.ipify.org tcp
FR 45.112.123.126:443 api.gofile.io tcp
US 104.26.13.205:443 api.ipify.org tcp
DE 159.89.102.253:443 geolocation-db.com tcp
DE 159.89.102.253:443 geolocation-db.com tcp
US 104.26.13.205:443 api.ipify.org tcp
FR 45.112.123.126:443 api.gofile.io tcp
US 104.26.13.205:443 api.ipify.org tcp
DE 159.89.102.253:443 geolocation-db.com tcp
DE 159.89.102.253:443 geolocation-db.com tcp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 th.bing.com udp
GB 95.101.143.193:443 th.bing.com tcp
GB 88.221.135.11:443 th.bing.com tcp
US 8.8.8.8:53 193.143.101.95.in-addr.arpa udp
US 8.8.8.8:53 11.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 104.18.33.89:443 www2.bing.com tcp
US 104.18.33.89:443 www2.bing.com tcp
US 8.8.8.8:53 collector.github.com udp
US 140.82.113.21:443 collector.github.com tcp
US 8.8.8.8:53 api.github.com udp
GB 20.26.156.210:443 api.github.com tcp
US 8.8.8.8:53 21.113.82.140.in-addr.arpa udp
FR 45.112.123.126:443 api.gofile.io tcp
US 104.26.13.205:443 api.ipify.org tcp
DE 159.89.102.253:443 geolocation-db.com tcp
US 104.26.13.205:443 api.ipify.org tcp
DE 159.89.102.253:443 geolocation-db.com tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4dd2754d1bea40445984d65abee82b21
SHA1 4b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA256 183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
SHA512 92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

\??\pipe\LOCAL\crashpad_4252_MHFDETTMXASESLHI

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ecf7ca53c80b5245e35839009d12f866
SHA1 a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA256 882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
SHA512 706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8da66f9a375db4dc73a7316f283e7c0f
SHA1 e15f879f2d1a107b2fca3586d648c2044c1827dc
SHA256 81bb5473a995a67f5be327a0c0e7589982a7f984d53bf5377f21c5d182002cda
SHA512 3695cc1d715a37379c8320ce53f48bf2714feab01a47515fa92ff3e62c8d5f36f61dce928eac48d93cde13530e3ee59222c91c92433ef0a80f1035b8b8c34797

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 be186e5019e2c4aa59489b1172f063cf
SHA1 d3e31995a9085f472ff4255bed4a527e62aa3b5e
SHA256 8f579dceda09a57403fb8fbb27987ff37765eab527ae0151f58f650bbb3e7bd0
SHA512 465c8e66de3e8ab2de2540e1d4a4ad9112267610587be8d8d99c94ce4d2b871b6361c903db67ecafdfbc73e08b18e9b06bd2ca49857281ea60155826724d95ec

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2469d054-aa15-4d3b-b78d-0bf2c2d22d5c.tmp

MD5 f2fd696d9ed1a2af4a15056862728e46
SHA1 95e301c0cb8c441019911caa180f5dec6dcfae1f
SHA256 ae9a6feec1bba5b2fcd1fa2e4c4b2be479987d6d8b0164bb8023893582c9a2ec
SHA512 c140aa78c7c1b5f309decb9950fda070a573ef7fb682b3952fd557c127d617e11aee45fe678e36da8c160719e2955b679d7da8e3ea6eb34eda867ba04f905c46

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c10cf96fdedd9d5d60339e08c3321fa3
SHA1 7783397d1a92283bce35bb309d9892bd73d0c25d
SHA256 76acae0af6197578f3aea7ca7acacd597385d4bee420d9884d74488d64e4c802
SHA512 000bb9a93c71fa864a7e9567c868a27edc66ec85419e2ce0ea9a49c158ac969238473caef8ef4e748dc7f57da5203078cd2070deeb3cba3736557b705451efc8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

MD5 c3c0eb5e044497577bec91b5970f6d30
SHA1 d833f81cf21f68d43ba64a6c28892945adc317a6
SHA256 eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb
SHA512 83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

MD5 ed124bdf39bbd5902bd2529a0a4114ea
SHA1 b7dd9d364099ccd4e09fd45f4180d38df6590524
SHA256 48232550940208c572ebe487aa64ddee26e304ba3e310407e1fc31a5c9deed44
SHA512 c4d180292afa484ef9556d15db1d3850416a85ad581f6f4d5eb66654991fa90f414029b4ce13ed142271a585b46b3e53701735ee3e0f45a78b67baa9122ba532

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

MD5 f3d0a156d6ecb39d1805d60a28c8501d
SHA1 d26dd641e0b9d7c52b19bc9e89b53b291fb1915c
SHA256 e8be4436fcedf9737ea35d21ec0dcc36c30a1f41e02b3d40aa0bfa2be223a4a3
SHA512 076acfd19e4a43538f347ab460aa0b340a2b60d33f8be5f9b0ef939ef4e9f365277c4ff886d62b7edb20a299aacf50976321f9f90baba8ccd97bc5ac24a580bc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

