Malware Analysis Report

2025-06-16 00:36

Sample ID 241111-ahs3csycph
Target http://wearedevs.net
Tags
discovery evasion execution persistence phishing privilege_escalation trojan
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

Threat Level: Likely malicious

The file http://wearedevs.net was found to be: Likely malicious.

Malicious Activity Summary

discovery evasion execution persistence phishing privilege_escalation trojan

Event Triggered Execution: Image File Execution Options Injection

Blocklisted process makes network request

Downloads MZ/PE file

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Event Triggered Execution: Component Object Model Hijacking

A potential corporate email address has been identified in the URL: [email protected]

A potential corporate email address has been identified in the URL: httpswww.youtube.com@Omnidevsubconfirmation1cbrd1

Executes dropped EXE

Checks computer location settings

Network Share Discovery

Checks installed software on the system

Checks whether UAC is enabled

Legitimate hosting services abused for malware hosting/C2

Enumerates connected drives

Checks system information in the registry

Drops file in Windows directory

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Browser Information Discovery

System Network Configuration Discovery: Internet Connection Discovery

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Uses Volume Shadow Copy service COM API

Enumerates system info in registry

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

System policy modification

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-11 00:13

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-11 00:13

Reported

2024-11-11 00:24

Platform

win10v2004-20241007-en

Max time kernel

557s

Max time network

556s

Command Line

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://wearedevs.net

Signatures

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\MicrosoftEdgeUpdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\MicrosoftEdgeUpdate.exe N/A

A potential corporate email address has been identified in the URL: httpswww.youtube.com@Omnidevsubconfirmation1cbrd1

phishing

A potential corporate email address has been identified in the URL: [email protected]

phishing

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A

Event Triggered Execution: Component Object Model Hijacking

persistence privilege_escalation

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\MicrosoftEdge_X64_130.0.2849.80.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\JJSploit\JJSploit.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Y: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\F: C:\Program Files\JJSploit\JJSploit.exe N/A
File opened (read-only) \??\H: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Network Share Discovery

discovery

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\onnxruntime.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\Locales\ru.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\concrt140.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Locales\fr-CA.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\msedge_200_percent.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\EdgeWebView.dat C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\Locales\bg.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\Locales\uk.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\identity_proxy\win10\identity_helper.Sparse.Dev.msix C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Trust Protection Lists\Mu\TransparentAdvertisers C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Locales\hr.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\EBWebView\x86\EmbeddedBrowserWebView.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Locales\kok.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\telclient.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping1628_1574363644\hyph-de-1901.hyb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping1628_1574363644\hyph-hy.hyb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_fil.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\AdSelectionAttestationsPreloaded\ad-selection-attestations.dat C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\BHO\ie_to_edge_bho.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\BHO\ie_to_edge_bho_64.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\Locales\eu.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping1628_1574363644\hyph-as.hyb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Trust Protection Lists\Sigma\Social C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\msvcp140.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\edge_game_assist\VERSION C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\Trust Protection Lists\Sigma\Social C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping1628_604297579\LICENSE C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_ja.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\identity_proxy\win10\identity_helper.Sparse.Internal.msix C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\identity_proxy\win11\identity_helper.Sparse.Internal.msix C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Locales\ur.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\Locales\sr.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping1628_1574363644\hyph-et.hyb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\msedge_elf.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\msedge_200_percent.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\msedge_elf.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\BHO\ie_to_edge_stub.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Locales\id.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_ca-Es-VALENCIA.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_tt.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Locales\sr-Cyrl-BA.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Locales\ar.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\microsoft_shell_integration.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Trust Protection Lists\Mu\Social C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Locales\ga.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_en.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_sr-Latn-RS.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\identity_proxy\win11\identity_helper.Sparse.Stable.msix C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Locales\sk.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Locales\az.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Locales\tt.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\Locales\ro.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping1628_1574363644\hyph-pa.hyb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_en-GB.dll C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\130.0.2849.80.manifest C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\edge_feedback\mf_trace.wprp C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source5500_1729270410\msedge_7z.data C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping1628_1574363644\hyph-sq.hyb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping1628_1574363644\hyph-und-ethi.hyb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Locales\et.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\Trust Protection Lists\Sigma\Content C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\Locales\ug.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\msedge_pwa_launcher.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Locales\nl.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\{ED32CE98-14F7-4B25-AD97-7F0034775067}\ProductIcon C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5c53a8.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5c53a6.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e5c53a6.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{ED32CE98-14F7-4B25-AD97-7F0034775067} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI5490.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\{ED32CE98-14F7-4B25-AD97-7F0034775067}\ProductIcon C:\Windows\system32\msiexec.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\MicrosoftEdgeUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001a73a27760024bf60000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001a73a2770000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809001a73a277000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1a73a277000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001a73a27700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133757576956085281" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc\ = "Microsoft Edge Update Legacy On Demand" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\PROGID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods\ = "9" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\LocalService = "edgeupdatem" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine.1.0\CLSID\ = "{5F6A18BB-6231-424B-8242-19E5BB94F8ED}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1B5BE67603097495AB20AEE6179D01CA C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{35725228-BF11-429E-B5B8-ED0F2BCABF82}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\CLSID\ = "{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C76C02A1-BCDF-4632-88E6-55698920001E}\InprocHandler32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.31\\psmachine.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32\ = "{35725228-BF11-429E-B5B8-ED0F2BCABF82}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\89EC23DE7F4152B4DA79F70043770576\SourceList\PackageName = "JJSploit_8.10.12_x64_en-US.msi" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebSvc\ = "Microsoft Edge Update Update3Web" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32\ = "{35725228-BF11-429E-B5B8-ED0F2BCABF82}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods\ = "16" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{35725228-BF11-429E-B5B8-ED0F2BCABF82}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ = "IGoogleUpdate3WebSecurity" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\89EC23DE7F4152B4DA79F70043770576\AdvertiseFlags = "388" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C76C02A1-BCDF-4632-88E6-55698920001E}\InprocHandler32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.31\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods\ = "8" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32\ = "{35725228-BF11-429E-B5B8-ED0F2BCABF82}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\ = "ServiceModule" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ = "ICredentialDialog" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ = "IJobObserver2" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.Update3COMClassService" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods\ = "10" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32\ = "{35725228-BF11-429E-B5B8-ED0F2BCABF82}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ProgID\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\ProgID\ = "MicrosoftEdgeUpdate.Update3COMClassService.1.0" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\PROGID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ = "ICredentialDialog" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ProgID\ = "MicrosoftEdgeUpdate.PolicyStatusSvc.1.0" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\PROGID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ = "ICoCreateAsyncStatus" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.31\\msedgeupdate.dll,-3000" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Windows\System32\msiexec.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A
N/A N/A C:\Windows\System32\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\JJSploit\JJSploit.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5032 wrote to memory of 4500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4500 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 4488 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 1504 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 1504 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5032 wrote to memory of 3092 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://wearedevs.net

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa173acc40,0x7ffa173acc4c,0x7ffa173acc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2060,i,14837452294838376175,16396753977724010251,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2056 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1856,i,14837452294838376175,16396753977724010251,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2096 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2248,i,14837452294838376175,16396753977724010251,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2216 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3028,i,14837452294838376175,16396753977724010251,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3064 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3032,i,14837452294838376175,16396753977724010251,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3248 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4472,i,14837452294838376175,16396753977724010251,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4452 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4668,i,14837452294838376175,16396753977724010251,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3248 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4800,i,14837452294838376175,16396753977724010251,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4824 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1432,i,14837452294838376175,16396753977724010251,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2768 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=2968,i,14837452294838376175,16396753977724010251,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4908 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5032,i,14837452294838376175,16396753977724010251,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4924 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5488,i,14837452294838376175,16396753977724010251,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5288 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5472,i,14837452294838376175,16396753977724010251,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5436 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4460,i,14837452294838376175,16396753977724010251,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4712 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4840,i,14837452294838376175,16396753977724010251,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5208 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=3524,i,14837452294838376175,16396753977724010251,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4824 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5936,i,14837452294838376175,16396753977724010251,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5908 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\System32\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\JJSploit_8.10.12_x64_en-US.msi"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 796E1DE6A86FAE09277AC101BF6315F9 C

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\srtasks.exe

C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -Wait

C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe

"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /silent /install

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEVBNjFDMkUtNDQ5MS00NjQyLUIxM0YtMjcyMTM5NDRGRkVBfSIgdXNlcmlkPSJ7OTA1OTQ2RkQtMEMxRC00NjExLUE0NjAtRkE5NTg4REY2QzY1fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins5Nzc3QjgxNC0wRkRBLTQyNzQtODlGQS02OUU3QzY4MTk0Mjh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDcuMzciIG5leHR2ZXJzaW9uPSIxLjMuMTk1LjMxIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3OTIzODgzNDcyIiBpbnN0YWxsX3RpbWVfbXM9IjQ4OCIvPjwvYXBwPjwvcmVxdWVzdD4

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{8EA61C2E-4491-4642-B13F-27213944FFEA}" /silent

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEVBNjFDMkUtNDQ5MS00NjQyLUIxM0YtMjcyMTM5NDRGRkVBfSIgdXNlcmlkPSJ7OTA1OTQ2RkQtMEMxRC00NjExLUE0NjAtRkE5NTg4REY2QzY1fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NzE4NDVEMjEtRDc2Qi00QzFFLUJDMEEtREUzN0EzMjAzOThGfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMzQiIGluc3RhbGxkYXRldGltZT0iMTcyODI5MzQwMCIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzcyNzY2MDc1NjYxMDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc5Mjg1NzA4NzAiLz48L2FwcD48L3JlcXVlc3Q-

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\MicrosoftEdge_X64_130.0.2849.80.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\MicrosoftEdge_X64_130.0.2849.80.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\MicrosoftEdge_X64_130.0.2849.80.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9B88F434-4884-4D7F-8B27-003519D38582}\EDGEMITMP_338BB.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=130.0.2849.80 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff784ecd730,0x7ff784ecd73c,0x7ff784ecd748

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEVBNjFDMkUtNDQ5MS00NjQyLUIxM0YtMjcyMTM5NDRGRkVBfSIgdXNlcmlkPSJ7OTA1OTQ2RkQtMEMxRC00NjExLUE0NjAtRkE5NTg4REY2QzY1fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBMjZEMDcyRi1GNkM1LTQ3NTAtOERGNy1BN0IwNTcwNjlBNjR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTMwLjAuMjg0OS44MCIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzk0MzQxNDcxNyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc5NDM1NzEwNzUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MTQwMjg5NjI5IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8yN2NiNzI5ZC1mZjk0LTRkMzQtYWFlNC0zMzg1ZmEwOWM0NGM_UDE9MTczMTg4OTIwNiZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1aOWJ3bTJ0c21oSlI4elFWT1c0NXlmNHJjVmx3empZVzFpQ2xzVUhsbjJxMiUyZkhqNzRGVEFQV1pJQUZMeklzMFlPUFIzdmRiSEhpUXBPVkZibm5QSkNRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTc1MDc2OTIwIiB0b3RhbD0iMTc1MDc2OTIwIiBkb3dubG9hZF90aW1lX21zPSIxMzIzNCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjgxNDA0NDU4OTIiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MTU1OTE0NzY2IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NzU4MDA3MjE0IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMTA3OCIgZG93bmxvYWRfdGltZV9tcz0iMTk2NzIiIGRvd25sb2FkZWQ9IjE3NTA3NjkyMCIgdG90YWw9IjE3NTA3NjkyMCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNjAyMDkiLz48L2FwcD48L3JlcXVlc3Q-

C:\Program Files\JJSploit\JJSploit.exe

"C:\Program Files\JJSploit\JJSploit.exe"

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.12 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5628.4884.6608813380900437272

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=130.0.6723.117 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=130.0.2849.80 --initial-client-data=0x15c,0x160,0x164,0x138,0x170,0x7ffa028a4dc0,0x7ffa028a4dcc,0x7ffa028a4dd8

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1828,i,6573176212168244233,14298699422539804040,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1824 /prefetch:2

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=1988,i,6573176212168244233,14298699422539804040,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:3

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2324,i,6573176212168244233,14298699422539804040,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:8

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=renderer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3492,i,6573176212168244233,14298699422539804040,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mboost.me/a/P?altId=VxNYy67bGcdHY9B7

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa011846f8,0x7ffa01184708,0x7ffa01184718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6736 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6920 /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x4a4 0x154

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7516 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7480 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7420 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4824,i,6573176212168244233,14298699422539804040,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7872 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7912 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,15691758412334379254,16407437814633319235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7500 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=6064,i,14837452294838376175,16396753977724010251,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5576 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5888,i,14837452294838376175,16396753977724010251,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5948 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5556,i,14837452294838376175,16396753977724010251,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5548 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6232,i,14837452294838376175,16396753977724010251,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5620 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5620,i,14837452294838376175,16396753977724010251,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6008 /prefetch:1

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=752,i,6573176212168244233,14298699422539804040,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:8

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=4672,i,6573176212168244233,14298699422539804040,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:8

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=5032,i,6573176212168244233,14298699422539804040,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=4664,i,14837452294838376175,16396753977724010251,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5712 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5852,i,14837452294838376175,16396753977724010251,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4776 /prefetch:8

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4812,i,6573176212168244233,14298699422539804040,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:8

