Malware Analysis Report

2025-01-18 23:53

Sample ID 241114-z84dfstdmc
Target nice.zip
SHA256 84d83fb688595407f1fe5f6a83211602dbade6a9e98cd4dd29aa56acb528a0f7
Tags
steam discovery persistence phishing privilege_escalation
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

84d83fb688595407f1fe5f6a83211602dbade6a9e98cd4dd29aa56acb528a0f7

Threat Level: Shows suspicious behavior

The file nice.zip was found to be: Shows suspicious behavior.

Malicious Activity Summary

steam discovery persistence phishing privilege_escalation

Loads dropped DLL

Executes dropped EXE

A potential corporate email address has been identified in the URL: [email protected]

Event Triggered Execution: Component Object Model Hijacking

Checks installed software on the system

Detected potential entity reuse from brand STEAM.

Drops file in Program Files directory

Browser Information Discovery

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Modifies registry class

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-14 21:24

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-14 21:24

Reported

2024-11-14 21:27

Platform

win7-20240903-en

Max time kernel

121s

Max time network

125s

Command Line

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\nice.zip"

Signatures

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Processes

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\nice.zip"

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-14 21:24

Reported

2024-11-14 21:42

Platform

win10v2004-20241007-en

Max time kernel

1049s

Max time network

1055s

Command Line

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\nice.zip"

Signatures

A potential corporate email address has been identified in the URL: [email protected]

phishing

Event Triggered Execution: Component Object Model Hijacking

persistence privilege_escalation

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A

Checks installed software on the system

discovery

Detected potential entity reuse from brand STEAM.

phishing steam

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Notepad++\functionList\javascript.js.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\updater\GUP.exe C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\contextMenu.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\autoCompletion\perl.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\autoCompletion\javascript.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\functionList\bash.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\functionList\cobol.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\functionList\perl.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\functionList\typescript.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\updater\updater.ico C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\autoCompletion\lisp.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\autoCompletion\BaanC.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\functionList\sinumerik.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\autoCompletion\python.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\themes\DarkModeDefault.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\themes\Mono Industrial.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\themes\Ruby Blue.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\themes\Solarized-light.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\themes\DansLeRuSH-Dark.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\autoCompletion\cpp.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\autoCompletion\autoit.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\functionList\python.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\functionList\pascal.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\themes\Solarized.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\nppLogNulContentCorruptionIssue.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\notepad++.exe C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\autoCompletion\actionscript.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\functionList\autoit.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\functionList\rust.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\themes\Hello Kitty.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\themes\Navajo.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\autoCompletion\nsis.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\functionList\toml.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\autoCompletion\tex.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\autoCompletion\typescript.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\functionList\fortran77.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\updater\README.md C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\localization\english.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\functionList\java.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\themes\Choco.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\themes\Deep Black.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\themes\Bespin.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\autoCompletion\cobol.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\functionList\php.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\functionList\cobol-free.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\functionList\krl.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\themes\Zenburn.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\themes\khaki.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\themes\Vibrant Ink.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\autoCompletion\lua.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\functionList\sql.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\functionList\nsis.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\functionList\powershell.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\functionList\hollywood.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\stylers.model.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\change.log C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\contextMenu\NppShell.msix C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\functionList\ruby.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\autoCompletion\css.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\autoCompletion\batch.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\functionList\c.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\functionList\asm.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
File created C:\Program Files\Notepad++\functionList\latex.xml C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\ = "notepad++" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\InProcServer32\ = "C:\\Program Files\\Notepad++\\contextMenu\\NppShell.dll" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\*\shell\ANotepad++64 C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ANotepad++64\ = "Notepad++ Context menu" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ANotepad++64\ExplorerCommandHandler = "{B298D29A-A6ED-11DE-BA8C-A68E55D89593}" C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\ANotepad++64\NeverDefault C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593} C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\InProcServer32 C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B298D29A-A6ED-11DE-BA8C-A68E55D89593}\InProcServer32\ThreadingModel = "Apartment" C:\Windows\system32\regsvr32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4812 wrote to memory of 2648 N/A C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4812 wrote to memory of 2648 N/A C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4812 wrote to memory of 2648 N/A C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2648 wrote to memory of 4636 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 2648 wrote to memory of 4636 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1008 wrote to memory of 4636 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 4636 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 644 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 644 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1008 wrote to memory of 2648 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\nice.zip"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe

"C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe"

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s "C:\Program Files\Notepad++\contextMenu\NppShell.dll"