MD5 710d7637cc7e21b62fd3efe6aba1fd27
SHA1 8645d6b137064c7b38e10c736724e17787db6cf3
SHA256 c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b
SHA512 19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

MD5 76a3f1e9a452564e0f8dce6c0ee111e8
SHA1 11c3d925cbc1a52d53584fd8606f8f713aa59114
SHA256 381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c
SHA512 a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

MD5 540af416cc54fd550dcdd8d00b632572
SHA1 644a9d1dfcf928c1e4ed007cd50c2f480a8b7528
SHA256 e4e53d750c57e4d92ab9de185bb37f5d2cc5c4fcc6a2be97386af78082115cbb
SHA512 7692e046e49fcde9c29c7d6ea06ed4f16216ec9fb7ea621d3cc4493364743c03925e74244785588d1a4bfc2bedd32b41e7e66e244990d4076e781d7f4bbb270f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

MD5 b38fbbd0b5c8e8b4452b33d6f85df7dc
SHA1 386ba241790252df01a6a028b3238de2f995a559
SHA256 b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd
SHA512 546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 4f791d02113903778a34b22a49fb9445
SHA1 3ed2cf579cd51320784452ce64d4228ded025037
SHA256 c777f2f6e4d4d1bad5ca2f5194c552c1767b0803ed0b2788cc8b99dcb8a495fa
SHA512 d3e8ac63683c8d5070559063bd8fb7c2ea0fefa70690468a1dc8969b5b5b90912ecd6ae60e4699524345c199c348ea8bb35720c98dd5e84315b0020b3401b974

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 5d9d62cda7234e5bc21e31d580c20e2d
SHA1 bc28f7fba074eb1403a65336f20bbaee9b7a18a1
SHA256 8f79f2f32ca8bee85ac52c5de8421d0db5a792801d9f90d67ccb6e4169ff1c40
SHA512 1c3c6537598d112f0fd21bfdbe9ece7d6676f2e289062ac6b78d785a9a536e835edeb7483aace0248a571cbb99f9141e63b8195b035985981f6e20987b1ddfe8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58500f.TMP

MD5 76c58dfa7b060f08403d0895ff611524
SHA1 5274a54c8c42ce1bdbb01c750913d15ce215aa2d
SHA256 dd841ab37f7c6dfc5ebaf1c9ba2169abf7c6d3c3e8ef96465b945270c463db88
SHA512 f8c8e71f80bc416f9073f4bb4469e1a9c5dd86b43eb004a229938c9768ea6f5880c925a8e2593f81e051fa3d0b01c683a78b6ca5ff81e38c0b484c5e50aa1ff9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7755d9f5-c2dc-406f-86c0-ffc671956e0f.tmp

MD5 03c2aec793d0c99f3fe9c68853b37ad8
SHA1 835d104c0de437c29d8e679c6d2667d2002d762c
SHA256 7da2e346a69ffd43b5360fa6a1f2acf14bfeb4faa8f90a45e07ea813f28fb5a0
SHA512 f9fa7a3751f5944ba6b44736beb319a9043ca6ae359d281f98c1bb792013358e5268c8255350a6cf055891de49f31dca835954b679b4225478823003fb4f3c2e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 aa2832bbb2872e9fc6028b8d4b20a619
SHA1 8b7e1d73db7cfd5da29e07027431b412b7319d52
SHA256 4045f47f90bc9abe5ef59ee09b0108404d88d3045b14adec9bba785601898469
SHA512 74e2c9c86cb1d431d6370be7ce47a2c96aa73fa2b274487e040a39fdc1fcb9757b90741916ccefea4015d547e88456b62d8d7afe42a4999425a5d939b4939300

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 d4e355a6f7426457b1ed95550acb5680
SHA1 40674b0616c1d089b103581e403a4c027292e134
SHA256 42f7e598d913c8d437a89ed1aa71e672b218052f8f974095b703f9520fdeb7c8
SHA512 b4bd7bb440af13b6e2fb36271d2cc0f28e928eec18af434821d813fef7b780c76e7fa8805381ee47cf9cdce7f5854e7421ba20a6c3e529e41dc401f0f150c353

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 8b468bf1d2dccdc666fca500c7c43cfc
SHA1 6acfbf67e130ef3e529222728cff0cd536506f35
SHA256 7a1bc5564b04a645753e9829bc80fc7c966b002e8e2374091fa136625bfed424
SHA512 1fbad097a66117002003fb6ea14b15195d8082fd346acc49b3c87d5c37383292db8baf4c09a13f25a6491bdd221e4606874284401a363d04949a944ab9579b90