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4472,i,6573176212168244233,14298699422539804040,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\130.0.2849.80\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=JJSploit.exe --webview-exe-version=8.10.12 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4328,i,6573176212168244233,14298699422539804040,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 wearedevs.net udp
US 104.26.7.147:80 wearedevs.net tcp
US 104.26.7.147:80 wearedevs.net tcp
US 104.26.7.147:443 wearedevs.net tcp
US 104.26.7.147:443 wearedevs.net udp
US 8.8.8.8:53 cdn.wearedevs.net udp
US 8.8.8.8:53 147.7.26.104.in-addr.arpa udp
US 8.8.8.8:53 234.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.135.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
GB 216.58.212.226:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 region1.analytics.google.com udp
US 8.8.8.8:53 stats.g.doubleclick.net udp
US 8.8.8.8:53 www.google.co.uk udp
GB 216.58.204.67:443 www.google.co.uk tcp
BE 66.102.1.155:443 stats.g.doubleclick.net tcp
US 216.239.34.36:443 region1.analytics.google.com tcp
US 8.8.8.8:53 fundingchoicesmessages.google.com udp
GB 142.250.178.14:443 fundingchoicesmessages.google.com tcp
US 8.8.8.8:53 10.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 200.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 233.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 2.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 67.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 226.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 155.1.102.66.in-addr.arpa udp
US 8.8.8.8:53 36.34.239.216.in-addr.arpa udp
US 8.8.8.8:53 238.187.250.142.in-addr.arpa udp
GB 142.250.178.14:443 fundingchoicesmessages.google.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
GB 142.250.178.14:443 fundingchoicesmessages.google.com udp
GB 216.58.204.65:443 lh3.googleusercontent.com tcp
US 8.8.8.8:53 14.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 65.204.58.216.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 google.com udp
GB 142.250.200.14:443 google.com tcp
GB 142.250.178.14:443 fundingchoicesmessages.google.com udp
GB 142.250.178.14:443 fundingchoicesmessages.google.com udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 ep1.adtrafficquality.google udp
GB 216.58.201.98:443 ep1.adtrafficquality.google tcp
GB 216.58.201.98:443 ep1.adtrafficquality.google tcp
GB 216.58.201.98:443 ep1.adtrafficquality.google tcp
GB 216.58.201.98:443 ep1.adtrafficquality.google tcp
GB 216.58.201.98:443 ep1.adtrafficquality.google tcp
GB 216.58.201.98:443 ep1.adtrafficquality.google tcp
GB 142.250.200.14:443 google.com udp
GB 216.58.201.98:443 ep1.adtrafficquality.google tcp
US 8.8.8.8:53 ep2.adtrafficquality.google udp
GB 142.250.179.225:443 ep2.adtrafficquality.google tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.179.225:443 ep2.adtrafficquality.google tcp
GB 142.250.179.228:443 www.google.com tcp
US 8.8.8.8:53 csp.withgoogle.com udp
GB 216.58.204.81:443 csp.withgoogle.com tcp
GB 216.58.201.98:443 ep1.adtrafficquality.google udp
US 8.8.8.8:53 98.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 225.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 228.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 81.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 tpc.googlesyndication.com udp
GB 172.217.169.33:443 tpc.googlesyndication.com tcp
GB 172.217.169.33:443 tpc.googlesyndication.com tcp
GB 172.217.169.33:443 tpc.googlesyndication.com tcp
GB 172.217.169.33:443 tpc.googlesyndication.com tcp
GB 172.217.169.33:443 tpc.googlesyndication.com tcp
GB 172.217.169.33:443 tpc.googlesyndication.com tcp
GB 142.250.179.228:443 www.google.com udp
GB 142.250.179.225:443 ep2.adtrafficquality.google udp
US 216.239.34.36:443 region1.analytics.google.com udp
US 8.8.8.8:53 www.google.co.uk udp
GB 216.58.204.67:443 www.google.co.uk udp
US 8.8.8.8:53 ad.turn.com udp
US 8.8.8.8:53 dclk-match.dotomi.com udp
US 8.8.8.8:53 pm.w55c.net udp
US 8.8.8.8:53 match.adsrvr.org udp
US 8.8.8.8:53 tr.blismedia.com udp
US 8.8.8.8:53 ads.travelaudience.com udp
US 8.8.8.8:53 creativecdn.com udp
US 8.8.8.8:53 cm.g.doubleclick.net udp
US 52.223.40.198:443 match.adsrvr.org tcp
US 34.96.105.8:443 tr.blismedia.com tcp
NL 89.207.16.140:443 dclk-match.dotomi.com tcp
NL 185.184.8.90:443 creativecdn.com tcp
US 35.190.0.66:443 ads.travelaudience.com tcp
NL 46.228.164.11:443 ad.turn.com tcp
IE 99.80.216.230:443 pm.w55c.net tcp
GB 142.250.180.2:443 cm.g.doubleclick.net tcp
GB 142.250.180.2:443 cm.g.doubleclick.net udp
US 8.8.8.8:53 r.turn.com udp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 33.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 8.105.96.34.in-addr.arpa udp
US 8.8.8.8:53 66.0.190.35.in-addr.arpa udp
US 8.8.8.8:53 140.16.207.89.in-addr.arpa udp
US 8.8.8.8:53 90.8.184.185.in-addr.arpa udp
US 8.8.8.8:53 11.164.228.46.in-addr.arpa udp
US 8.8.8.8:53 2.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 198.40.223.52.in-addr.arpa udp
US 8.8.8.8:53 230.216.80.99.in-addr.arpa udp
GB 216.58.201.98:443 ep1.adtrafficquality.google udp
US 104.26.7.147:443 cdn.wearedevs.net udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 8.8.8.8:53 cdnjs.cloudflare.com udp
GB 216.58.201.98:443 ep1.adtrafficquality.google tcp
US 151.101.65.229:443 cdn.jsdelivr.net tcp
US 151.101.65.229:443 cdn.jsdelivr.net tcp
US 104.17.24.14:443 cdnjs.cloudflare.com tcp
US 8.8.8.8:53 14.24.17.104.in-addr.arpa udp
US 8.8.8.8:53 229.65.101.151.in-addr.arpa udp
US 8.8.8.8:53 cms.quantserve.com udp
US 8.8.8.8:53 a.tribalfusion.com udp
US 8.8.8.8:53 dis.criteo.com udp
NL 178.250.1.9:443 dis.criteo.com tcp
US 104.18.37.193:443 a.tribalfusion.com tcp
DE 91.228.74.244:443 cms.quantserve.com tcp
GB 172.217.169.33:443 tpc.googlesyndication.com udp
US 8.8.8.8:53 s.tribalfusion.com udp
GB 216.58.201.98:443 ep1.adtrafficquality.google udp
GB 216.58.204.81:443 csp.withgoogle.com udp
US 8.8.8.8:53 193.37.18.104.in-addr.arpa udp
US 8.8.8.8:53 244.74.228.91.in-addr.arpa udp
US 8.8.8.8:53 9.1.250.178.in-addr.arpa udp
US 151.101.65.229:443 cdn.jsdelivr.net udp
US 104.17.24.14:443 cdnjs.cloudflare.com udp
US 8.8.8.8:53 s0.2mdn.net udp
GB 172.217.16.230:443 s0.2mdn.net tcp
US 8.8.8.8:53 gcm.ctnsnet.com udp
US 8.8.8.8:53 um.simpli.fi udp
US 8.8.8.8:53 pr-bh.ybp.yahoo.com udp
US 8.8.8.8:53 match.prod.bidr.io udp
US 8.8.8.8:53 c1.adform.net udp
US 8.8.8.8:53 ib.adnxs.com udp
US 8.8.8.8:53 dsum-sec.casalemedia.com udp
IE 3.248.152.233:443 pr-bh.ybp.yahoo.com tcp
US 35.186.193.173:443 gcm.ctnsnet.com tcp
NL 35.204.74.118:443 um.simpli.fi tcp
US 104.18.37.193:443 s.tribalfusion.com udp
NL 35.204.74.118:443 um.simpli.fi tcp
US 35.186.193.173:443 gcm.ctnsnet.com tcp
DK 37.157.2.230:443 c1.adform.net tcp
DK 37.157.2.230:443 c1.adform.net tcp
NL 185.89.210.90:443 ib.adnxs.com tcp
NL 185.89.210.90:443 ib.adnxs.com tcp
US 172.64.151.101:443 dsum-sec.casalemedia.com tcp
US 172.64.151.101:443 dsum-sec.casalemedia.com tcp
IE 52.16.65.27:443 match.prod.bidr.io tcp
IE 52.16.65.27:443 match.prod.bidr.io tcp
GB 172.217.16.230:443 s0.2mdn.net udp
US 8.8.8.8:53 d.agkn.com udp
US 172.64.151.101:443 dsum-sec.casalemedia.com udp
IE 34.247.242.198:443 d.agkn.com tcp
US 8.8.8.8:53 230.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 173.193.186.35.in-addr.arpa udp
US 8.8.8.8:53 233.152.248.3.in-addr.arpa udp
US 8.8.8.8:53 118.74.204.35.in-addr.arpa udp
US 8.8.8.8:53 101.151.64.172.in-addr.arpa udp
US 8.8.8.8:53 90.210.89.185.in-addr.arpa udp
US 8.8.8.8:53 230.2.157.37.in-addr.arpa udp
US 8.8.8.8:53 27.65.16.52.in-addr.arpa udp
US 8.8.8.8:53 38.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 198.242.247.34.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 ade.googlesyndication.com udp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 8.8.8.8:53 1.80.190.35.in-addr.arpa udp
US 8.8.8.8:53 246.197.219.23.in-addr.arpa udp
US 8.8.8.8:53 msedge.sf.dl.delivery.mp.microsoft.com udp
GB 2.19.117.90:443 msedge.sf.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 90.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 msedge.api.cdp.microsoft.com udp
US 4.155.164.36:443 msedge.api.cdp.microsoft.com tcp
US 8.8.8.8:53 36.164.155.4.in-addr.arpa udp
US 8.8.8.8:53 msedge.f.tlu.dl.delivery.mp.microsoft.com udp
GB 2.19.117.99:80 msedge.f.tlu.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 99.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 11.73.50.20.in-addr.arpa udp
GB 142.250.180.2:443 ade.googlesyndication.com udp
GB 142.250.200.14:443 google.com udp
GB 142.250.180.2:443 ade.googlesyndication.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
GB 172.217.169.67:443 beacons.gcp.gvt2.com tcp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 forum.wearedevs.net udp
US 8.8.8.8:53 forum.wearedevs.net udp
US 104.26.7.147:443 forum.wearedevs.net udp
US 104.26.7.147:443 forum.wearedevs.net tcp
US 104.26.7.147:443 forum.wearedevs.net tcp
N/A 127.0.0.1:443 tcp
US 8.8.8.8:53 region1.google-analytics.com udp
US 8.8.8.8:53 region1.google-analytics.com udp
US 216.239.34.36:443 region1.google-analytics.com tcp
US 8.8.8.8:53 api.mboost.me udp
US 8.8.8.8:53 api.mboost.me udp
US 172.67.214.146:443 api.mboost.me udp
US 8.8.8.8:53 146.214.67.172.in-addr.arpa udp
US 8.8.8.8:53 mboost.me udp
US 8.8.8.8:53 mboost.me udp
US 172.67.214.146:443 mboost.me udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:53 mboost.me udp
US 104.21.67.56:443 mboost.me tcp
US 8.8.8.8:53 56.67.21.104.in-addr.arpa udp
US 8.8.8.8:53 cdn.wearedevs.net udp
US 104.26.6.147:443 cdn.wearedevs.net tcp
US 8.8.8.8:53 api.mboost.me udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
GB 142.250.180.2:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 147.6.26.104.in-addr.arpa udp
US 8.8.8.8:53 66.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 region1.google-analytics.com udp
US 216.239.34.36:443 region1.google-analytics.com tcp
US 8.8.8.8:53 fundingchoicesmessages.google.com udp
GB 142.250.178.14:443 fundingchoicesmessages.google.com tcp
US 8.8.8.8:443 dns.google udp
US 216.239.32.36:443 region1.google-analytics.com udp
GB 142.250.178.14:443 fundingchoicesmessages.google.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
GB 216.58.204.65:443 lh3.googleusercontent.com tcp
US 8.8.8.8:53 36.32.239.216.in-addr.arpa udp
GB 216.58.201.98:443 ep1.adtrafficquality.google tcp
GB 142.250.179.225:443 ep2.adtrafficquality.google tcp
GB 142.250.179.225:443 ep2.adtrafficquality.google udp
GB 142.250.179.228:443 www.google.com tcp
US 216.239.34.36:443 region1.google-analytics.com udp
US 8.8.8.8:53 www.youtube.com udp
GB 172.217.169.78:443 www.youtube.com tcp
GB 172.217.169.78:443 www.youtube.com tcp
GB 142.250.180.2:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 consent.youtube.com udp
US 8.8.8.8:53 78.169.217.172.in-addr.arpa udp
GB 216.58.201.98:443 ep1.adtrafficquality.google udp
GB 142.250.179.228:443 www.google.com udp
GB 172.217.169.78:443 www.youtube.com udp
US 8.8.8.8:53 i.ytimg.com udp
GB 142.250.200.54:443 i.ytimg.com tcp
US 8.8.8.8:53 accounts.google.com udp
NL 173.194.69.84:443 accounts.google.com tcp
NL 173.194.69.84:443 accounts.google.com udp
US 8.8.8.8:53 54.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 84.69.194.173.in-addr.arpa udp
US 8.8.8.8:53 rr4---sn-5hne6nsd.googlevideo.com udp
NL 172.217.132.9:443 rr4---sn-5hne6nsd.googlevideo.com tcp
NL 172.217.132.9:443 rr4---sn-5hne6nsd.googlevideo.com tcp
NL 172.217.132.9:443 rr4---sn-5hne6nsd.googlevideo.com tcp
NL 172.217.132.9:443 rr4---sn-5hne6nsd.googlevideo.com tcp
US 8.8.8.8:53 9.132.217.172.in-addr.arpa udp
NL 172.217.132.9:443 rr4---sn-5hne6nsd.googlevideo.com tcp
NL 172.217.132.9:443 rr4---sn-5hne6nsd.googlevideo.com tcp
US 8.8.8.8:53 yt3.googleusercontent.com udp
GB 142.250.200.33:443 yt3.googleusercontent.com udp
GB 142.250.200.54:443 i.ytimg.com udp
US 8.8.8.8:53 33.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 rr2---sn-aigl6nsk.googlevideo.com udp
GB 74.125.105.103:443 rr2---sn-aigl6nsk.googlevideo.com tcp
US 8.8.8.8:53 play.google.com udp
GB 142.250.200.14:443 play.google.com tcp
US 8.8.8.8:53 yt3.ggpht.com udp
US 8.8.8.8:53 youtube.com udp
GB 142.250.200.14:443 play.google.com udp
GB 142.250.187.225:443 yt3.ggpht.com tcp
GB 142.250.187.225:443 yt3.ggpht.com tcp
GB 142.250.179.238:443 youtube.com tcp
US 8.8.8.8:53 103.105.125.74.in-addr.arpa udp
US 8.8.8.8:53 225.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 rr2---sn-q4fl6nsk.googlevideo.com udp
US 8.8.8.8:53 238.179.250.142.in-addr.arpa udp
US 74.125.3.199:443 rr2---sn-q4fl6nsk.googlevideo.com udp
US 8.8.8.8:53 199.3.125.74.in-addr.arpa udp
GB 74.125.105.103:443 rr2---sn-aigl6nsk.googlevideo.com udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
GB 172.217.169.74:443 jnn-pa.googleapis.com tcp
GB 172.217.169.74:443 jnn-pa.googleapis.com tcp
GB 172.217.169.74:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 74.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 rr5---sn-q4flrnlz.googlevideo.com udp
US 74.125.3.138:443 rr5---sn-q4flrnlz.googlevideo.com udp
US 8.8.8.8:53 138.3.125.74.in-addr.arpa udp
US 8.8.8.8:53 rr2---sn-aigzrnss.googlevideo.com udp
GB 74.125.175.7:443 rr2---sn-aigzrnss.googlevideo.com udp
US 8.8.8.8:53 7.175.125.74.in-addr.arpa udp
GB 142.250.200.14:443 play.google.com udp
US 8.8.8.8:53 challenges.cloudflare.com udp
US 104.18.94.41:443 challenges.cloudflare.com tcp
US 8.8.8.8:53 41.94.18.104.in-addr.arpa udp
GB 216.58.201.98:443 ep1.adtrafficquality.google udp
GB 172.217.169.33:443 tpc.googlesyndication.com tcp
GB 172.217.169.33:443 tpc.googlesyndication.com tcp
GB 172.217.169.33:443 tpc.googlesyndication.com tcp
GB 172.217.169.33:443 tpc.googlesyndication.com tcp
GB 142.250.179.228:443 www.google.com udp
GB 172.217.169.33:443 tpc.googlesyndication.com udp
GB 216.58.201.98:443 ep1.adtrafficquality.google udp
US 172.67.214.146:443 api.mboost.me tcp
US 8.8.8.8:443 dns.google udp
US 8.8.8.8:53 cdn.wearedevs.net udp
US 104.26.7.147:443 cdn.wearedevs.net tcp
US 104.26.6.147:443 cdn.wearedevs.net udp
US 104.26.6.147:443 cdn.wearedevs.net udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.110.133:443 raw.githubusercontent.com tcp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 133.110.199.185.in-addr.arpa udp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
GB 20.26.156.215:443 github.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
GB 20.26.156.215:443 github.com tcp
US 185.199.110.133:443 raw.githubusercontent.com tcp
GB 20.26.156.215:443 github.com tcp
US 216.239.32.36:443 region1.google-analytics.com udp
US 185.199.110.133:443 raw.githubusercontent.com tcp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:443 dns.google udp
US 204.79.197.239:443 tcp
US 8.8.8.8:53 239.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
GB 87.248.205.0:80 msedge.b.tlu.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.4.4:443 dns.google udp
US 104.26.6.147:443 cdn.wearedevs.net udp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
GB 92.123.128.185:443 www.bing.com tcp
GB 92.123.128.185:443 www.bing.com tcp
US 8.8.8.8:53 185.128.123.92.in-addr.arpa udp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 r.bing.com udp
GB 92.123.128.185:443 r.bing.com tcp
GB 92.123.128.161:443 r.bing.com tcp
GB 92.123.128.161:443 r.bing.com tcp
GB 92.123.128.185:443 r.bing.com tcp
US 8.8.8.8:53 login.microsoftonline.com udp
US 8.8.8.8:53 161.128.123.92.in-addr.arpa udp
IE 20.190.159.75:443 login.microsoftonline.com tcp
US 8.8.8.8:53 bing.com udp
US 8.8.8.8:53 services.bingapis.com udp
US 13.107.21.200:443 bing.com tcp
US 13.107.5.80:443 services.bingapis.com tcp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 200.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 80.5.107.13.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 216.239.34.36:443 region1.google-analytics.com udp
GB 142.250.180.2:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
GB 216.58.213.3:443 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 3.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.179.228:443 www.google.com tcp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
GB 216.58.201.110:443 apis.google.com tcp
GB 216.58.201.106:443 ogads-pa.googleapis.com tcp
GB 216.58.201.106:443 ogads-pa.googleapis.com udp
US 8.8.8.8:53 110.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 106.201.58.216.in-addr.arpa udp
GB 142.250.200.14:443 play.google.com tcp
US 8.8.8.8:53 roblox.com udp
GB 128.116.119.4:443 roblox.com tcp
GB 128.116.119.4:443 roblox.com tcp
US 8.8.8.8:53 www.roblox.com udp
US 8.8.8.8:53 css.rbxcdn.com udp
US 8.8.8.8:53 static.rbxcdn.com udp
US 8.8.8.8:53 js.rbxcdn.com udp
GB 2.18.190.78:443 static.rbxcdn.com tcp
GB 2.19.117.32:443 js.rbxcdn.com tcp
GB 2.19.117.32:443 js.rbxcdn.com tcp
GB 2.19.117.32:443 js.rbxcdn.com tcp
GB 2.19.117.32:443 js.rbxcdn.com tcp
GB 2.19.117.32:443 js.rbxcdn.com tcp
GB 2.19.117.32:443 js.rbxcdn.com tcp
NL 18.239.83.2:443 css.rbxcdn.com tcp
NL 18.239.83.2:443 css.rbxcdn.com tcp
NL 18.239.83.2:443 css.rbxcdn.com tcp
NL 18.239.83.2:443 css.rbxcdn.com tcp
NL 18.239.83.2:443 css.rbxcdn.com tcp
NL 18.239.83.2:443 css.rbxcdn.com tcp
US 8.8.8.8:53 metrics.roblox.com udp
US 8.8.8.8:53 apis.roblox.com udp
GB 128.116.119.4:443 apis.roblox.com tcp
US 8.8.8.8:53 ecsv2.roblox.com udp
US 8.8.8.8:53 4.119.116.128.in-addr.arpa udp
US 8.8.8.8:53 78.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 32.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 2.83.239.18.in-addr.arpa udp
US 8.8.8.8:53 apis.rbxcdn.com udp
GB 2.19.117.27:443 apis.rbxcdn.com tcp
NL 18.239.83.2:443 css.rbxcdn.com tcp
US 8.8.8.8:53 locale.roblox.com udp
US 8.8.8.8:53 images.rbxcdn.com udp
US 8.8.8.8:53 auth.roblox.com udp
GB 2.18.190.75:443 images.rbxcdn.com tcp
GB 2.18.190.75:443 images.rbxcdn.com tcp
GB 2.18.190.75:443 images.rbxcdn.com tcp
GB 2.18.190.75:443 images.rbxcdn.com tcp
GB 2.18.190.75:443 images.rbxcdn.com tcp
GB 2.18.190.75:443 images.rbxcdn.com tcp
US 8.8.8.8:53 content-autofill.googleapis.com udp
GB 216.58.213.10:443 content-autofill.googleapis.com tcp
US 8.8.8.8:53 27.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 75.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 10.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 assetgame.roblox.com udp
US 8.8.8.8:443 dns.google udp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 arkoselabs.roblox.com udp
NL 18.239.83.95:443 arkoselabs.roblox.com tcp
NL 18.239.83.95:443 arkoselabs.roblox.com udp
US 8.8.8.8:53 95.83.239.18.in-addr.arpa udp
US 8.8.8.8:53 ncs.roblox.com udp
GB 142.250.180.2:443 googleads.g.doubleclick.net udp