C:\Windows\system32\regsvr32.exe

/s "C:\Program Files\Notepad++\contextMenu\NppShell.dll"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8592446f8,0x7ff859244708,0x7ff859244718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,17305654604011195173,6099639952294639399,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6324 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 133.130.81.91.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
GB 88.221.135.33:443 www.bing.com tcp
US 8.8.8.8:53 33.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 th.bing.com udp
GB 88.221.135.35:443 th.bing.com tcp
GB 88.221.135.35:443 th.bing.com tcp
GB 88.221.135.42:443 th.bing.com tcp
GB 88.221.135.42:443 th.bing.com tcp
US 8.8.8.8:53 35.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 42.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 login.microsoftonline.com udp
NL 40.126.32.133:443 login.microsoftonline.com tcp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 services.bingapis.com udp
US 13.107.5.80:443 services.bingapis.com tcp
US 8.8.8.8:53 80.5.107.13.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 store.steampowered.com udp
GB 95.100.245.51:443 store.steampowered.com tcp
GB 95.100.245.51:443 store.steampowered.com tcp
US 8.8.8.8:53 51.245.100.95.in-addr.arpa udp
US 8.8.8.8:53 store.fastly.steamstatic.com udp
US 151.101.3.52:443 store.fastly.steamstatic.com tcp
US 151.101.3.52:443 store.fastly.steamstatic.com tcp
US 151.101.3.52:443 store.fastly.steamstatic.com tcp
US 151.101.3.52:443 store.fastly.steamstatic.com tcp
US 151.101.3.52:443 store.fastly.steamstatic.com tcp
US 151.101.3.52:443 store.fastly.steamstatic.com tcp
US 151.101.3.52:443 store.fastly.steamstatic.com tcp
US 8.8.8.8:53 52.3.101.151.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 login.steampowered.com udp
GB 23.214.143.155:443 login.steampowered.com tcp
US 8.8.8.8:53 api.steampowered.com udp
GB 23.214.143.155:443 api.steampowered.com tcp
US 8.8.8.8:53 155.143.214.23.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 aefd.nelreports.net udp
GB 2.19.252.146:443 aefd.nelreports.net tcp
US 8.8.8.8:53 146.252.19.2.in-addr.arpa udp
US 8.8.8.8:53 store.steampowered.com udp
US 8.8.8.8:53 help.steampowered.com udp
GB 23.214.143.155:443 help.steampowered.com tcp
GB 23.214.143.155:443 help.steampowered.com tcp
GB 23.214.143.155:443 help.steampowered.com tcp
GB 23.214.143.155:443 help.steampowered.com tcp
GB 23.214.143.155:443 help.steampowered.com tcp
GB 23.214.143.155:443 help.steampowered.com tcp
GB 23.214.143.155:443 help.steampowered.com tcp
US 8.8.8.8:53 www.google.com udp
GB 172.217.16.228:443 www.google.com tcp
US 8.8.8.8:53 228.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 3.178.250.142.in-addr.arpa udp
GB 172.217.16.228:443 www.google.com udp
GB 172.217.16.228:443 www.google.com udp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
GB 2.19.252.146:443 aefd.nelreports.net udp
US 8.8.8.8:53 help.steampowered.com udp
US 8.8.8.8:53 aefd.nelreports.net udp
GB 2.19.252.134:443 aefd.nelreports.net udp
US 8.8.8.8:53 134.252.19.2.in-addr.arpa udp
US 8.8.8.8:53 3.173.189.20.in-addr.arpa udp
GB 88.221.135.34:443 www.bing.com tcp
US 8.8.8.8:53 34.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 help.steampowered.com udp
US 8.8.8.8:53 login.steampowered.com udp
GB 104.103.247.162:443 login.steampowered.com tcp
US 8.8.8.8:53 api.steampowered.com udp
GB 104.103.247.162:443 api.steampowered.com tcp
US 8.8.8.8:53 162.247.103.104.in-addr.arpa udp
US 8.8.8.8:53 aefd.nelreports.net udp
GB 2.19.252.146:443 aefd.nelreports.net udp
GB 88.221.135.34:443 www.bing.com tcp
GB 88.221.135.34:443 www.bing.com tcp
GB 88.221.135.17:443 www.bing.com tcp
US 8.8.8.8:53 17.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 aefd.nelreports.net udp
GB 2.19.252.146:443 aefd.nelreports.net udp

Files

C:\Users\Admin\Desktop\random stuff\npp.8.7.1.Installer.x64.exe

MD5 251d47503743b09d4ec3847356487ac9
SHA1 2365dec100d7ad2ca99079e2a6fdae7d801cdf43
SHA256 aa130d151859eccc8b4cc535ae756682069d626087e8c56a35b630df4b5f0024
SHA512 e3ff13f400e095b091e1fae184b9a83416c17c1033558b1512f765e19d866a776414db964d5e7a713eaa0ac0e07a98524540a0dba88294f137c0eaacdaa62e20

C:\Users\Admin\AppData\Local\Temp\nsn25C5.tmp\System.dll

MD5 4add245d4ba34b04f213409bfe504c07
SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