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 5f4dedd1a03740254cb25e9554e8824d
SHA1 e64255efa5958d28b83bdaa937f047235965851a
SHA256 db9b95a75db45ea83799f75cd930cb246de6786993973328ba8052bff54e2488
SHA512 aa5b3d9802ba6184f84ae879f6af09f99a1b4510c0454f28eb9027409cf3b3434044c3174231fb780b546150e90a4ef96f3fce98b744f09157f7205aa28a13c3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 981d18ca5657fcad9823d5663d028741
SHA1 e91a4f87736e9a91c4adbf1d155bf3dda6d1c3c0
SHA256 908bc303e34c11773e4f7e478892d67ecce7512f5c71964184737dd46a307842
SHA512 07051c1944fa091a504167aebdbe3aaa83e9f1699d511f1740cded7b51fa90634326b3aa58eaff57dc43e5cbecd26f861fe79a5771aabf99469179e7e8f58c72

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 0831b5cc2641cc0386ccd35bc66f5833
SHA1 1248883e1144ff6b81088d16957c270bf8b7bdfd
SHA256 8dc958a0775480e38b806bb20eac271b31bef2601f0df6f0a634c608d2e16b40
SHA512 0d1b7047aef9146cd8a4ae6d4f722758d8b6bd9be65539b8917c4d54c9ea5b60576bd12aebe8d11945e23034a5d00b52c79b076d0d816d33071ba28cbfaa11bb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 08462cf0362f7f87efc4a777c1072a7e
SHA1 1d088ac31e26f0146ac9f8fb4c541e58edf59c72
SHA256 6cc72b702d6177d025c7bc5a7b8eb80f51988a6fce04c0e3ba87e36c3fd14a55
SHA512 b39f3f2091cd048de9a843032129a4e27ab3a981c7023cea5cd0e74b46b1e86270bf1000ed7fd5a21eb688575e44478d6a7e46f9a26de2fe47c6ad307a03f392

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000043

MD5 2e23d6e099f830cf0b14356b3c3443ce
SHA1 027db4ff48118566db039d6b5f574a8ac73002bc
SHA256 7238196a5bf79e1b83cacb9ed4a82bf40b32cd789c30ef790e4eac0bbf438885
SHA512 165b1de091bfe0dd9deff0f8a3968268113d95edc9fd7a8081b525e0910f4442cfb3b4f5ac58ecfa41991d9dcabe5aa8b69f7f1c77e202cd17dd774931662717

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 97979c14b10bc2a0476c665d7ec1bd8d
SHA1 6aa63a2ea196db0084e1f3ff64545ab8ae04877c
SHA256 3f9d4534db3d36c19d1ced44c5f59ffc65f1f060f0721f868feed7599ce49d83
SHA512 5d96b24606ddfa903bc4d2a2bf1e293f1044dfa1d91676c6b8b888143bb2727e8e8f33b3afea8b64e2d0c72ab8931e1b133670020f8fbda8078181297c7585a4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b9e2d0eff94963bf12a3e7e033854209
SHA1 a6b1e89f24b439cdc51e44ca2c5452f77fe23504
SHA256 665213db7d3061df2928c6e76265c56a71dedbef8073348ff7a0c24be74a18de
SHA512 c7f81cdfe0f50cf0626365b89129d5b54fda2cd22c17875854c122eb7c879fedfceaa443fef758328ecb3564a0be035154bee10978c309de06cf91565ee971d9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000048

MD5 b0ca864f370ce459aefa34bd5d1b433a
SHA1 4917d4e15e1f84e09ce8c59555b11e09bd8533f4
SHA256 c3b6214ef0277a056ac9726ddc1300f1bc05d3b0dc8d4044c710f5d2b8c968e9
SHA512 b99ab657af0471a7fff1b8479e8e70da25f629cd381e32d874f617d258d073ad5e23fb56909e3cf718269105dafa787768fa47ac41208fc1fea9216f1a0969eb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000049

MD5 8204ba87e201faf988861bfbd5505b94
SHA1 7e1051f5f9c33b95b265ffc2f8799fb3375c9cee
SHA256 12027957b89023392cc2bd4f79aa51e4d6f4ba99c91a9112cce58d384ac313be
SHA512 b848530ef8a546631ff7aaba065db429eac0682baa455e2c9f8381164af9e4b37d793cdecb9fc5e75b047dcf27440c761d979ae26cbd045e3de0034861eb33b0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000044

MD5 0bf07f12c1c5dd5952718e58d82c5e71
SHA1 676971edd706766162435f60bac58fbaa233a8b8
SHA256 259a012639a62bbf10b217ce04837da2f775151efc7eb06cf290fd53c2c5ae36
SHA512 9056b0f63e196013ea6fb599d00de7bf8c1476f2e02d74a13cc93f2d2b4c129ab0da2f52a2157fe44443a4fe92df2588423d3c38f4ab38b79e394e109b43e5b3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000045