Files

\??\pipe\crashpad_5032_XHONJSRALBBKHADL

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 1dae30fe8309dac4cdcd1359f6197d65
SHA1 313dd1575f143ad67c7184bdedfa86e0de6be30e
SHA256 1e828e24e0dbadc3b4e4e43b460d5888ed90647898d46653c11a2f540912bf34
SHA512 0e041fa70cebabdce47d5ff97c0dd7cf81170971a5842b7cccf45adc0b77b4ade7557c4be04c14d21d339595deb087cfda6c17fa796d6516deec8a89b26a8f90

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 34a866dbf7d46c5be10bfea35b7a33dd
SHA1 6ce641da46d63a502fb1ad0ef828dbf6027606cc
SHA256 bb1f5a15f03f6bfd2bcc75688ec41426ee7c3ed5341974b4869a5cda5b3b914e
SHA512 65de24b449fbc3b446fde0c67157924e8d7a46732356d42aac55cdf3349f142df6103c270010d9a35e9e1a48881ca562f715dfc26e165143fd0029d405a05e81

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 753b7e850fc51b8016f5a8d303004dcb
SHA1 2158c62336e9d1ca0acbacbfade0108dec6311d6
SHA256 f44e7a2a95654c423c03f6e6cd324320a833d07174ffba143b71a366785297a1
SHA512 eeaa55a824d9523ca2a867f2e7bca448642b5484445ca09bbfff3df61b3a0a9d54c23c916bf8c728a908718851a70e72586bfdc783de9348efed8383993c6f21

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 01d5a22bf3c4dad649cff536581c5f1c
SHA1 9c2c8fd6d0757d8f94ac0c0fc6b1ae40298fd345
SHA256 00509c3d71dff68ceb6c929d74e961b3caea1e7d1e52e5d2416eb3e1b2872f2a
SHA512 3801ed822207a78f328f7bfd8e5ffe3ba2ca6c65e8a67b287ca775fc0e695cabedf4657d5355e581c731df8661a8eb0dc828f8ec3f1ba7317085521e0cd663de

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 731921dfc09f275f549ce51e9738e505
SHA1 9e667160482020cac741feea655bf8e8ca674f35
SHA256 b867e44364c9367c2cfd4076e45fe3fa6211fdf70524756be65f538a1509d85f
SHA512 6fd8003d990f28a13e383c5e5ef03694a1da0abd62029ba05dfc6ad1d3936f73de06b196f151390ab0225b708d1af3563da495bda8166d98b21e95ce24f32093

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 cbcce8f491eac7cea7dfc347bb7addc2
SHA1 ddad886d23448f54abbaffc92aa3bc939927c012
SHA256 5153d09fa97dd190b5c17c3f3abf2a850f782fb850d8a36238921b701747e533
SHA512 6e8cc72b542b382ea0617f2147a0e2f0092d0349b6ad01f21de4b61f0698f57f8d0616757ba9de9a23385a565e5f31cdee3108a0c1a8c72170670e1a48acbf94

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 8d08e6bd8d89e014abeebd3ce1f52b41
SHA1 37f0903302e9c21fe579e042d023c28041248e62
SHA256 befd1893e0b1dbf37f056c6ff9a65d1a98195a786ecbbe2fd65b3c76f806f95f
SHA512 d0dd0614d1976c1bede7d0fc06bbfd8a3a998d8e7e134074403b3bfe17ec29e062f82eaa68d7b37d7d8b4b559f408125c42ad1f2f9f4304474efd384668c1c18

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 7bfd5edbfee98af34b887f3498f818e9
SHA1 714683da6d1b71381d7318f0166579f13888b2db
SHA256 eda2dd5f4a79c8fcff50e655fbeaf0258b84bb2af7e0c1b6412b12230e32b92e
SHA512 22f5dc16eaabacf35759c14be081d1ed35355e1365dab24b356ea5ef990f5d2fb2098ec1dd1733cb06e912874333a0cf7d982a7cd28d5db1022ddeb52b24c50b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 5953cc34608c5a6a6a3c2cc9879e91c5
SHA1 223e7dc935fbd909c9d9f946cbc2b1ce517a1114
SHA256 eb2e6193bd1b56df234b178fbc7f4a01cd28a336b98e240d5dd370e049a81789
SHA512 d6f60768b5d9641a171980aac417ef65c39049c2bc19d4a5760d227ab3a594ee814eb5db407da71738a0daf3e9e237175e01d837d1e91f2b2961bfae37c98188

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 6ef4fa21ea615aae08ffc083ead9d314
SHA1 7dd82888035e1d41e4005fdd1188391ff24221ed
SHA256 149faef81243f2ccb2ea4a7b62778a78936628ad9d157ffc369937924d0e9a7c
SHA512 f405c8d1e554e501e7ce237883237128f289e2089fc07d1d5b6e0a05c20961e90ad66cfbc1772ac3a81d6ef6169fee216d8222be90751ec402212fb9ef9d0973

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 7ad98ee01cac65d22dd567c4463b6f3e
SHA1 a1e166141ad5d4c42abb7c69108ab3bdd32f5690
SHA256 93f64927113e0c742fbffbd4f6eb790695a97c3af515067e3cdc98861620410a
SHA512 0f13e218361b833f67b95b6a93e2454629455edc67183ad39f5f754bccac5b8db7ad5a5b304f1ba400a88304e7c40346c8030f3850fae5bc547297acbfef55ba

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 fb21e9c6f1b2806ed14b7b837e1dd9ef
SHA1 4fad04b31faa573615c60f2486a9158190f64c01
SHA256 93ca56ea31c8fb407f7fc8943ed346f9151d1c45045d71eb496a09def5fda898
SHA512 85f036b7f96f36996d106b9fb364ae952e4d34e547770ed8c3f1487d0f6e452d8eca7d42f99b2f20b93e4b67a639eaec44e97b4fafc7058281232a5042647a73

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 0664df0896cbfdbd9bf4d41c2926dba8
SHA1 464b8c19305e14a5d7681e3b55455222453c41ee
SHA256 6bd3a99cd7c7a0734f3cd8c0993d2118e4b8702e77b3e195e8b1fd564b7b6148
SHA512 0afb40e12e1083dda038464a1ea313667b1fd94ffd75bf043457f92d4d1ee02f9223b9295d4bb1469e05c13da683c0775329c58a7e21e968e49d7373c5ae4958

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ce4dbf706b5135341a19f3b9abae55f5
SHA1 da16a23c9f4d7a79712be39cb6081aff69450fe3
SHA256 fa5c2f973646389e00bc45785f862436141a024b12ae7521eb6a788f2d508701
SHA512 fc9da6b417c0896ac43fd7108720c6142ba1c43f263f575f93fcc43989535baa2835453da80d213f0199f14e545c2c85e8d1a5d14d648add044e2191d67f561b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 8a8d7c6f87d4632ef6b22693545e1c30
SHA1 62f33b3f71c81b7ff4918f3c777d3e4bd5d828d6
SHA256 d7e3bc32dcd58d01b08db9f2edb8f5c288fd03638035d38ae8aae88ad3cc3d47
SHA512 72434ec9d2cc0021377028c5f4ca005b51e674cd7e4019730dddd829a640a1e53de9ea885e2cc8a398cf3312727e745a903ce07cf9f66bb5396d488d7a1567a8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 fe1954d398790a0e2e6525c499f8a990
SHA1 e8d6e339f7944fbf91f6bb1512b663d90756da73
SHA256 9b1887441eb4804a92db1e45b0c2c7dbd9ab68ef5c4caf1e957aa3ebd775ae31
SHA512 3e2b1f4e7c8db6a04353faaf616a1a5d94cf825da775a961e62fa629dccf630e62148778f332d715a4616ac1504c0d41cedbda8b79a93b8283e4f246241edece

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b

MD5 eaa14852c8d6c41556f4eeb28e2e0bdb
SHA1 cc6886c72df9cea06c939c21a289ff33cf76771f
SHA256 7643a051614e790fc4f000574b5ff1c2424df14de2b955f150622fe8554cd860
SHA512 769118b41c316f1129c3be4b740549a176c339b9bf85981b5092b83498db8313ec7d3c020c2c3382f892bfd9003ca589712b3d036b9d0b0e4a9c4ebc0c3f2d0f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a

MD5 222371c3cc45c2e40335ae4b586ff039
SHA1 facd5dd7c01092cf4655a5fd0029ea2ddb8daec2
SHA256 ec394950728ee69587cc337dae6c3420008cf09f96aac536a239bb7341c3c102
SHA512 23d522b1f6529f7cf159105130636108d0af4cb5f6e785ffab8358b8ad135442466f9f14a8c5584d2838607cc95062e29e5b9df7083e692b73bb9a5ab269705b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\71848a3da7ea1aa8_0

MD5 245da6c66015838c66dbcaaa4b310850
SHA1 78b4e177b29167fd6535d35898346be888538931
SHA256 e12013c9cb9ae48ed001907e8e1bf77e188b162f76a833e894299cdd6ff2e661
SHA512 47604e60207144465489a41b15c3138b502b9ee0f05929f8c2d97050b45cf3ab41a4148d229025a5db641f8666706f7a6a026bfbcbf40baf9afed2b602b8814c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

MD5 02c33261ffa8bf25d6aefea03b031c15
SHA1 5ca3f8ff07692af7d4b2a343c76c19b565210f76
SHA256 9ef2cec079f1961ee93cb941f964fbca92058b09b65651dab948799938564c7d
SHA512 86eccd0e4696b16113ee4ea50f7c249464ddbff33f8ead3760b9f319ab2a203266caf499d0541035961a255c72c3b424e7e92f1d787e6ad6eb9003d418c47f72

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f

MD5 87e8230a9ca3f0c5ccfa56f70276e2f2
SHA1 eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7
SHA256 e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9
SHA512 37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e

MD5 428cd8f6d64db822c8fdd794e8a399ce
SHA1 abba23ad50f1afe5aec8418d82ce37ffb38567f2
SHA256 eda025c9cd43460683e1379a828ae1700b87285575bd9df6b96c675dac4e65d0
SHA512 434e1d21c7ceef329762eb5a5d5fcb6b5ed75921cab767d4a77e813009ac1c8801be02a7588599c6a25d2953cf2a5534528ca4dc6b8019a22764157e55cc2c44

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d

MD5 83ea6d1b74fbabf1af38b5373c52478e
SHA1 9180a2b9ad6b9c5ab16ec82e9e2c2c3bf26a0c8e
SHA256 c5fe4cf5b58739e392d1e4f7b6abfbb77dab9a6312c35b83c15c93f9aa9aa6fd
SHA512 632f69bd2db820bd254d55ad7b10ac3bb68e8e161f5df86ec29cd33d207e57894bc4f41fb3c4b31b59a4f1eff099fe94e62622df1075ba3b24f87f73aa8b4807

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000020

MD5 6327624317701c6c4924c87cfe7cd97a
SHA1 27389d815244682780bffef61856db93589b3ca6
SHA256 d3d2f1a5cb6c279d8b34d82680d68ce110054353249e9a2636bbb452cb7ecdcd
SHA512 b5cf6c5fd48dcafe57eeae6693d184e90a79fa3232b48b2518badcae3138c8b15b19d4ee95847dfd437cc852a9e6dacd7f22f49612e70bf3bea7f10aea4df533

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 99f542bbddeaab23e4aaf792e47a172b
SHA1 8b2403ffed5983967cb4accb4c8553081fb91fac
SHA256 184a039636000edfda7d933ebd25070e1537701ae33cc3aa812419b19edd107b
SHA512 c7790e01a16163b21fd69f9ec1449a22c9f83399d652b98cc4fd4655dfa281aa55b10bede837e1d2d3ed0dd2cab7fdaef5ed26329f883560901519fca9f2cad8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 2b058413fe10e7032d4a1f381e70d75f
SHA1 d92da68295214bcd318c0ec96d779c3be2b9f717
SHA256 3f621a5cb437e170ac11e8ab96b3a5a21df3cdf7dab46bd9bab3a8c90fc49531
SHA512 39c5168da9bbc736b5a0a33ea2207f9d5af1a86eb922f5de1e5eef4398fcd2569c8ec7d419f55f05a2ed8032fe42416865e867ec012b673ec5eb092b8ed02193

C:\Users\Admin\Downloads\Unconfirmed 644532.crdownload

MD5 0c51311b8e9d06dc32930c38c98a7b95
SHA1 aacbb77423f97d4bc7ec74c75dc6807ed4338623
SHA256 26323b34dc2f151859ba9d36615463908478a70915bc7076a1babe52855c22c0
SHA512 aa3f4baaeab39e29d7b16221871d6a1219310b43d750415dbd7b114c57b1c133bbfc25e213398ace80cf361a4f6389c191cba56713985a5ce238d920610c0801

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 22de2c4ebec87f73019ac2ea75c877b7
SHA1 29fdbbe34c387a6d1b18861358f3acad1973b5e6
SHA256 ef5ceb0c726c7da35246ad2a580c4e27f6b6b94657b3de6413fc798cf159a575
SHA512 92f10a586dcebb69164d4305dff545046fa58e052c0e44050a3d1c8d352c88bec8aa82db3f61644d669d7be837cc058479e4bebca7836213b630b1e77db1da91

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 5221fb13bb30d856f495b07649903dc2
SHA1 21165c1599e0a55f7d80ccbe9dbf7efb1a2458e4
SHA256 31178f358ebf7207ef6c445429f150ef639c06d81459fd0e407b76887e455917
SHA512 b89b97062e0b52d449ef0149a904c3d2614b9c9d739d4977a4beac39d9cd5719398b429ffc5026453b4bcc0034dfe31d847e738d333c13894a5ce060d1a28e35

C:\Users\Admin\AppData\Local\Temp\MSI1F67.tmp

MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 f812a2984ec3476e813fda297e068023
SHA1 d31354fedc9783e381a6c0c91963efbe293a26bd
SHA256 d5966d1ee7f868849ed3b9a194c1504e7bd8773acee8cc26add36b891a4cbb1a
SHA512 e7db4bdb2a4fb4a1da00965cdeba9c18688bc02d5cbc9f5026004192aba7cd58fab3a9525578db86fa5fbf2f11623c972d1684e54f0598268e72901ee5e567df

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 8faa3f443cf0f22abc9e5c16b3d80931
SHA1 28af893fbe4be3d5d872f481639d24689ffc0538
SHA256 2df89ddba21ac9d94aa286855216a00820123b8c56f78c4bc55464180446ae0c
SHA512 a1db9813a492a6f54c303eb4d946be10568526235b595cec8ff6862c1213bc642ae4f3e0a19aa2d9c4f54c295f2c488c747b3e24d271b9b1cd1041903ec0998a

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JJSploit\JJSploit.lnk~RFe5c5607.TMP

MD5 3c0fb65d300b3b4789cb01e12ebce88d
SHA1 4893009d90670149895f221addb996f01809ef45
SHA256 e4a65b1b468cb87f479f4e6499622bc6bc9811f355c3a9603dc2ccd0fdab859b
SHA512 f510d54ab00745b0b8eb11a07eef83b01393c8242b34390e8228bd8655c2ba6bbf5a2530a38933932bf67f1e1c355e06180205950834e48969118c1f057e3394

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JJSploit\JJSploit.lnk

MD5 772c6e25fd5893d51a76bc26176a21bb
SHA1 c801ecd2020ed03b5d491485043098ac7c260fd3
SHA256 379d01042096c4d97d3854dcc69b2591a4360f2c7fed03dd1597eaf22cb23d05
SHA512 0a075ef7000a1812a162892341c1064d431225989a7ca03dd4cbff48714b3352de51c39ce4027b58a1dd78ef9f09a2de0b081ad1c1898c257f9a53943c83d5a8

C:\Program Files\JJSploit\JJSploit.exe

MD5 8c80175a590266d599fb77ccc1fa8f85
SHA1 b46cfda374e01776361c9b1dc6b46f5d7275105b
SHA256 94f52e11c81f7700834281cb179089e470528cf2f3701d5428195a06fe7a7269
SHA512 0d6f1bf2d0e2cdc151a2af3e814c2f724e26f37fd4e4a36fefd2e30b5249b4745b0548ee320e8faedc1002980c1554007b4b3b5ba837e30c759122a6ce0b7f95

memory/764-548-0x000001A765AD0000-0x000001A765AF2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_khlguxg5.dkr.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 9fa98be46693224964c0622cd97bcc9e
SHA1 c58c5f53b9e1b4c46d1b3d6539ca85ebdef250cf
SHA256 ed9accc213056fab2fb73eb3c5a2e642235fd32a9d1cc352bc726f2c37fbe5a0
SHA512 95fb6882205163d4b8e84762531d2de32680bf72c5ac51b7e0da886441b793edcd3ef95bd657a7f8aaf864bb957e53d15e2a511ef90270f279884e9fc61f1e8e

C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe

MD5 431a51d6443439e7c3063c36e18e87d6
SHA1 5d704eb554c78f13b7a07c90e14d65f74b590e3a
SHA256 726732c59f91424e8fb9280c1e773e1db72c8607ad110113bc62c67c452154a6
SHA512 495d60ad05d1fadb2abd827d778fe94132e5bfc2ae5355e03f2551cd7a879acf50cc0526990e4ccde93bf4eff65f07953035b93cc435f743001f21b017cbfdfd

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\MicrosoftEdgeUpdate.exe

MD5 35a79bd6de650d2c0988674344bf698b
SHA1 a0635c38472f8cc0641ceb39c148383619d221dd
SHA256 a79a81da2b8dcbe39609a9e1b4e8c81ae0bc54195c0c854b77bebe7bfa7f10c1
SHA512 afe33d38785afe489845654ba1c3ed6648b36b1ebe5f98b3d5d4bf24eba3af9bb6676af5a79d2ec570bf2b4b6ae40d14fc3d4b872c5d4577aea40f6d1a26c0cf

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdate.dll

MD5 39ac5a029f87748e964491b97936d890
SHA1 24777aad794a13d0e7381fc6f32f0e1bcdb1ba80
SHA256 ba861524fe648ccb47b7ac57421bb07a6231a7aab5eaea332548511cce6185bc
SHA512 2ecb9b208846f84cd37f37d2100f26358d6c37128efc4010b2e7efc10202dc37b621d0c0138a8b76b23d968da324c685a41b44f4ae30cbbe243581f1904e14c6

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_en.dll

MD5 894b6ea4b49fa390bd70167a75f3ff7b
SHA1 4f834ef6567d02f28390d63c8ca9fd3c735b2140
SHA256 a8dc2b1e32d8d3d2c321c469eed3329f7661f4fc71d14696f97106b5aa6c532a
SHA512 9b4fcbd07dc7f65c34575aaabb7a517198739f7268133f084b101edf99f0b96387f3f0248de1be5252b2466db0bc59036d40e3990d4264bfab89aa01aace7ea6

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\MicrosoftEdgeUpdateCore.exe

MD5 dd30f3ff486b830211df62d20348f86f
SHA1 08c7d7407dee7ed20b50e8f1a2cb1b08a9282dbf
SHA256 9d57bdc8b97e75f8a04b93a1657dfd18d4e2f68607783c9bca42140233978fa7
SHA512 af3b48ced7018c7edeabdfa998e51356d57c2d7a846c76629fed0ff2e5db8db79041184c58a5a67a10ec627f53af8e3c80bbffacaecf5dae6d989cecb82e72e4

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_hr.dll

MD5 ca9abf92edc001d3c0cea4c926bd004c
SHA1 740513a325a5c15376f4b1aea402e9c54155ab33
SHA256 d6d9e064773b121fbf224252ef6c7d64f239d6b5013c119738a8240cc047e346
SHA512 7171143ee05b0e03bc936fbd98d3a37c3763bc244ffd8ae85e3229b85e13ec6262c3111b93b3a067f3d82f5fa6b6f691438c0e148efd14606cdf5a850e474a7c

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_hi.dll

MD5 274c267b7ee544d36698b2db119a6929
SHA1 27377267ddc09060254033c4aa9916a60a254956
SHA256 ac843711f010925cfdd60c396baafc3ead08584ed4b1b3df57b0c975cefd039f
SHA512 f9073912e9c314efe60f36dd9b2bdb4b1475aadde18e82bec971c447293a4f8dce46abe625bb9cec4dc48280fce3cf3d8175054b70b4e440e89a8c072f4a505a

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_gu.dll

MD5 bb4a1f9374f1c3e0cbc4788a3ce1d4c5
SHA1 30667d6dbaa689db9a08b42acacdf68435dac46e
SHA256 bdbd0882aba924075c40de48fcbbe951ea6a937c0b85541fd6f1fa5701b8e655
SHA512 d0a5260ae123d4698e2f62fdcf97a73aa038b69b200508948185bb5de5f5edb50d6859c9e6e21e84145ceebc144882d0ed5723ce1486e805c26737358ae77504

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_gl.dll

MD5 31276d0895baff6976c94c549efbb47d
SHA1 4f0fe790cecc28823e6359fb3b78dde13cc17681
SHA256 d3bf99db747f3e6a2d541ecab380244c0a33ceef8655383d54e2daff37dc9a88
SHA512 413958104046b85772d4a32550ae3a7a3a50eb66dc35966554123bd9dd15fc7a76fa7511f6d2ac666d8a205a9b58042f68e2322189c2b34d372db6b180b70da8

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_gd.dll

MD5 d64f47e1971f1e9faba211ca984e550c
SHA1 6f4de57c6f174dd778788b138a9b25cf4725258b
SHA256 75fd1c674a460dcdafbbc1429a4c30c9ac28e58527c6f0797c3706012ec19e00
SHA512 722c9f1e5d27d6ac678ca13aa648aa22aaf1121b835fad5209ce3e482471724cf4920390f51c8df2d31c66898def51ad76b0c119f4de831011b56afead2fef7e

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_ga.dll

MD5 3ca8dfe9af49bdde95188002ebd5f227
SHA1 d18d7af889c4d03ea417c09bc56069f3f697c547
SHA256 6577e1a60f0fa340dcb70dcf625c877fc9502d122744782708ede0c53ceb56a5
SHA512 a61ba9baa6d0116b769c4add55aefc99a360bf85be7986ab099a424ff7a39ccee18d946128e74e39283629b52aa14821f36fe338c0e17de29694fff5138590be

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_fr-CA.dll

MD5 08b6c8f26644370c6dcbee63e4abf884
SHA1 e4981733831c4d31715cad1749545d21dc29acf2
SHA256 916b52a362fddae79461d1d07ff01fd3bb4f7b8916b263d62572a8ad420946d8
SHA512 31f074e494a372a1b961fa9c053b561bae9e52182866a538a734b7589cad550a42b1d88649262a7d265226288084e5ba65e9e1d6d32ffd9292258a9f65e236a5

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_fr.dll

MD5 cf3ff14718b5e6125b956d6d9e897196
SHA1 041de2587e03f6c52dba60e9d2459ce33b263eb9
SHA256 d75ece04e40e34beaaf50cce0fef63e52918b5939c9c267fbfd1e6cdcb2a82fa
SHA512 551ed975b1afdc75f464bb742c30f239f9d18aa99bf9140ec0620c938629868b38a952041288244b6e2387748c16546a8fe55a664a9903577b8e484856583ac4

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_fil.dll

MD5 20134024ed75deda002dc0839b352f84
SHA1 e67bbd13a320d2b4413b283e165385c44a65ea0d
SHA256 425e0834cb73365cf78a233a5b139e1897961e5225e9cc92ab365b3efbe30d76
SHA512 7dbab9a85d852546ab8c30b3452ab8b200874eb3aac0c862bdaf5c90cc882cec11de536851693f8f115706448e3323c66affbdd7e65257395baf24a0208dc537

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_fi.dll

MD5 7f47c9b9bc9488754579935209291c55
SHA1 470e590c6f5263a44b95abbd6d0c158fae326d21
SHA256 f0d8c44d909aed479b3e770b556eb3792c0d3ce247defff953a4dd9f7ce4cc75
SHA512 6f81ddd06f6a1c796bbf21143737bfeed8f9ca0ace82a4de00ccf79d7288586376439e0564f1cb128e5e585eaba122d406af8c3a6e3969efdadfe0cf65c3ed4b

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_fa.dll

MD5 ba417f44f7564f1aca70cca9166f3f44
SHA1 d8f064e25038e0076bffcd1a694b58063b7268d7
SHA256 56632098f623cbb58fadddc5c7a889fbc91954f661078501e62517709b8ba703
SHA512 c35ba956e92a2298268bb6ee7a753d6b7f94bdec96118c834f028a0fa45f18b67302b0e20a26d948d1720b04461d3074ae30003bb9028790d9d2d63cb80f4467

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_eu.dll

MD5 ed883bbd9e4b3de4db68e356707f3e67
SHA1 e03dde660c15a614442552f8c4d2cc5dd8425fc1
SHA256 168eb27052a559561af3ed650bc170eb471e53f05b9065f0e229672d040ae1c7
SHA512 ae48fe344b2644380e56a95d98aeb0ffeff7ddf0c914f5d14ef518a4d40bb090fee9a7fd30f7178524bcdec1a2d8fc870b4b40d5d8437e3f2577320262236126

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_et.dll

MD5 6b03eb5b302e72727977f2431ea7f30d
SHA1 ac5cab93d3c28e46f92d2719638c739c680cc452
SHA256 b5b51fe000e0e0ce42e8dbaf4b8343a5411e2e99440726c747196a02ed736137
SHA512 362e94f79b7726b277cc90c5158d3cc5a0a890bf32e11707f9901233414b3ff22816df78276afa67f0122fc7d6fc2d09dbb1fd8602e3a01f807f93b9423bb463

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_es-419.dll

MD5 bcafbabbfc8f810220b2ebdbb8a76d19
SHA1 58703c8355f996f2ce8ae5fd1ce4dc29318fd414
SHA256 7fef9c85b5d7dadf344ff39d82794ed252066cceb2b6531be2a45ee3d84844b7
SHA512 b02820c3088ceae9ebf19ede77e3a406483a3dc13c030860d3818e6e8a163e9f54293fd058ec9575c196d12f1465211ab7feff145faf684be6a8cc251d1c0d71

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_es.dll

MD5 3ccb8eab53a0b4c93507bf2adff6ced5
SHA1 25fa2435e97bd0e1cf986a882ce33e68f961c139
SHA256 8bcbd325374a8cc5c1c7ea774382515316473c200baec86a65ae21073fae33b0
SHA512 4f443ded84d74e150a0be3c32edc734ca01298817933a7b1f0e5c5cd93f26987f051c4c306848301e688b9334d134a12bcdcc0ceabe1fcaaca5c4d307c697bfd