MD5 1258482388f7b6ada91ecf01351b123b
SHA1 18256e690ade766d59600b2691b97c8d118e3226
SHA256 fa808cf05e8e516ea04fa76aff4c107391880ecdaa90bbaeec4de7252c241170
SHA512 5ab21602e28ead72808d3a4458f2f45397ab0b6e56e7eb6c00efc9335a96bb6a21def505f6fcd328079ded6422b3ed164f40803811de21c5749906d56d72a8eb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000042

MD5 9458c39229e65e93245ad6de284f2dde
SHA1 d5a728dba861ffd24bec6317f105e14cfba4b2ab
SHA256 dd563bbb62335aafae055c08891ba60e191ef343c71546db64a16c5e6c1dde48
SHA512 84c39acc38a17bf73fdec1bb6bd93a0654c5bd54fa4c13ccad2069ff7b759ac2999c7e099348a91a53afdd2cdc3f056a033db3cbd0dc552e6299fffdfba8373f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003f

MD5 94a66764d0bd4c1d12019dcd9b7d2385
SHA1 922ba4ccf5e626923c1821d2df022a11a12183aa
SHA256 341c78787e5c199fa3d7c423854c597fd51a0fc495b9fd8fed010e15c0442548
SHA512 f27ba03356072970452307d81632c906e4b62c56c76b56dfe5c7f0ea898ac1af6be50f91c29f394a2644040929548d186e0fbcea0106e80d9a6a74035f533412

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004a

MD5 e5b6deae3dea235b618f729a9cf8a51c
SHA1 f969da7bdab3d314300e83d0c290ef69ee41e33f
SHA256 592cbfd0085a910e7406af8689c7640b42329227391dc20b9fab16ef7cccd2b3
SHA512 35b0d04c0faa9073b096256f82aed4788d9c905ce1abdec3ace08140d9b661cbc3a1a4671ba964318f6a8b98f4204b14732788a330b7a76a2e98f9467c0d6bd4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000040

MD5 1abb5fcf0a5cde337f571d01815138ea
SHA1 5b497176ce92a000121468cfb8c73607ad8faa40
SHA256 61f6285f6d41defa47b4dc12183a4c43e76e69cc4927aa55c91904b1bb8502b4
SHA512 0082bad0d20696c64b23da3d802c300a7ec661687228f1cf025d6f7a8e3178ff1144636c2c2c2da3f809afa7239ffaa948488ef8d2afbba97bcec59eecf11e89

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000041

MD5 e35339c6c7ecfb6f905814a86caa7882
SHA1 2380f4be31da11f9730b20b1b209afdb42bf7f24
SHA256 3f2b391ce2229a0fd88b58ecd0e56b1113fbf27271411a28016394eac9df4984
SHA512 3cf03b85d72d40aa516d1be4315684f932437cc93fb332695fe069cd590b43c5e96c6b10208ec566c9db7875246f452b259e17ab567a4075ff484748070b8375

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000047

MD5 cfff8fc00d16fc868cf319409948c243
SHA1 b7e2e2a6656c77a19d9819a7d782a981d9e16d44
SHA256 51266cbe2741a46507d1bb758669d6de3c2246f650829774f7433bc734688a5a
SHA512 9d127abfdf3850998fd0d2fb6bd106b5a40506398eb9c5474933ff5309cdc18c07052592281dbe1f15ea9d6cb245d08ff09873b374777d71bbbc6e0594bde39b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000046

MD5 0ab3157f814a486195ba86bafc7eac95
SHA1 b5746e35a7ed4b1d781ece016456cac68298c20f
SHA256 f2ca3da125f7020f78c23e0aa60f2c21b66453ece0ba1cdf8ef5cc15345d3757
SHA512 8759fc18a4002f12ae3398f13984ca3e50573bfb7d8daa16cc03d6a8655ee22623eca05549e0a9b721dd13f7e08dc6275b9cefdd96c8250fbabad31e7834b881

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004d

MD5 a7fd1bce1b33874108faa673b185e4e0
SHA1 6ae246814ea7f9983d09798dce55e7dee3f278e3
SHA256 7bcccb182bc96564e7ecb5300ec605e39217f4cdf157f7a4d1ac8ea8b44def2a
SHA512 557c3655e266b756890b4ed5fbd2eb2fa44bd108f0388f4434866dc2d0fcdf3ecc5b576a65895a86ff4a00b977fea8c0f30618b621958c24639c7a9584d101d3