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_en-GB.dll

MD5 39dc20ae50a0e2ba9c55dda91256b3cc
SHA1 464139f11db3fd6ae77502b183c4b59f581d6c7a
SHA256 e1891a155be133e6dd82cab3f9437bb7f047f0f80689ca724ca4d1d90d1fef14
SHA512 08b8e19528ff007b904f55872935e0de9e06e7cbcb3f3ed751264e3e20a740b477b55c818bf2b0ed213c4ed9cbaba0c8953c19f427be3e8ab8f50c9c86a74bf4

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_el.dll

MD5 09cf47260852ff7b2c91c65d127b9314
SHA1 b3d362f3d08f81bd1b719a1c94b54f5f9c9610da
SHA256 eb4344676280f83e6023ddc604ffa42e96eb46e765a216fbc5ecbe49ddb3c920
SHA512 114a21296d8e7e054906139102617e6cd6008337a0877053721553cfed10183f54f890c8071b1cea17bd0b2535589af7aafe5bd1d161886ad7363f89919d7300

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_de.dll

MD5 ce66ef1a806c21949b75055f81cac760
SHA1 3719e4af114a3c0baceb133d152a02bc6a1fb9f8
SHA256 23f5414d554b96db0b93c7dbe27939d294b8061e56c19ab74d59fe9135e81c8f
SHA512 04d9575c866ac28db490a291be3da41f884d3ceadbc9b7077776ea7deb1819277aadcf9c9e1b5afede3e90bafbcb00e6ef0840166228d153be7e8d8d53975593

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_da.dll

MD5 19a7aee0daf68fdc1a24e3228a8bf439
SHA1 1fc6ce227a11245787c80f3932e2c311de2d44bb
SHA256 409cce12be8b7a86313bd1d9e3c6d9154cf0c5735db61d94852a128a746dab99
SHA512 0051119311316d29dbc13ace84c24283aa2eaf1d46459c81ba7b31cc6178b43165618fd7bec17de698b1431ef2b33be179c2c8b1537c1000aadf849e2c888c84

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_cy.dll

MD5 11b92ae8fe94c784480d465a37935766
SHA1 f4ead29d4b20c57bb0e4d16a7488784f61a25972
SHA256 571b0cf8b0383e33393b8b8fa79d1632688ffc2bdde794fff62c85f5e1a3f161
SHA512 b636dec2e1d48916d0c83d2fe45eb24d826c027455cf22ec78e013166e59fbdb4780ebe69de3ab4b5730dae03652d253890917f53fc835aa73f9f75b01dc4f23

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_cs.dll

MD5 8eff4531519a4b768005b9411d4a5f9c
SHA1 59b354e3f32f0a0da8755c27b903803994f4aa31
SHA256 2e9a230a8b8a7fa437a28e2115ebf01178f3209fc0d61eb90160f49c11a16cb0
SHA512 4426ae1e2937e1f6c7364d2f437aeb83d834f9997d28cb1ffb07fe1c448dd954083aa822ff439c886249a387823a23245640a0425dd8c42b75b73912733f11ee

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_ca-Es-VALENCIA.dll

MD5 afdafc9f56401b662f42cef830d92b38
SHA1 b56966370ec07cd676e35d93fad001e0f6b3fb8a
SHA256 03d7a1c0d8810df4b908fcc40c8491df0e3ce19db8ee22e6be79d02fd9df8f72
SHA512 884f9cd99785ea91c5c8e26200bbf0b010ff278b52c5ac590cb73712321a9cdb645e5448bf4cf62622cdb06543b8de4a8e6956a2f6b6677c0b9befb35589d8b0

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_ca.dll

MD5 15ee7526536790bf77317975896542f9
SHA1 365bc54203b490daa0e24a1c9813d5d99c9de720
SHA256 5e2349af6e02da1c5d18f1b3235fc5099229d2d99e1c5cf2713c21472c151f8e
SHA512 475fd9c0879c8cbc418a66441e3dc026fca983327a95763eddd1537c1f44fdf272d212c69e1b06aad55d91c68379a2beafb2908659d58a61c740731a7d047406

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_bs.dll

MD5 5e06d311c2e24b94f378c4d3b3deb260
SHA1 ef7df63f63746eb197c21694ebb21cfb86c0b2b8
SHA256 d2052450e3a3272b302d80af9f2c46b766153267100bc902dcf03a78ec609b65
SHA512 8d73b5265735aa19116cf41bb8d2bdacde5b22b286a56af58068f9579b631b044c155e625f6e1fda12e505f621f245faebe126c2557dd2ec873d7d980f8ba552

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_bn-IN.dll

MD5 1e038b27661b303e15a39a55305e86bb
SHA1 35b48fe72d50406063f9145fea64c57f205f0084
SHA256 385665137d0dfee16ed8ef2da5ce28d826d210eb2bde1fa4ef13dac50e4b5364
SHA512 13fcfde6923b38acc2cfa530087d13725a2cabdd2e771d503f4d2f5cff93e8744f142e235dd484244d920d80cb3e7cecbbd731b473f6e509edb39159c51e9465

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_bn.dll

MD5 9afe531b6472cf9eb66028e9638584bb
SHA1 6212292867bd59fe376e79988c07f4db8ad26cdc
SHA256 383754fc147dc6ef5f1edd14b60bab6bebf32639dfea718aaa64b2b65ac98812
SHA512 352bec509ccd3ad15a274ddd3ccea43b76eaed885b0e7722235abd95aab8fec1c645722765d76865c1b32ed422a10e6666f220e3abcc5a24268ba94c5cc6b8d8

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_bg.dll

MD5 4b23c7229eb43740744cfbf48c4242ca
SHA1 4938dcf6239e14db53c8f085d3c477905a9986af
SHA256 a7527b867ebc222114b679b2ac542cdc46a75f8bc24e5ca8b7ebc17b7a2963c2
SHA512 4bd8ed0ecacd3f2c69dcd0789ab8ee10dcfd6144b019dd8858c2234bebddfe42c83037fb8e2f934f3320f58796683bed5ab050ba897ba1fa409b6df60f02ec53

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_as.dll

MD5 16b0c8a664626da016a95fb46fdc9c0e
SHA1 c674b635cd8927511825847f3d86a5562b4155d7
SHA256 b059fc9713d3a41e9a83f0d61f8cce29546d3759def0a7b8e162a13915e51255
SHA512 ec39269fbd9e510d10d665c86b8a8161208b74f919e4fd128e365144d71f2b59d3c48c50b8f017b1d30c711ee4f63668f843539957b4643d2a488c9e17290e75

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_az.dll

MD5 bf510bb9b7639af7da969f77620b480f
SHA1 17a6693a5d6aea1f3fa6f34abc46daf558cac645
SHA256 2507da222cf6c6dd608da9b569f89f8e11c47b6e16134c767cdc23b7c1f56bd3
SHA512 6cebe80005cb7759ee4fd8dd9ca41bdd073c01e969e1ebe03cb07616921e50516974019faacc2f9dcaaccdc0044eaae57a6a94f3a4a4ce044a781cd8091478a7

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_am.dll

MD5 1903bc250fc269e79c9f7aada2979aff
SHA1 efbf76b1259217c02c138078c56f36b2cb8543ab
SHA256 228fa3e2fcacc78111a8152d6862de2302c024e81cc8b5e3f16e31caf96cfd04
SHA512 9db527c2e26ef691c089f5d1d010298e0f47e2e0420fba03ed18c7c2793b92c5860240b214b5233dddbc150413a2649e9cf4823239b9831930c2804b143ab538

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_ar.dll

MD5 b4c28669b9d4e56b094af6062f4db065
SHA1 4c492c03138c8a796cf0673866892b9e0c2073ec
SHA256 7fe494dd265f99f330b153ef69c51c0541016755ca1876788f7f0ede78f9cedb
SHA512 35941ab6f2dcf5f60824d172f75f9f7b8b93e65c7bd8bc441fc32e49cbb414a68d65a02e3479b096f728b2a34d3e85dfd868e8bf95ff9b1a57d10adc3da0022a

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\msedgeupdateres_af.dll

MD5 2a9524cf8afae49394379d9d9be69206
SHA1 e43d4146f8abebbb30831fbd39a39846bfb7eeef
SHA256 e5a08731963e681b6386c4e85c16bc98452ebc13c4a7de3ff6979125c609d5f0
SHA512 a0111589960cbdcb10b55c17aa82555e44f0f0f173ebad09de6364881138cb35280596f1de6d86b31044427445575630c22079c3585e34729ce461599b8979b1

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\EdgeUpdate.dat

MD5 369bbc37cff290adb8963dc5e518b9b8
SHA1 de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
SHA512 4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\MicrosoftEdgeComRegisterShellARM64.exe

MD5 1723c5e707061e59d769c492a95d5083
SHA1 3b535b7a0df2f7a4ab5e531956dad9892adfb5e9
SHA256 e97ab6dc0ed865aa8606f5c113fd62170341d1a3d63d5618f233aea969ec49ab
SHA512 a4e3bd9ec331a27338c123a9a3ae23619fc5a5b80fc9aea38d23d3b82ca015f47669e0f3e1a6f98e7f464e6bc21e92723a04f72805e45e0dfc81540a2d299a8a

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\NOTICE.TXT

MD5 6dd5bf0743f2366a0bdd37e302783bcd
SHA1 e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
SHA512 f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

C:\Program Files (x86)\Microsoft\Temp\EU6384.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

MD5 c55b37823a672c86bc19099633640eab
SHA1 da5e15d773c794f8b21195e7ad012e0ed1bceb72
SHA256 3df9cd2fecf10e65be13d4b61ca0a9185845f2cb04b872adeaf41ca46af39aa0
SHA512 1252c3fde4aa4ce239103e8df7224afce093a2cbe539bd40347601980a314ea3326ea6ce4c1ebc845c125845969ad65ebca319b9df35a809ef871bad14aaf33d

C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

MD5 0e20d8eb514b65971a14c06be42a424a
SHA1 14a751a5745ee4f7d1a2ef98729509764e588113
SHA256 d3ebd939d52c8d7c4a6dd62009540f4382408be1b07678a38d9c80fb0eb516fb
SHA512 60ebfa2ec7e50c382263b1b2daa7efad3956dade5ff79d39d30406a9239ae4dc36dcfa2b2c22949666f94eb0efe42f37bd83b708cc1bca794923f28a1282c571

memory/4712-748-0x0000000000FE0000-0x0000000001015000-memory.dmp

memory/4712-749-0x0000000073E20000-0x0000000074046000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 dba017711400d7f912cb52379eca32b7
SHA1 82041436498bb7c93b5f7528084f30036417b2aa
SHA256 b765b78ed7b436d78a1001144717f4ca6f342278e1a1ba5d277a5d582e5dde94
SHA512 6f984f13da72a2a65f0f5e79681786105f1203c0a33de5b4145f1ffe48578046e42c34c9823e952bbbd6dab5b4c277bd5e19466c839f283d46bd8b9063ad018b

C:\Program Files\MsEdgeCrashpad\settings.dat

MD5 ddeafc2f685922ae2d61d610dc8f93c3
SHA1 4d57fcfc1170640c8a97e8f8934798e6e4e3e5a1
SHA256 a9f7537d82a71a4b5eb62214b24abaea21b790c623f0804a87c41f96957e0f10
SHA512 691c4d0d8dc989b56521d1a0977e76980f9f6b36c186bc409fbc1c4dd64f20746d62c9353e692c19de787ebf1a05a79163530534bed45969936104b0989f1437

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 1110e14b3770f6bb8cc78673432f5103
SHA1 bc628f52a4c5bbb96705a86ac61843bffc79a72a
SHA256 c8dff5beff4166b660ad1c8225d611fa11e701377c107032efb13b2b347bd5e6
SHA512 665af5449dc70c5fa7151e92b49477a9818284090964a06fcf8fb00cc7ca6bda6b587fb8ec8e6f0c0f34bffc097c69b0622a37c62eb67e355a3e2b6bc20d193a

C:\Program Files (x86)\Microsoft\EdgeCore\130.0.2849.80\Installer\setup.exe

MD5 b621cf9d3506d2cd18dc516d9570cd9c
SHA1 f90ed12727015e78f07692cbcd9e3c0999a03c3a
SHA256 64050839b4a6f27d896e1194e902a2f7a3c1cab0ef864b558ab77f1be25145d6
SHA512 167c73cf457689f8ba031015c1e411545550f602919c35aff6fd4d602bd591d34e8c12887a946902b798bf4cf98aadfce3c2de810bf16c7c24a216bfd8abec19

memory/4712-812-0x0000000073E20000-0x0000000074046000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 774eb2ccf6323ccf64fd7974bffdbbf3
SHA1 2385bd8e5d659588c9126460f12562a1a996831b
SHA256 727ba105e6eb093f9db1b863eff78e12bbdac27ad662f4c42948bc575861a762
SHA512 155c02c19f2a036732e979a21a7a8e49e705c2c1b659199e46a6142424c6bbcef44603914489d999916eea729668c7650a56d793657fa67a17f38b7bcf1ff680

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 cd46146331a1868992490c5c91cdb6e5
SHA1 00ae656f2e449077c2dbadb21394fa46f86b8b4e
SHA256 340244e2095338f7864aacd76e7857be059df0e5fa5016d81dad32f316733f69
SHA512 c1af5873f90898370a3280736ea96e5f7c90f2e91459c5195cc41945fbcb654c03b5e5170cd9104137bd6e47c4565893630b55cb6f4e07ed8f3ea56b28cc6090

memory/4712-846-0x0000000000FE0000-0x0000000001015000-memory.dmp

C:\Config.Msi\e5c53a7.rbs

MD5 ae1c8816a8f7938ee6d5bb970fee20e3
SHA1 59825c85c18d3fd67aef85f95e9fd667118e6db5
SHA256 74d5fdd56ec3e6c5bcd99b81b48a35d6c200348f8277f6ea89211644d458e228
SHA512 65ea2ed5de947bc32f159c1eaaa5ecd3156ead194e5c7b728abd7a49daddb747a18e6a6dc15039608acdb1d2e0deec04767c4c4186ca98365be8d4c53d8da549

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 2b953c38901f6aeb2d6cfb43051ccf48
SHA1 3fd8081ae271ff7b7171d5adf07bb23aff02be3c
SHA256 c3624a694fdaafe77921c015643c601633803f0966a29d3d3d878d1bdee6472c
SHA512 0097fd05c45c6d8e029aa4bd730adc263769960d5aaaa05385a0c78ea3dc014a8d21265b26d7ff805bfb36cd64fdc493d72adebf9237a136909bf7b9002f20f4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 cf21726bc72298bb77a279fb50cfbf2c
SHA1 342022f91284b29c3207a3bc385abfff14dc7d7e
SHA256 427fa8051d6de9f922ec95e29e7b79fef600449156cbc06506e2509915f2b19f
SHA512 076c15406fe8c6efdc9884e7ddff2e19b7a17f1b3fce2ed669ca619f3447fd82148e24d9528af6c1e2eac7444dad8942d768762c1b07043c1a5bb54a16ecf0ca