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

MD5 94e17094cf872d65a32c5532174e1f66
SHA1 ee543d3c278ca99fcff45e79fdb4b0bd7659104f
SHA256 414296ee11cc1fe46acdd322ad51170a0e117976e27a61dd6860382e6108a04a
SHA512 f7a24d1208d8bf73370c48e172081d8c3ac0fac30da3f9691fe5360da4b2105c31861e9ec8caa154fc58d42b8d78b5de73b1c1d84d0ecb57488655486e7fcda8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004b

MD5 531b54313c7e37aa9373ae02902938fc
SHA1 2f4216dba4074d48eda6f2ec432c6b36d53d131f
SHA256 ffa166b04c3e8ce908968d4029f32f26cf1d5adc49ae843d6992b8d3049af94b
SHA512 8fe11e78c01959370174c384d5cfad2a22ba1abf981deb74b8bcf5fc070250c80d75f6740e2455aada3037bfdef0ec4cd8558d4de5c5bf55a330e642f53956d5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004c

MD5 13c9fa26d781d5bfb4192b4d255dcfb8
SHA1 8d8c1fc8a9835aaafc017cd0ee2e41369ad3be8c
SHA256 d8f57272a95e48e67cefce9eeba43853e2cbd593b3fa7ff84624950e1238f8c3
SHA512 55229d8fd4f23f2ae243d30e7b6844f776e33402b1d00a9651539ea9d1ee014dd2f6096396ff4cb8c8674774463121876e6bc0dd68bccf172f19b9916c5b4b34

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 1c3651f37a81009435e090538809ddea
SHA1 ec4812be6b7a16c78ee16d5f6d274f31d745597f
SHA256 08610fb3fba9a8f0747deb92bbc6b76fab1d79ed337edaf5156ed5aa9c6476fa
SHA512 9a6dc28c8360f4aee77444d5bafa050bac9a619aa42f2668b6646b1e83f948aadf0a1de60887ed636c9bdfbfbcb5defcde2e3feaf8985d0f853e75a813233c9c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a143dc5aa4879d6c036b455526a0c002
SHA1 6a99825b99dda370379b0913c4f8d80d2b3163dc
SHA256 7eef781e009f2518c7f1c29827ca29e56180ee44610931b738b60f850e097f51
SHA512 da8fad21ef485bda087cb1aec7980f5bffdecfb2f825d787cdf45a12163ab742fd31dfd738b43074c1166527ef7927a882b7d1c1e8ca2d5546098a2b09b0f4e2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 1c708ad70b845226e492764f255d2815
SHA1 5055cc696fd13dccce6c41f07f1b05f5d4345b5c
SHA256 64396aceff48aaeb8ec3fd02f136fa22b6c6adaebd515402e6fb1ef372b86b65
SHA512 09987f688f67ac12155efee70ab96e4c047d238fd2c72f3fbcc22f639e960e6b269da4317d31988f28156a4a5ab30c0fc5c941ffc6ee0a29e025b9786da86c6d

C:\Users\Admin\Downloads\Unconfirmed 179911.crdownload

MD5 11afed49123fd774af33550dae13777a
SHA1 f02c2409c589f76a1639cef002dda5f7f538e98d
SHA256 07266653b14ff50a02d0be770e90e102d766cede26e92bd43eb61255c5931fca
SHA512 303d1eae5e242b0c831bf235705e57d0cb92c65387d7fe7279da364100f402c2212f48972cb6dbb64c951c704ebbd7af2081164bc8884b79064d2ba15e16fd55

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

MD5 e776b4b25923c6856da5d4211388cdd0
SHA1 b5251f4c3f0ac6bc3642c3bb8c4955a35031143e
SHA256 77e74207794f008c4834287a1846a7c318f2b7f9ea4117948a73afd2f12be37c
SHA512 d1bc6977f616816ab898c09e12ca3beacb99bade2f68894bea3d05bcacab32153578225119ddc778ce674889fdedf9ba06cdee001b244545a92c824ae1d66e79

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 2cc253e10fbb2105663cd541dcbd4d4a
SHA1 5acd8c7e155d8567808a18815c47db8c543ec5a0
SHA256 be121ad04af0dca28e3530cc945a3791e7bb5bfeee1ee3284c07f43299217d61
SHA512 89597e6baea99c9d4a9f7bf7e2beba80f8b0aebe33cd49c765bfe68ab73f0ce067db93033ecabac9302b70b368c66f56b667d26fa2021c8a7913a47eff1bdaeb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 816699b04774427de58833ec6628669a
SHA1 c453ef7ecc5c4a556c21bd4cb597f9883053b0ff
SHA256 4f3b2d5e4f45df6e6f5b171b1130292c5563d06df36a5e145220baf02807fb30
SHA512 61c07bffaa08507f466b2913af7d254ddd3006c54d2482d6083e075e291fda356a22319ec758166354eb0c5e7dc5e28e37383f41b0b0292c14911f882d0c99d3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 2c670f9ac0d4f64cb8dc5b65551ad442
SHA1 767e52fe6a60bbfa70a812ccb1537399bcec3a28
SHA256 db246413258513b0a6ab8045e0015a03a1a945d9ac9514f0116ceb87fc2a7d1d
SHA512 fdeccd221c5e49220b5c2a0f0bcc705e1cb6a1028808c584e806c9bd92208c727a1e268985307d17697158f107334ebf64dd8294f5c0a55d7a0e2ab5f4366746