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

MD5 46715762a63598f82087c7dfd0b53a1e
SHA1 ffdd6cb739e88ef4af75cd683e7c1ff929b4879f
SHA256 f1e14b79018c77d2373eb97bac5539b82799bb40127cc7220e7981633ed45e7f
SHA512 96c713ae9dffb1ea85b8c72d3ee7db57e20e1aa79ffe8c312a0d32382abbc81ead5bdb84463c049b7d1591f8e9cbfee186764b098528d2b5278824e2c4819cf6

memory/5796-916-0x00007FFA25310000-0x00007FFA25311000-memory.dmp

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

MD5 d1e8eb37125c109532add22eae4cb732
SHA1 cf743a99ae2f79cc2bb9c2215f337ad7c87562c5
SHA256 1cb2e4ca5cc91928a15fad89692a9db7ea581cfc3fc98c38c7eba02683207da4
SHA512 1c9902f635b515b61472a9ebf76bc7768797b63534a4dc7061ca309eea6876334ea71b619a631de4d17afc8f90099b5ea1d82578d6350d104c6001f6f10c7af7

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat

MD5 626ef6ea286182e7529546fef4914efc
SHA1 979d89acabb682c61f25afb25c5fc64f942a02ee
SHA256 91f82c1f415eba5df7cfca1857852fac079b23c72e2ae5dc1144d63f2ad3dee9
SHA512 1a2230497cb14d377483b9568abe2b7d27bbe8131e79a6d629154291f6457a22f781bd484d4d115f0f87e7641478011d2b38bbbd784e3b51d175e77f0c3b9f60

memory/4312-961-0x00007FFA25310000-0x00007FFA25311000-memory.dmp

memory/5000-960-0x00007FFA26040000-0x00007FFA26041000-memory.dmp

memory/5000-959-0x00007FFA251F0000-0x00007FFA251F1000-memory.dmp

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Sync Data\LevelDB\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe5dff90.TMP

MD5 e831510807daded2422b4d4c3709acf6
SHA1 c38b339523e973a95710ae5e9c72a520f0db2b37
SHA256 b0dfe00ec62d4709f63e1b409e329a61bd48dbaf4f4afbab6a04a8e054de6d84
SHA512 ec858f91af8dd33efd4295928d91474fd82d40b7391d2935de04efbbfc76a8e059d767cdd4cc6ad80a4905fdba17b2efd49b6b25baca87d06fb01028f376cf0a

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

MD5 edfacb75badc81b8a5db19497fda6a34
SHA1 21f73bb42ff2e404963b9254813bad71ff865b35
SHA256 4f3ce63be14240708db0442a34495ace17e8354fa047807a8655f14436da1762
SHA512 e5443b7c9414a4158df040df300abf3be6659fbd38927bc5137c40b80673fab5c5669f663f6be9039e6ff9426df952509ae60db8991b9fe4a4a0ac46e20eea04

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GrShaderCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_1

MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GrShaderCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GrShaderCache\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 34d2c4f40f47672ecdf6f66fea242f4a
SHA1 4bcad62542aeb44cae38a907d8b5a8604115ada2
SHA256 b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
SHA512 50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8749e21d9d0a17dac32d5aa2027f7a75
SHA1 a5d555f8b035c7938a4a864e89218c0402ab7cde
SHA256 915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
SHA512 c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 5a7d077480873e73fc9f3ac4ebfc125e
SHA1 af0e06799f51ad64dedba8b16055a6917e1ededb
SHA256 8128692ed8c1a2cfece88284ec0c87c164b0cecb3a1ed5d9bd98495d3e631927
SHA512 46f815191ff82faed3867c72f7b8e0464cb7b3b24f83dc0f45f49b49052652039e3d2d79d246b858c2838a7a01d9b9d943d8022b73c5b317df3adb70c40c987d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

MD5 015c126a3520c9a8f6a27979d0266e96
SHA1 2acf956561d44434a6d84204670cf849d3215d5f
SHA256 3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
SHA512 02a20f2788bb1c3b2c7d3142c664cdec306b6ba5366e57e33c008edb3eb78638b98dc03cdf932a9dc440ded7827956f99117e7a3a4d55acadd29b006032d9c5c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 b169750e2b437d0b46e7aab4cdb65631
SHA1 0b1f0f7d0d3ae71dc8bb8b6785c9b07284af7eaa
SHA256 2f5ba209744afb918d426c49dd45010a3612168e1f10f7c3439b9c48d06868eb
SHA512 36e1fa5c08f9c0d7deafc26868c6cf1d911327bd8b15c718c26e4d2987eb14190f0de893d90ec521c59a1659327faec9d568e021be0f859f5fce0a32df418aa7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

MD5 858023a83e49a27fd10ac44f09837365
SHA1 95a43d9fba0a4128fc3e2b1f15b810b52b4e3312
SHA256 80d77f889bf66835fee35174f811837371d8b935bd98e2c073186d134b9d23ff
SHA512 855c293326b6ca767e27a6d623392e150427651d8bb5d7566ac793239ff8cc98c3664d1e1e22481c953477f913ac085eadec76ff1dee97fdc16a49bb1d1dcb87

memory/5796-1171-0x000001C6D8880000-0x000001C6D892C000-memory.dmp

memory/4312-1172-0x0000024913D40000-0x0000024913DEC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c6f0e69dcb449ebd273aa7bd7523bbdf
SHA1 4392cfd2d938ccb498fa63832545938348974415
SHA256 193ecd7c502a86a569ab5e77b96edf7b82b1ca0cee521e5af3ce691b498ecb97
SHA512 de780efff67c46e1c23708f9a64e44198fe527e033d08d2eb2ec2fa69bfe2bd5594e14ded7f344769fde43fceb12d704a26f41a37e6c51efaa61f2aa3a76fe2f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 7e790a8c9c1ce430abac4bafc315123c
SHA1 3e13582643f6a5a13d82003c29d19addde58e97c
SHA256 31413103474c5d44578f01be5e3755e2720db913eb70a0637267f0ae58f82ed1
SHA512 17781cc1dd953eefa30bf288762f51f650c7fea0fd994370a4bf5b2e2ceab4d86956178c917fdcf78bed4ee9e3a9f23480a9f890795ca6ae4be8f144caa34cd9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

MD5 47accff7277da95f087e5314f772d6e9
SHA1 9d2cd16c0bdda4ffff7bc6aa62ca2308cc51835a
SHA256 1acbc509e4807e63e8f8ea84cd82a167ba9f24699630fbbb5bd135612955d709
SHA512 e545227cb8fbbc3e77a868650c26fc94bde74c7880ac536f1cca8094789b5e45126619b2e9801a46462830184e603cc2bf02f963197b22956ceab423e22481af

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

MD5 fa9235299558ffe72c06907820cd603b
SHA1 49f4ef834c233189091678a23dbc7cdbda16f5e4
SHA256 8d43a497e81ad152d80325b500075c45ff42423f99aab0fe45ef174d197a4e73
SHA512 63ff8d94dbe09b493f0ad948457fa3d85a6aaec538c5c324b6d6bd37cf56067a5ddbdf322d2a00feeebe3c1dd9e0f56bd7696f76a9cef78c5f644ad9293bbf28

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

MD5 f61f0d4d0f968d5bba39a84c76277e1a
SHA1 aa3693ea140eca418b4b2a30f6a68f6f43b4beb2
SHA256 57147f08949ababe7deef611435ae418475a693e3823769a25c2a39b6ead9ccc
SHA512 6c3bd90f709bcf9151c9ed9ffea55c4f6883e7fda2a4e26bf018c83fe1cfbe4f4aa0db080d6d024070d53b2257472c399c8ac44eefd38b9445640efa85d5c487

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

MD5 9a95812cb17f16b3be234454aae14f6d
SHA1 e5786798e510473ab441c232d9e0e413a10333e0
SHA256 bcafb4b7e44312e55ead0b9804468198f31b2faeb746ee704da79e73b7237ab9
SHA512 f194cbed627bac70c24ce6af1b53be7bcbdd3b181501a35480711af7a7371512580328e56c2577afe0a558d60053297d008e501eee514c42a1ceff164fc03a2b

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 e17c9fe07ae3c0b32c2261bd65c79afc
SHA1 5502d8d491225776e81c683069e531fab0b34b0e
SHA256 45a48764a32fc57dd489812c36d7da2d813505e758db049f2c7651d93835c94c
SHA512 61bcd77c3bd645cab7b3040b388cdbbc8c197f28342158510acae1e0a2963f901796e8b9b465fed8552e6383e5cf88c6e3af78042598e129683358f2c7a1dc9a

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity~RFe5e56a9.TMP

MD5 f93f51dc61c67caaab1e53807d464ef9
SHA1 4ba512e97a6c11cdee03551d14b0238c33513de5
SHA256 60eb90a4efb112bd3f23e976de34c09be41c3331cc797371d8c38497ad4c871e
SHA512 908b3ed39a7c89b3ead551f5e7a39f49ec89ed625fe73afe7651240b939edc40b81c867cce0a99c8228551b0694fcbe8f7bd86dacb8d3dbed1f82094e179f87e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\c3137f8d-e8f2-46aa-85ed-89d0d19639f0\index

MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 a16ccd724fc582122624549a90794d73
SHA1 b768395cf186efcf58c0f2c6c2ef27800d8aeaf0
SHA256 c7599094ef3ab32ad1ac8a4ea89ed4fca316e23676f57f39c4eb5b5fdc99c027
SHA512 7204155744bae18406af38e7a78263b838173f0d00152749c94335f8b8532f767058813a86eb2261e74797768b436128c1d5c2592ead612f2c2d54336ae2e11b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 87a61c98014634f4a8bb5d4d24aba11f
SHA1 5210f4451d9148491c1ba423f8374c3f666dc664
SHA256 bba8fbb5793aae79bc19a70f602d8b8a6fa4169f6ab3fbbe10c584546a20ed27
SHA512 bc1ae8f8baf9aa6bb811c1f8be7989b02658936a7d18e8d443dfd2f76ec4341f47307ab5cf5d60bffa41ee5c7ee05bfadefe2f2afb70d12f2870a83dc235aa6f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 bac5e201266233e9396bd285c340042c
SHA1 c81fcd15fba61bd8dfc8cca4d8cf6d5a24b7195a
SHA256 911c0f02381733e09cc0fe92d7ec8e402f25b23c2c04df4ca7b878f1330615ad
SHA512 2f8ebbda833322a9c796ba344346d4c44a9e049a4164a0a9223f35ce5f9dc9275b7bfaa3f7bbce2c875d72d47cf35dc52d127743653014c95177c4c841c0bf8b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 2c561e005eba02f5d2c2638237f0a91b
SHA1 759541fdba0859dc6b2329d00c63e65f7b5770b2
SHA256 382b37f35c835cdf25b52ddc4ac58b71bf251f892c117fa3f716b0c659472000
SHA512 84a8f388da302b123b9d2eb66bb5e0e1667791ce778e730e4d41cd16451e815e5e0de7d8b91644bb5eb0e941c9337297585b5a932f558352bf18ffa5df531721

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 bd5ebf5dce945cea3723afcc8edada1e
SHA1 461b4e9b07e24831ffad935d9d3d01c77a8db676
SHA256 196d2ca3611266e4cc61091b1cb417745eb29c19018c3bd8d60f81466b756705
SHA512 b0f1a7135be748ebf999287033092549b3e80f7d72252aa94e01f0d1b94c3e3042f247bd737432981523c39c01095dbce6275dd51ca64443319f923a17e2d57e

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index

MD5 1e931b60437666190ab31fe75aae6fc1
SHA1 9574ac6aaac63776c72bc0f44b86c85709e7d577
SHA256 b7818bee43947c45290243a9feaa9696fdcd090089ca773f8d5ecf1158d11689
SHA512 f40093d298631105a15393275697ba011c90d7071af8ea0ce3f0bc33d0af06abc6bb6166b7ebb3262bc2e9d76f69ba18e2be354731501568c2e016c9e8959d0d

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5e6bb8.TMP

MD5 eef084442e69ec5f0e66892d6d2c608b
SHA1 f93029a2a8acc53c9cdb5ce29eab05ba24f5c978
SHA256 0402804315884e4ad22f6b724d8cb0f6a7408c0093b261fc8729cb828073bbcf
SHA512 7177900006bc58dedb61c8eeea9db7555923f46789147bc19ae8d9c7ecb16c796af71b91977126db038d0d23f7778304a51ad365461193c0ea0bdf26eef63357

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 a80e0d4467ad7bf8fd15448c0db48ca8
SHA1 494729104c41c23a68a23708799e5eec7f356349
SHA256 be6ea744326f917bd37197772ca646670170de13921c1639774939bc008bb4b8
SHA512 2c8d016d3ae6b588efa86c029fe3af26502f9e88fec31299798e8553952b2f6dcaef57e5e3db1346f959cb8d8bf403e7a597e9659676190fb6ed05bcc70188d7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5e6bc8.TMP

MD5 3f2749eb44da8e788d2daf8d8de1d661
SHA1 65e47797b650550888ab1f534a4ed19d82d12198
SHA256 6870d4e1fa3f7545cb31bc9976908957af8b5b7aa13aa20f0a434ea418b1e4c8
SHA512 683a6135e6e03b72198bb4b7d9eed4bb9a70ee1b24482a418b9adfe80da1cedee2bef30c402dd349c7ffdf30d1782e5763f18846e6056a2f525e97f175135d52

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 0e12b005d3a8ef2cc04f6534536cbab2
SHA1 f3c458489481fdcbe041bfc0fc950bcc16b41174
SHA256 8e741024674ed3697c7410c779ef077e28c730cc1a07d0b83add4ddb37beb433
SHA512 5fbc0ce0a0702d6c279c114b8af113ee06eac330d4457c4a4df4eeb7f11ca24bb1420446bf55ef0d9fa42677e6a0b1209fa18d02419a14aafbad7d9f7a535846

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

MD5 778ca3ed38e51e5d4967cd21efbdd007
SHA1 06e62821512a5b73931e237e35501f7722f0dbf4
SHA256 b7e1bfadb8d9c061f17a7234df012df7842ab1aa8fb6f9579fa3f0a3b4a75bc0
SHA512 5f6f02099ca8079305fb7e7f43ae4344d522271fe30379c0854d6a81b7d8adf408a50a4b799b5f52e6ed162ba6ce7fe97e24a2b9719df780e75683d3aa103d09

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

MD5 1183ace68690f4de0c3571f4ed05cc57
SHA1 bd7478a0244ec28985db90d59e72604c687fcf1e
SHA256 87a41d8b8a5ea4808d65574908b2c63e0b925b06a8e2809b69b9c204f235f62c
SHA512 0a82d1ed585d014a25ca4ff3af2e64e83f3a529352a8893b24f4f1150a495de45906430e0ec0bbf0b91ac62e94c80985ad64dea2df45fb8ae2a7621be2dd5d9a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

MD5 8eff0b8045fd1959e117f85654ae7770
SHA1 227fee13ceb7c410b5c0bb8000258b6643cb6255
SHA256 89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571
SHA512 2e4fb65caab06f02e341e9ba4fb217d682338881daba3518a0df8df724e0496e1af613db8e2f65b42b9e82703ba58916b5f5abb68c807c78a88577030a6c2058

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

MD5 3b9f9328178ba859f9e855cfe6399b1b
SHA1 9319c5dde5b916563adca9ca1bf752655f6458de
SHA256 4bb9893cec3b4b218957c9bfbbe39d97ec19f2c2acb3dbceb4a0ef3e681b11f4
SHA512 652fbbecd15e8bff889fec2a223c87d93fc094ed402955ac04cddb4ba2e0bf40c90c2a5b4a545ee292fe739540e1b1c8e7e93fb8841d8abd15001d77e666d565

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 18a4df1116fe099eb360784c5853f8f8
SHA1 7efa7a315c8f45cbafbab6eb1843e8dea6a50eaa
SHA256 4deab7eb56371e291ad479b2d30d04c1fd7eee17abb10f6e04e28c11f247c5a7
SHA512 813e3dbf415dbfc33945a497f398860476fdb591bef1584343324fdd538e1ab373248c157e1b6a8098dfd990df83f7bcfe3a6d54376473e63faa71140753d690

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 3fda15e9399835d2407a3d73d9c3989b
SHA1 5aba65aee901e11f69e5270fd28ada831ab3f7d6
SHA256 88222e173f53782fb8218c5415004eca71c4234ce0c5d680be3b4655d9a928d4
SHA512 9a63e75b1dd8e0bb6c1156d274814fa2cbf5cdc29f7a8b6f1ae2bc52a377489deab3b98ec205c42e929f2b12235d5ad8a5d1eda509f468d20904bc12ad7656a1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

MD5 18a64802714cd620582e3070cfe247b6
SHA1 8b07b5a18b9378816ad4ea50545aae6c28796262
SHA256 c920432f90cdfb91ca4074cf59d22871407e1d2ac429b95c5ca46690ea4314f2
SHA512 f8a66354bf3b6ac887994f48e84d5d35fa38684c0c621f90fc9c846074518ddec7e3f89ca6a924456c1f54f8323ed2d5649893bc2d62061724e281a9a9028ab9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

MD5 115c2d84727b41da5e9b4394887a8c40
SHA1 44f495a7f32620e51acca2e78f7e0615cb305781
SHA256 ae0e442895406e9922237108496c2cd60f4947649a826463e2da9860b5c25dd6
SHA512 00402945111722b041f317b082b7103bcc470c2112d86847eac44674053fc0642c5df72015dcb57c65c4ffabb7b03ece7e5f889190f09a45cef1f3e35f830f45

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

MD5 c83e4437a53d7f849f9d32df3d6b68f3
SHA1 fabea5ad92ed3e2431659b02e7624df30d0c6bbc
SHA256 d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb
SHA512 c2ca1630f7229dd2dec37e0722f769dd94fd115eefa8eeba40f9bb09e4fdab7cc7d15f3deea23f50911feae22bae96341a5baca20b59c7982caf7a91a51e152f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

MD5 3d244d2cd60fc3130d8a6ebbc970026c
SHA1 209cb1588a39db12ebf0b3bfe84351d317c1e162
SHA256 13031d30807391135a86d00d923b08150cf05ac81fd127920c767ce34a07f769
SHA512 449098c3f7b6c5b415c54acccbecb46fef7b01241d1cd29bc4eb6d88c4ca76c3ba02e6ef982bdcac70bdfb079386a35cf7ffefd5381642c15696b020e0b86df2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

MD5 8b7e7b8c23b3258a2797eff7ee34f466
SHA1 c14bcce1022711ea331bbe8f36934dd7a668b1e5
SHA256 1101c3511b7b6e02a37264660514fb7cb52983b3c878c83073cc62914a446aff
SHA512 868dba59ad30dee43d80dab8f0c73993157f94f34dcad866235b51e506af92a4344c601c3537dc13e2cf192671cb09eb1496550fc9c7b28593d176c7b6842dbd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

MD5 8896cb65e02f504c952cfb0b9d555e66
SHA1 5d9996b5b64229f2801d375611eb1b5fe3a0dc2f
SHA256 784fa9764db693f0482d7b760e0a249f54e9bfceb9f717103a908f22b201c184
SHA512 29de6cf175d4326423c204aae6cf92b1d26251b67a09652a1644c58963b0e70be1331f112c13467a8d6563ac2beb635ac31d000376e5a3ecf31d07bd4bce9c06

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

MD5 04c55b15f7198033fc8717dd2a3bf0d4
SHA1 ae356f7b4f808fbf1b9ed22fd20a94df9398cf76
SHA256 f34fae55aa8babdb4de8ea7b7ae2f8a02ac400b84152b9efd3081c225dd1c727
SHA512 4a48d32e01d138e90e09aaf83dd6a580d28176b5e12c9ee46dfa42994c855a51b45762c5fab5aee68816f61fb1fe2a501188db9c8227cdd1e31344fffff417d4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

MD5 69dbd6ee16d8fa653ad807bd7aaadaaa
SHA1 93996849f6cbcb1de0b9b49036a3e294ed7bf1b5
SHA256 d2f65062d74e0e67e6c84f55446442fa94b57685dbfff614f496538154d835f6
SHA512 aed0786f5ac60d1ac1d2ff6789e1713eca04a5e6f78e2d7da689854bbaa2d5c0e1dad4cfe68b07e65dd1d43ae78d3614006256da8b95a8d6af33233973c38eb3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

MD5 d51156aefe1bb617bea2b80267421bf6
SHA1 21f5fb668da9d0a0b6b71f2c4f4c2b6ceada50d2
SHA256 add2bee75d3c9389bfe4ccafa5f08a9f1d3ab2f644c7ea02255070479d09bc72
SHA512 fdcf53ba59bc5e72954c6f13183e248354fbf6be8a51ee4bb7f4c9d01ca39c27c1eeed184572900caa4f48d279acd2b1c3ae0878285a46832f0724093898d8df

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

MD5 7f043a434014b2d4b45e935b13bceb0c
SHA1 5c4255ed66bedbc0b2c267bbeab8b6e234e649dd
SHA256 a227cf1bf68ebd49f41498bf352931f295fea01e41baea95c76f02318178ee19
SHA512 bea3223b5a3f315d2933b349872ecc9c2d87b58d7aa1875029854749167e66dc5136f9f465cd43c4ecfb5bd83e73b73c0264fefddc21b8617a40f0f8c3a9ef67

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

MD5 02d2b427b3a08796b1efc9b82eafe607
SHA1 e189e702bfdf3e02a73276383b2ec5cc7be8cdf3
SHA256 e45463a8a17648cc41e15a51dfa9ddd35d6ca9a28dec430ee7b8aaf52ddaef08
SHA512 a2221c0b35d8c3abfb95586237cca0c6f44d7bedea07dec9306d0bbee73e87c7e7fa3126395590f80ddfd68e761361899236cee4d080584bd4bd3609e00bb934

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

MD5 401424dec575b5bd40fcdf3d8e156bf9
SHA1 fc7051e7c9c855a7d396e2d6eaddaadc2c2335bd
SHA256 014e7cd2d67b5573a78c65ad805f7ab1ddf085f5b23ee6fe73af8d8f49b4ad89
SHA512 4a59e0b1a6326914570f75af0344f5da1cb64c053a928916b648e318dc232ed0e1cd4ccfcb053dd29405395203b7292c45c8dbc2deccd82e1081b55374e2640f

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 4e8102c664f70525286ebe4f02f7bb50
SHA1 6660485f84af93fc3039cae322a6e17521ace47e
SHA256 c02bde5529cecdf5049313bbf2ada174784e206379233c54fe088aa26d83392e
SHA512 706dcd470917b97236a18f418fab7fbd273643de28caf58f5c41f2461f78dc4398c252df6e1b57dbb87b23323a2552750ad50dde05b9dddd54c9b335fa779fe2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

MD5 a2edb5c7eb3c7ef98d0eb329c6fb268f
SHA1 5f3037dc517afd44b644c712c5966bfe3289354c
SHA256 ba191bf3b5c39a50676e4ecae47adff7f404f9481890530cdbf64252fbb1a57e
SHA512 cc5644caf32302521ca5d6fd3c8cc81a6bbf0c44a56c00f0a19996610d65cf40d5bae6446610f05a601f63dea343a9000e76f93a0680cfbf1e4cf15a3563a62c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

MD5 52713fad4684225bb12287831a630472
SHA1 157ea8d723ebc8e04f3bf691d75af91888b88d7c
SHA256 a58f5fe2d8ad7860f9d66808fafc14403e6f8e0ea308f0e0e15bd17676213b86
SHA512 418688f3b58e4cefa34dd283884cba8ec184c93ac2ae573583ed588e4177e324dc7646d645dfe1cd4449bb27781e459ced713bfe6fd6cef45510ccb392cbccae

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\6dd3383f-1d7f-42ac-be8b-b36232a8156c.tmp

MD5 64d78f8b2f74de5e1fe11a9e5d521e39
SHA1 fb4f34e9cac7e2d4c7937f9cb8331fbb6c3f7308
SHA256 83974bfd4564e00b60f0aa0442042c48ec1a747c31260a020f5046af4a9680ad
SHA512 a3098d805fff7760fbd0a3fe789cea390e7613a2522b6b577905cd382b4c67c7c6cde19671cc273dda9f74dad5dba5a2549c99ed861819c0d418b7b017eda6e7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 0f1453829863f8c5d4838351b168eb23
SHA1 d847d10ae91e82b1dc630bebfc33d04f09c3ca30
SHA256 36e9ceb8bd88e2da15c70d9a95c50d280dd4f609f86fb70b94c91bf911817ef0
SHA512 17f6113c7ad6c9b764d2a5e364abbe16352ddbe04e8424beb59e61117383b4caf8ffb3390090fba0e48e73490523bd272e5e173213a5a9a30d264ba00a0fd712

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ca8822558ab680628be1c6dc6875e67c
SHA1 8c3317726bdd9d79bb85f5ebd15cf8de97199771
SHA256 335e82da5fb0cf82eee65b7fecc274b50ab9ddf27c257c3ef996db0df2362a47
SHA512 6eed17ef03d05e793dc5dbe29c7f19b2473553f1a0190770dbb6fb28f8515f55abe840d5424c63cfad64f5fccfbdfa26bf5bea5849f41edb659897e2fb6730eb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 925c031893856f201d4161ab73cc7dde
SHA1 2851903c4c9e2de0df79bf2428d707a2cb52e145
SHA256 e435f499e3f9de07664ccef31a0e8a49606c7ef474d5b7a9ab8a4f00953d2726
SHA512 5157be9b44402d778860295cbb3a2c79e0fe2e49703d5dcfce3b1872287dfdc9bb213bbbd4f27916ed76417ab32eec7de526dade2d0e02e29d08838e9c410dee

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ea7c7.TMP

MD5 46f9e8b879acdfac42a8347814da9ff5
SHA1 6b6569aaba08d4a42064167b419d850432a7b30d
SHA256 34cb32dec72e2babe079f2683f93852074031f470c96a379bb7bc61b2e35622c
SHA512 8ea8d44c63e6b9cd4e41ca8e74383389d0314067f2ba1657f552b8fbdee993c1bd18f3b5d1ad5aed080f9942136749a6e214862aa74ca9ce6f446a6384d7ddde

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 4c21020d5d90a9ff1654dd4a0a57cec5
SHA1 7015bc49c2aa4c90435bf15e1d4c11a61f408c30
SHA256 f0fd881a67467195f1dd9a02e4f4a9f6b1b413be36d5e2b90fe432b5e827ee06
SHA512 d82ab86adfcc00087727858925c9a146c8bfc84390577f38ac71c1793e90877c51efdb5c370bd52e7c359726733de4b6290d8cfe24f8c5d8f6e4347bd505e2c7

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 ab451b78a8f1e04b04f1885d9396ff76
SHA1 53602ec4843a68e3dda075a5bef0843bde58a013
SHA256 ac1176f0f98fd9e5c52c92dee34ab97468770ec98c57d1a8217c0940e2433904
SHA512 e0883f37f2fa7a9e5addd65ad63549a430d48d9562c552484471b300bf06e5659c5c7c92952551a28951bf19c0789fd6536bdbe8765cabb249e9f69f47958713

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6d782603-0f46-4a36-8d2b-afdffb92d251\index-dir\the-real-index~RFe5ec64b.TMP

MD5 a9409eadaee21499f31e80a4c6f287f0
SHA1 dc6dea28371446b9a40087620ab25f845ea257ee
SHA256 44b6dfd5cf1eaff803ea68cb081a1c7dbc8d859f370fd7d42c0c10fdcfdcdbaf
SHA512 1516af7bcd12845326b45a6d7591667b1e9256c65882a1cbe9de6bf5eb2af0a336378a8aab37f84d13bb0856ccef00613dcb718b3db9bf1472169d57a3956bc2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6d782603-0f46-4a36-8d2b-afdffb92d251\index-dir\the-real-index

MD5 1e872af193490fe5b83cc3630d795334
SHA1 78bee0712f725aac6a6be53ba0ad5cde7e471832
SHA256 44af26a017a31493f72fddb60d0e528f3e123d35bbdf40539798e6253e8dd318
SHA512 38a5f3063333087fbbebdf48e71e5ba8132cd338f7e7ce5940312ac545c970bffde312648145b51f3b11474a1458c89056d28316db7a3707a4625d466ad33e95

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 6aa0a55e219b43448f1f06efdd393dda
SHA1 62dfa6ae2188ce6f4b306780abb040b216ac39bb
SHA256 ed6d53d611c748232d56ef197faadbbe738f03b3f9885b3f377f26dd76fc1164
SHA512 5b73b7f16cc88d4051791494aec5285808cee3c6a30f58bb45120b73567684c0a0f6747022a8cde709809fd734d3a7edfcc480dec2a9717650bcdd2867a752d5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 9062c6335afc0a1a640b51510e837824
SHA1 3a298af5b88b2814ecc701ddd4e4f41281a245d8
SHA256 a1962e54a02642ac058978447a6f3c33bb02190304bb291820c113a5e0c98a9a
SHA512 9d44c72ef3e357ed0e24c6a77fe61b0a44f5bf6eafa07fd505877084ec2ee7ccab508598a1cded632b4840172f4960ee02b9907c887f68480736f84b9a7bb454

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 d40ab8dbb586a58b0e426b7c5f7f46a2
SHA1 dfa852622e8f54c3489b34ec699cf3641b276bb3
SHA256 a9266e779404c521a68822ff6f5429b51b6e1be5ef858034b09600816d76ff17
SHA512 e647383612cd8825fd8478d5f7913005df6247db53044d21c3ac1a0116ed923e56c067376a7a92049dfc9230b6d7a8be45525675230a6e4bab642455eee0f6e5

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

MD5 61fa111aacdd106a5956239433e3e09c
SHA1 f7b72d579e15c9af1c81eb938ac64cfd550f5b32
SHA256 e93cae8d694d731a45c73fc77b1154119c502cc83adc6df7ec179a94465c7262
SHA512 e6bd31aedad230ab7c73a72594cc79f8b17f1cb7dc874d331da64c95df5154862b4a9befa67e6d46dc9e77d29ed54b5c40566d94f2e682a05695d6626246d8a9

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State

MD5 6004bb573647b244441ebd68d22c178b
SHA1 f3b22bc1141c14d5a002ef2d0317d650016bf4e3
SHA256 a0421931f17919d48fb5896768747e197a75f5a83b5415d7ce963a7e870c3ab2
SHA512 62e0eaf11b0a78b08fff7f46646f16dc6baefdf29d276c2f0babae9692a374e581979c8fb181427457fc05f2c84907681e7d953423fd663f4c72bb01a4597b40

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State~RFe5f1362.TMP

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 0011e17c001ecd85d9621de30651c093
SHA1 2b55e094943df785d56373e7e79690f1c2a982ba
SHA256 d3dca8a772ad66edf0650bd697e03f6f8c3152a66cfaa01028cbe0fe2f4ad329
SHA512 0f601f6f2e22a26ad98b82080a5e34a3e67588ec8711473f6a102de26e946be0131e144ef5b0c6ce32915c88c2a891581f8dc780c8a2f5f63050f89a99930ae1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 763fd13d9da1e6d1e28b57ac11bc4364
SHA1 37c0a5fd851a027812d548fff03e7bdc5873cf8a
SHA256 55672a1640e82b1b450c585ab5def795474f9a9f87057523fcbebe7765767e30
SHA512 964815e1610ed346c572d9f55e49176c0b07bf1031d965b82f4d15add9af5fb30f3a10dff6f4d3599f68c335b73be159d1897fdbc0cc04d24475ffd5b3906bed