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 57d6040ea814c29fe14210e83235f56c
SHA1 6fd4d2cb88fdb1fc45b38ca409cf9a981536150a
SHA256 a51bd50d284b65df048dad5914b131c34692358ded53e88951127ca080ca9f56
SHA512 02dc64ff440a1e24df916b31332f325975a4b5340acf7a674d5a3531c83287580e96dd30da1b040125824738829313a5ae97a9f7d7c1817157f96dfe88b1b471

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 085ffd901550e4be2c98b6639b8d5783
SHA1 44ce3cd643ad02ccd7f06cd8889e73c87b018940
SHA256 45b269130af54bfb9b9ac0bf4a10caf1f50fd6c6a2753f363c11dc189380094a
SHA512 92c0194c08e6d335106f475867427bdba66296514c678891d5ea2c29f9ad55d614a597d8118b318005eae0abbb4576264f7df67cca4089967f5b8da65d04ceb3

C:\Users\Admin\AppData\Local\Temp\_MEI41082\python310.dll

MD5 deaf0c0cc3369363b800d2e8e756a402
SHA1 3085778735dd8badad4e39df688139f4eed5f954
SHA256 156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d
SHA512 5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

C:\Users\Admin\AppData\Local\Temp\_MEI41082\VCRUNTIME140.dll

MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

C:\Users\Admin\AppData\Local\Temp\_MEI41082\base_library.zip

MD5 b942e4444e2adf75d28471eb3482b7d3
SHA1 5508f75e28a221fcc6b2d812c73a472a116da67a
SHA256 91e9454e232efa06df1ccd8831801fe1d99bc5fc597428fd7a6028a44209dda7
SHA512 bed23da3933fb2556493c758f0aafc835ebe9bf1e5309a9aeb60bfc7d7978950018991eb65a41243765d5bbfc5e151f4605ca51c7683f37e06ba6933fd4fb086

C:\Users\Admin\AppData\Local\Temp\_MEI41082\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

C:\Users\Admin\AppData\Local\Temp\_MEI41082\_lzma.pyd

MD5 0a94c9f3d7728cf96326db3ab3646d40
SHA1 8081df1dca4a8520604e134672c4be79eb202d14
SHA256 0a70e8546fa6038029f2a3764e721ceebea415818e5f0df6b90d6a40788c3b31
SHA512 6f047f3bdaead121018623f52a35f7e8b38c58d3a9cb672e8056a5274d02395188975de08cabae948e2cc2c1ca01c74ca7bc1b82e2c23d652e952f3745491087

C:\Users\Admin\AppData\Local\Temp\_MEI41082\_bz2.pyd

MD5 bbe89cf70b64f38c67b7bf23c0ea8a48
SHA1 44577016e9c7b463a79b966b67c3ecc868957470
SHA256 775fbc6e9a4c7e9710205157350f3d6141b5a9e8f44cb07b3eac38f2789c8723
SHA512 3ee72ba60541116bbca1a62db64074276d40ad8ed7d0ca199a9c51d65c3f0762a8ef6d0e1e9ebf04bf4efe1347f120e4bc3d502dd288339b4df646a59aad0ec1

C:\Users\Admin\AppData\Local\Temp\_MEI41082\_ctypes.pyd

MD5 ca4cef051737b0e4e56b7d597238df94
SHA1 583df3f7ecade0252fdff608eb969439956f5c4a
SHA256 e60a2b100c4fa50b0b144cf825fe3cde21a8b7b60b92bfc326cb39573ce96b2b
SHA512 17103d6b5fa84156055e60f9e5756ffc31584cdb6274c686a136291c58ba0be00238d501f8acc1f1ca7e1a1fadcb0c7fefddcb98cedb9dd04325314f7e905df3

C:\Users\Admin\AppData\Local\Temp\_MEI41082\_socket.pyd

MD5 0f5e64e33f4d328ef11357635707d154
SHA1 8b6dcb4b9952b362f739a3f16ae96c44bea94a0e
SHA256 8af6d70d44bb9398733f88bcfb6d2085dd1a193cd00e52120b96a651f6e35ebe
SHA512 4be9febb583364da75b6fb3a43a8b50ee29ca8fc1dda35b96c0fcc493342372f69b4f27f2604888bca099c8d00f38a16f4c9463c16eff098227d812c29563643