C:\Program Files\chrome_Unpacker_BeginUnzipping1628_1497117796\manifest.json

MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f

C:\Program Files\chrome_Unpacker_BeginUnzipping1628_1497117796\manifest.fingerprint

MD5 5bbd09242392aacbb5fac763f9e3bd4e
SHA1 14bb7b23b459ce30193742ed1901a17b4dcf9645
SHA256 22b55f5d9b1bafb80e00c1304cf5e0d6057a304a2e8757b4f021b416f4397297
SHA512 541e4c7998e91a5113f627c2c44e32b54878fe225b3b9476572f025f51f2b4ec4a44b102498adcc22b8fe388970645bacfafb6e7fc8a216df4d7bbfc8b0ff670

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

MD5 7d666af3a4705647cfc6b91cc95d9144
SHA1 d2ffeba668d6b5a62a963f672e10ff3769f60122
SHA256 5705ce9ba1e0f66e2780453259218e2edbbb3e6f3d00c787f7c48cac48a79662
SHA512 329bf7025c5a4d1e8e3e83bbe5a4d196275510b89dd0fda8442fa67a1550672542382d5d1d7e84ca57e266ef3b8bb53386980cd3a29690a127f781d75cfb523f

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 bcfdd2c72bcaf7b4c80180dbf8c673f7
SHA1 702830519b2cc980af1c0276ae5469570571895a
SHA256 0a684e28e82e283a6ab2e98c2594aa4b057889c87e947b27e4ce0ee9e874e233
SHA512 ba52d25231afbc02f0c8664cf298699fa65bce283bacbedbca0e23f1d44b7bc154259be42da9fc42586ddbf25e7e3e2ff4e74fce1fb15983721702b44f29818d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 28599eb4ab4498b2d2772653313bdcd7
SHA1 c0fd1c947a69a5849bed3f5c27b96e6de869e997
SHA256 17dfc71b504b8127b3ec216c053fb7893c9c5bc2557407fd91d45ddfde88d568
SHA512 9d6a887d9c1773f8266ffb0a698c206c66ecb24a6bbba24c5881f9c44f099c4d1aaa69353e40e6e36435c6e1271ee6095ccb848ef87b0c900446717d1c685278

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 4c15c7e50a4a21e57291e57c76ac6cb9
SHA1 43ffe852e909bb9bad5f0b462b914a5657547766
SHA256 4ab1a021044ee7b2b1d12f1e89235f2ae434a9dbb84c76342001b1e6235f3c10
SHA512 6d3c7fddb54a2cc7f563ac151374ec7e305a1851ee051897f21affd8335a2a129c751597d059ad33ef64a5b27deea04e6527bb67c97752c889f3116008c68313

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 79a17621f3085d64f6931638c2c5d068
SHA1 41cf4bc41a6d2cc155ed7e35c85055e72ff86bd2
SHA256 a31614b22d03498a4b1af6c94f5a13279386be65229eb71d7dbbf8e5e3b8d257
SHA512 583d53cca0acfd772bea390e7c33ea655ea3c378efea46211750e258a8032f9ac32213ccd5d9e1a97403493037c04a26f7a39c9c57ce1ace23715c94e22ca813

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 5767a1446bbc03c905bfb86f8947a163
SHA1 19d2bfa8089bd1777b794f01ff9af235479f5dcf
SHA256 1ac364e67c898f40216c1a6df08a4483e9c086114ab2cc5eecfc74e4109ada40
SHA512 0a4bc9820f831fe29a39ae0e28bf3d44ab8f7e5c28c1f2dc125f29ef24e5dd53e8b52107f4826cb146edfb03d3e4a4a12c2ea6348003f6149403a97a12641351

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ece74c54608eab3c5c677b8ce38a811d
SHA1 c72f77c120ffea7c0511d5529e8eb2185c32a542
SHA256 05e6b5bb48d7f0a1072df699a0bf2399e117760adba270aafaf88f5dabfd0d40
SHA512 4660db5c514bb7a36ca3d4954a6dc90edcf57d809b824a3e904dff0d797d854e92d05109025c682d26c1f89491d2b3bc6a7f516fe5f761675d989f33d069def0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 dac60db76bcad20e70004c1ee21fe84f
SHA1 47c49895127c6cd409b775eea47271ddbf7dbc52
SHA256 869cf70e33a6f4ec9661f157d6603191ee211d891f092b6d61b1c93a5b1f4568
SHA512 8a20fc8bff69ec6cc77f86aa5f7af94ab7e2bb917eea709afafa71587c5facd3c2a201b50aee2a28d811854608df8fdd851e997697999c75fa766c84796ffb4a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 71a6047c932181f420189ab4d18fc091
SHA1 6ae8e89c4b2252fb386fa0c530225d56bc7931be
SHA256 3c7ba9c0e8692aa647e29256699436a8ea441cc1a76613ad471ff3fa1fc4920b
SHA512 5af8c7f18d0c3ab4aa1e4acb8658eff543a94dcddb46f71f48d5de0d8660a5f5b6df8e59e39f247009f3bdd34cae35c7ccde32cda086ffe02efc4813ed246bf5

C:\Program Files\chrome_Unpacker_BeginUnzipping1628_1574363644\hyph-hi.hyb

MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

C:\Program Files\chrome_Unpacker_BeginUnzipping1628_1574363644\hyph-nb.hyb

MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff

C:\Program Files\chrome_Unpacker_BeginUnzipping1628_1574363644\hyph-as.hyb

MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

C:\Program Files\chrome_Unpacker_BeginUnzipping1628_1574363644\manifest.json

MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

MD5 d3644d6e3a80978a2e6a082ec63b6099
SHA1 284cb50bdd29a3acd83bcb520cf18b6560dfea55
SHA256 f098f784aee31e32dc6967519dbfc519cdb30ffa835ed0b1ea056a01f61398ff
SHA512 2dad5f1ebdaaebbb5a1c0d7be03add658f1f41ae0cad87585ca6d44d5848b976abca3132af9e7757e00ee9ec5d7ba9257827df675910de756ced143430177a87

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 095c42630b627e888cd76d64683be528
SHA1 3a1e239ce35a4f9e34c6c457f02273eb3e238869
SHA256 7f04c7e87b245cf4b1207dbeb15cabd5c4fdf31962438317aaff40fa29d5ab35
SHA512 0b3fe304dfce0d37cc2b5e771e2a7c98028d51255085ca8a362528f7d12142da9c09a6c1d2d16c91cff6bfcc7b38dc5b9b67ff2ada18bcb47c11ea258e416cc8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 6445a6143eb488a0682fe56ba4e91960
SHA1 dad8d054694ed356d26636f004e2bf8e52ae6fcc
SHA256 178c921a999b1354a9ad79da5bf31ab5aee731e4513e8108578273f9a3c70700
SHA512 9b767487b5e038c7fd1360e306b288ffe6b5782af4505becb98d4a7e519098b467432bdf5c48a25a7cac6c98f3846d818299ca70104aeed868ab13872abbbe9c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 fcf4a6aa181daba37d566c49ce0da267
SHA1 1eb81ff0ebbf8a979905429d852178b86b848d74
SHA256 89921043b09e5918dbf089090f52bcbc4c7a5ecbbada54f029cf9ee68b7b5403
SHA512 3f5e0251f91bf75388997b50e785078e539c641dbc6134db8e71feaca4b2939f3cb5388ec1f3851e41d20b0115f66c1534ef8fc2ab4b4e52270ee23ad4e35e7a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 4453013e9bd5cc8112c66967aefa1098
SHA1 48ab1c479cfd4bb275fac979eba5571849ea13f2
SHA256 53f4d0e295f8e38496601f993673fb0cc985ed1bc8509bb97c02612d84c6a996
SHA512 b008455efcba9f5e2cbeba9fdc1e8933d1dc328d3337b778d7c9aaedb9f44a7b9ce59defe937e52be2a23d9e831f78921fb7f15d3d83f92eae6df2594c7e49e5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 f2935125fdade4ad072d6479332cb815
SHA1 9ead06620a1477fce38798eadd09a5a3dbda7c75
SHA256 31c6a251e7c16ad75f618cd759f45a458ff6209865fd4e783b0fc5ef693e3730
SHA512 ffb4a28fda2239f59dd128561edf2af6e71f0da8b1df50230d64727b1c8a0e020831762d1bdda5ab07f382f64d4555c1a9a3edb20619707ef7d1fe865e0b2ab0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 648cab323d5af63b9aed09dfbf20e74a
SHA1 62b0d6a0911f6f9b591f73aa6d8e07f3a07a4d1a
SHA256 4f77b633eb2db17b25828afbbc1c42daffc1676b31a5d12fe9f355efaab71393
SHA512 5ba505f141d64f9d367caea6898ccd5124335e0fc74c9b4e06d8b17aec778d60f212b522e894a0cf9bca9e199f0149d4e5300aa9e5bd4138da79f554e0cb9759

memory/6716-3099-0x0000016F99850000-0x0000016F99851000-memory.dmp

memory/6716-3100-0x0000016F99850000-0x0000016F99851000-memory.dmp

memory/6716-3098-0x0000016F99850000-0x0000016F99851000-memory.dmp

memory/6716-3104-0x0000016F99850000-0x0000016F99851000-memory.dmp

memory/6716-3107-0x0000016F99850000-0x0000016F99851000-memory.dmp

memory/6716-3110-0x0000016F99850000-0x0000016F99851000-memory.dmp

memory/6716-3109-0x0000016F99850000-0x0000016F99851000-memory.dmp

memory/6716-3108-0x0000016F99850000-0x0000016F99851000-memory.dmp

memory/6716-3106-0x0000016F99850000-0x0000016F99851000-memory.dmp

memory/6716-3105-0x0000016F99850000-0x0000016F99851000-memory.dmp

C:\Program Files\chrome_Unpacker_BeginUnzipping1628_604297579\manifest.json

MD5 2188c7ec4e86e29013803d6b85b0d5bb
SHA1 5a9b4a91c63e0013f661dfc472edb01385d0e3ce
SHA256 ac47cc331bb96271da2140941926a8accc6cb7599a6f3c17bd31c78f46709a62
SHA512 37c21eaff24a54c2c7571e480ff4f349267e4404111508f241f54a41542ce06bcde4c830c6e195fc48d1bf831ed1fe78da361d1e43416cfd6c02afa8188af656

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.57\LICENSE

MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.57\Filtering Rules

MD5 d7c9c6d2e1d9ae242d68a8316f41198c
SHA1 8d2ddccc88a10468e5bffad1bd377be82d053357
SHA256 f215127185b2ee6b01e12b6ca75d3e5c4e454598dd4aed36124ae13d59afd547
SHA512 7fd14824e9200dd99e1fd2cee402656dc0cfc3d0a60058c5eb05c68e9e65b7f0b47e550fb4d6c2b59eba204dbf3ef9e69dc9723b43a9b3ccd5412d6b77715fc3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 e016a209233668f1d1e0f93139e242d9
SHA1 bfefcd261910fa13bd9357fa5ab79c3113ae1eeb
SHA256 cb0522c6d9d96e470940a16d3e24fccfc71905a6b253294786b5f723aad734ef
SHA512 ee1fab3d6348cb3502579da68ec6be19625f2f84e5631c8d2035d8fa69e414b10ac39a41b8d05800d4de003851cc22e1b47d013fd060bdc31df63d2443559dbd

C:\Program Files\chrome_Unpacker_BeginUnzipping1628_1192194367\manifest.json

MD5 58d3ca1189df439d0538a75912496bcf
SHA1 99af5b6a006a6929cc08744d1b54e3623fec2f36
SHA256 a946db31a6a985bdb64ea9f403294b479571ca3c22215742bdc26ea1cf123437
SHA512 afd7f140e89472d4827156ec1c48da488b0d06daaa737351c7bec6bc12edfc4443460c4ac169287350934ca66fb2f883347ed8084c62caf9f883a736243194a2

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\AutoLaunchProtocolsComponent\1.0.0.8\protocols.json

MD5 6bbb18bb210b0af189f5d76a65f7ad80
SHA1 87b804075e78af64293611a637504273fadfe718
SHA256 01594d510a1bbc016897ec89402553eca423dfdc8b82bafbc5653bf0c976f57c
SHA512 4788edcfa3911c3bb2be8fc447166c330e8ac389f74e8c44e13238ead2fa45c8538aee325bd0d1cc40d91ad47dea1aa94a92148a62983144fdecff2130ee120d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 be46992f288cb3e1a800f7e0240ea6da
SHA1 109cdfbe4cc4b262e1f4671c25bfa1ea027b4a23
SHA256 fff07fb932f851209909bbcc29e632353409ad0164256c0df73c47c35f2a03ef
SHA512 ae444ddcbfc01f22928a01e8587e1ad8543cb9308ce06647616524e03e240e9d31cfa5d8766691626f16e8f57b19fae0251ca95632d510b510b319f546ba44cd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 d35a5724d63339c3e4de4337ff2db0c9
SHA1 a4e3167adac0f069b28ce74720b6b5adafb354bc
SHA256 5042aa44cb8b3e5f36c1efc547c893b7008b7083b130ccfc9930c8901a48a234
SHA512 fbf464c0bd8dd6a7be2dc2c879f19f3c5c4ec6263a8cf69ff3307e935e930de3d0fd7a7bd950da26127a4b4a0c64fedfd96aa223f859645f149866884d9db63d

C:\Program Files\chrome_Unpacker_BeginUnzipping1628_930284266\manifest.json

MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

C:\Program Files\chrome_Unpacker_BeginUnzipping1628_112498612\manifest.json

MD5 b3b44a03c34b2073a11aedbf7ff45827
SHA1 c35c52cc86d64e3ae31efe9ef4a59c8bdce5e694
SHA256 e3649c54fd5e44cbb5ba80ef343c91fd6d314c4a2660f4a82ec9409eea165aa7
SHA512 efa957a1979d4c815ecb91e01d17fa14f51fafdde1ab77ba78ea000ca13ec2d768f57a969aaf6260e8fd68820fd294da712f734753c0c0eda58577fe86cfe2c5

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\PKIMetadata\14.0.0.1\ct_config.pb

MD5 f9d04f6b65d1a463f1a01ec39b77622c
SHA1 8f13311afc943d362dbb332b1c0fb289a722547f
SHA256 b42a2649782caefe33aa7f546a02b69bb292a0d4c8ca48602bd9c8dc623b3588
SHA512 16b6419a5d1848abbc668fff08b767af3e01abd71a94341baad7344c0dafa5951ba8e3bbe8561d79fecab03b720e0293e22b49659961d82587d3c7956addd71a

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\PKIMetadata\14.0.0.1\crs.pb

MD5 5533fc3f4c1820b787df3ec6fdc2ef1a
SHA1 f39ff89fcc1af711e8127c52ba55c8ad347e84a2
SHA256 56711adeba4ecafe298eab09cf0ef2f1d7f3260a2aa4366b927029781d270938
SHA512 5194c0562b8cb8e23fde7b561b00dd6bed93782f2e9253324a8e8ef05b69b66a549f2061ff3a9010a73a1412cc64889bc93931d0f212b8a68e39838dabd8e811

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\PKIMetadata\14.0.0.1\kp_pinslist.pb

MD5 fb4c5e847d5f30be002702ffab8e928a
SHA1 30adae5ee6799e233e29cb6825bde492ae6dea98
SHA256 2fa10f05494714d062dbac514989f544036509e4181af8352bf7f8c3b7ff2fe0
SHA512 6c0792c37f44835a10e412dc889e64bfb740337c0a94ae360149c7987216cee168f4b70a428fa9a63a99fa0d35640727450e1fcde735b42c6108ee3f9457f72f