C:\Users\Admin\AppData\Local\Temp\_MEI41082\select.pyd

MD5 c119811a40667dca93dfe6faa418f47a
SHA1 113e792b7dcec4366fc273e80b1fc404c309074c
SHA256 8f27cd8c5071cb740a2191b3c599e99595b121f461988166f07d9f841e7116b7
SHA512 107257dbd8cf2607e4a1c7bef928a6f61ebdfc21be1c4bdc3a649567e067e9bb7ea40c0ac8844d2cedd08682447b963148b52f85adb1837f243df57af94c04b3

C:\Users\Admin\AppData\Local\Temp\_MEI41082\pyexpat.pyd

MD5 43e5a1470c298ba773ac9fcf5d99e8f9
SHA1 06db03daf3194c9e492b2f406b38ed33a8c87ab3
SHA256 56984d43be27422d31d8ece87d0abda2c0662ea2ff22af755e49e3462a5f8b65
SHA512 a5a1ebb34091ea17c8f0e7748004558d13807fdc16529bc6f8f6c6a3a586ee997bf72333590dc451d78d9812ef8adfa7deabab6c614fce537f56fa38ce669cfc

C:\Users\Admin\AppData\Local\Temp\_MEI41082\_queue.pyd

MD5 52d0a6009d3de40f4fa6ec61db98c45c
SHA1 5083a2aff5bcce07c80409646347c63d2a87bd25
SHA256 007bcf19d9b036a7e73f5ef31f39bfb1910f72c9c10e4a1b0658352cfe7a8b75
SHA512 cd552a38efaa8720a342b60318f62320ce20c03871d2e50d3fa3a9a730b84dacdbb8eb4d0ab7a1c8a97215b537826c8dc532c9a55213bcd0c1d13d7d8a9ad824

C:\Users\Admin\AppData\Local\Tempcrunrhcwye.db

MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

C:\Users\Admin\AppData\Local\Tempcruohgumkh.db

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\Users\Admin\AppData\Local\Temp\crpassw.txt

MD5 155ea3c94a04ceab8bd7480f9205257d
SHA1 b46bbbb64b3df5322dd81613e7fa14426816b1c1
SHA256 445e2bcecaa0d8d427b87e17e7e53581d172af1b9674cf1a33dbe1014732108b
SHA512 3d47449da7c91fe279217a946d2f86e5d95d396f53b55607ec8aca7e9aa545cfaf9cb97914b643a5d8a91944570f9237e18eecec0f1526735be6ceee45ecba05

C:\Users\Admin\AppData\Local\Tempcrcfucggyg.db

MD5 a603e09d617fea7517059b4924b1df93
SHA1 31d66e1496e0229c6a312f8be05da3f813b3fa9e
SHA256 ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7
SHA512 eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 0346cf34d59d5d6253074119ee916af6
SHA1 fd62800296dfec737d89b1591d4471fd8d7e1843
SHA256 13716f5102174349e3f7626b1ce4a213082635cf0e43519ec19517960d5f4236
SHA512 cb3bb124300381aa358429c48d1165036f44a6e3295718f21c9a50616cc5a2afd9fbcaf76e6d909b1e11fa6fbf08947ad777bef779d63aa569496c5edc4451fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 bca967502963d6d096e282abecf27030
SHA1 b8dcaa9603e40ea311cec09333a6ba1336608cf3
SHA256 81886c5a6fa9d3c8f41c98f885a3276979c5a624d7cffe9f7634462ba4dce975
SHA512 76ba0110d717ef19406297341756ae982c2636814dbb49074f2636cbab080a53397a5166d9d03e2b309900d6482f0889ba18f820e2efbbfc659c91df854abbfd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038

MD5 209af4da7e0c3b2a6471a968ba1fc992
SHA1 2240c2da3eba4f30b0c3ef2205ce7848ecff9e3f
SHA256 ecc145203f1c562cae7b733a807e9333c51d75726905a3af898154f3cefc9403
SHA512 09201e377e80a3d03616ff394d836c85712f39b65a3138924d62a1f3ede3eac192f1345761c012b0045393c501d48b5a774aeda7ab5d687e1d7971440dc1fc35

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a

MD5 cf604c923aae437f0acb62820b25d0fd
SHA1 84db753fe8494a397246ccd18b3bb47a6830bc98
SHA256 e2b4325bb9a706cbfba8f39cca5bde9dae935cbb1d6c8a562c62e740f2208ab4
SHA512 754219b05f2d81d11f0b54e5c7dd687bd82aa59a357a3074bca60fefd3a88102577db8ae60a11eb25cc9538af1da39d25fa6f38997bdc8184924d0c5920e89c8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005a

MD5 5cb3affdd94fbe4985dde03f19cc76d1
SHA1 4531169ecf60818251222dca42007cc80ddaf9c9
SHA256 010ef749118b138778650df0311f1118322a75452bd3b2b7da607f7408b6b771
SHA512 01dfdf471235d91abe06426e8017a92b793923824ebda4912f0012f6085d8865a0d69c447db782d40530b33d4af29ff111ca29a19996b5139a456bbc7ebcac66

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003d

MD5 1de4708beee6992745a7c14b7d8580da
SHA1 03bb2b7dd07f1701da7cf19b68dd23a2b298827b
SHA256 ba0ecf05941451756a9acfc7a913e64dd56ddee8f3811c8a9f1cdd0a219ad64b
SHA512 5d21cd342f3f70a7dc4bdd3b100e6677e74a7fec22af3ffc9d048618d1daeb5dc5e3f1511ffaa2fddf2f3e49b31351d7d4613f7f03e21d2b609483ad6aab9c86

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 5b4bc8652d24db89927ebc7a05dcb365
SHA1 5c1a0934eac6e8adf8cbeb2b1700b51a0bab0bf4
SHA256 4f66c9e7de358a821444c40fa5496ff047df10e505260ff2e1f0bb8b41d00875
SHA512 d5cc665357f971605876ab11b220c050c061a6e8e1b8e978ab782e9b288e385f11e95085c81b721438e58163420d711ca8c7085a5cd3db9c5b7dbbdee114b49c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 fac2736a998f8969bb95ac5ddac622ab
SHA1 a0a3d1f4735753bd66bcc398003307f03d7a2c61
SHA256 198b6fe15798e9da7361efc5b087a6ebd61af8864ac7118befcb9b1fc169effe
SHA512 33af38e186b0c16925ff281956183cff4b7836a1ff6be5e00757dc30231776fd57e7a397673235b3ee709cc13e4c18e30b516aad1a9f422d41b29ff800afb7c8

C:\Users\Admin\Downloads\Unconfirmed 409537.crdownload

MD5 8cd9953ff0283305f3998f6893c7d244
SHA1 db906639e1b164bb813e3e94e548a4c5549bd36e
SHA256 0a3f02ad6a8f319b352f4ab3222bd57d9699882db065fb344b9828243b1d0015
SHA512 3121712026e63ae2c9df423c24511249895e773a5e56f3fd19dff89eefe58042c990afcd7ffba21bf9f181045b9b4d9f439c7e69114f0f9282adbd707558e133

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 5882171195a41cd70a2e9380e0c9c8a1
SHA1 3c90dc367cfaee4ab338c906f122112d3f4bcc1d
SHA256 ae2df832791e3cb643d8b9a8f1c1af5793f9fa43ee75c6b78dcd15e28a4116bb
SHA512 155ef659be298fd3310490541ed76293ffa24211bb475aa6ad880090b9fb6000692cbe8ba918808bca4c157b26219269e68a44aae4aa8dc1f223ab8683b4228e

C:\Users\Admin\Downloads\Unconfirmed 905887.crdownload

MD5 b7cf1039d089511ff4594d0796dc966b
SHA1 e41d50c48f5381da01ed43967d1024fdaaeedd81
SHA256 9143707613cfa106fc4d7177e6e9f8a544738989b6167cd6578101f1bdb0927a
SHA512 6627a7a810c78a94ff1d52b14d071f8aabd71a2e6b521d2fcea7d865d94f5bcb1dd890f1b93b292035b20127507e32c11c215268e00510e5bf28c6132a4ce2a4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 48fe440177ec3c12daec06603a46d7ec
SHA1 d45102ad85563e6841ad51d5796d6d30f8a3b60a
SHA256 0144ddd311250abfaa82f4e9ac93d227ed5f7036d1782937e4e7607e2ea76112
SHA512 6e24ef63b9f28b8fd5aa47a4c1c52e4e193fc32155ccc8b5f0de487d50252c30b2ceb394abc0df5998a8c6831463aa0218fbbbbc1f4448fea5daa7923086e877

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 7b0167756eea481a3061e42375622cd9
SHA1 ad97152ff63eaeb2d885c09b92f49e50075e563a
SHA256 a484c310393c729a1155429c1310b0f03d6c5055767b6bd9962e6a0e4d7ee70f
SHA512 c1dbece59afa78c84d55d27ceefc62a6bedf58774167dee6b615473059cc27822236abe4bcb9327d65a4b31bca6287d79974c576c0171b67def9244b56cb5085

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 22a0c2fbe6d7d4924a00c6f63195f1e3
SHA1 18c2b709c273905d123fc98221c4de73cce5ea55
SHA256 68f105e3a636c7f9cd55f4e121a40a3f2b230c06183f81ac81be95cfecf8afbf
SHA512 91f4288ad163d5217f544218cb967b1530450d237957fdeff07552047ed281c94acd4c006e548a17ff8e27f3261944d80ccfe78883e5f723dc7e51f26f34ccd1