C:\Users\Admin\AppData\Local\Temp\nsn25C5.tmp\LangDLL.dll

MD5 50016010fb0d8db2bc4cd258ceb43be5
SHA1 44ba95ee12e69da72478cf358c93533a9c7a01dc
SHA256 32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e
SHA512 ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

C:\Users\Admin\AppData\Local\Temp\nsn25C5.tmp\InstallOptions.dll

MD5 d095b082b7c5ba4665d40d9c5042af6d
SHA1 2220277304af105ca6c56219f56f04e894b28d27
SHA256 b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c
SHA512 61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9

C:\Users\Admin\AppData\Local\Temp\nsn25C5.tmp\ioSpecial.ini

MD5 e8d2bba4766c9f08c04f931ca1708ad8
SHA1 2864b195b3551fbdfe7f586d800e44bce41e6518
SHA256 26a7933e4369d947324a56fa236baea9467b5bdc1901b6b1aa6d4765a194dc8c
SHA512 41525c5897eb0434d86b42592bcd9334e95051f0e9765c0dd319b3b57741522f3b7016468774cb13bbd6ba8dbef985277c6a4dc8489faea2f90b3c0dd8891aa3

C:\Users\Admin\AppData\Local\Temp\nsn25C5.tmp\nsDialogs.dll

MD5 1d8f01a83ddd259bc339902c1d33c8f1
SHA1 9f7806af462c94c39e2ec6cc9c7ad05c44eba04e
SHA256 4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
SHA512 28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

C:\Users\Admin\AppData\Local\Temp\nsn25C5.tmp\UserInfo.dll

MD5 d458b8251443536e4a334147e0170e95
SHA1 ba8d4d580f1bc0bb2eaa8b9b02ee9e91b8b50fc3
SHA256 4913d4cccf84cd0534069107cff3e8e2f427160cad841547db9019310ac86cc7
SHA512 6ff523a74c3670b8b5cd92f62dcc6ea50b65a5d0d6e67ee1079bdb8a623b27dd10b9036a41aa8ec928200c85323c1a1f3b5c0948b59c0671de183617b65a96b1

C:\Program Files\Notepad++\contextMenu\NppShell.dll

MD5 448207940bb3ccb92ab10bd015b763b0
SHA1 5eb3567139c60da222f32995dcad0738b3634d04
SHA256 47e03141468c701328af836a4bcb77e60a961270160fd9577a2dcdfffb135cd0
SHA512 52e114db431e56e5d39b86bd5856329721bbaec632af35de41a894920aefdd8878657bfa667f9d13c2ebd2159a14c50e07c34fd7993f670642c9e42e9c7471ed

C:\Users\Admin\AppData\Local\Temp\nsn25C5.tmp\ioSpecial.ini

MD5 ace97f271757b0a08bdc004cb195e119
SHA1 4692742b6353b2a87e59350fced9b0c39e9f5b8d
SHA256 46c84fd37f911b82e0ac4f379ab9f03daf9b7022b70dc1d34bbe65375ba7da4a
SHA512 805ae9ff89c9926ea2ad661f6546a87f2cfb4a7aec563345fb0aebd702af4e24a299ae78fbc492f6686ae5d221acfbd0c2eecb6e1da4397fb9df2fdd08fc333f

C:\Users\Admin\AppData\Local\Temp\nsn25C5.tmp\ioSpecial.ini

MD5 9977d2712ebcbc4b4987f7036e99edc7
SHA1 5adb77967146055e45ad87b7c2b6a28f03dfd0d9
SHA256 cad71ad82c98ece2bc92dfbb746f8ec436782ce9311f004caa5d1b52fc958548
SHA512 958e974f8fcd674446a54f061056b28123aa4e0cb8474e12df4f582e36a8eddc577ce0f45216aee1f23ac730e481ca51d68f6e8805dbd0d5584adb58fcd9cb65

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 c2d9eeb3fdd75834f0ac3f9767de8d6f
SHA1 4d16a7e82190f8490a00008bd53d85fb92e379b0
SHA256 1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66
SHA512 d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

\??\pipe\LOCAL\crashpad_1008_RAJGUAOFATIYKYFO

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 e55832d7cd7e868a2c087c4c73678018
SHA1 ed7a2f6d6437e907218ffba9128802eaf414a0eb
SHA256 a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574
SHA512 897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 92e7d40e777cf4433d4dc5fe3b88aa57
SHA1 43eb3e737cb75645ef093164f389230c6c2cf6e2
SHA256 f68641b1b9dc5dac8b9c7880537a6fe2fc9e3d6444eb7a91caaf15621cdcf36f
SHA512 7a5affa47f7799b9dbbf38848a60e00548f54fc51cefedce4160cf8efc944096ee3ae6a0470b7f7cf8d4670046884d96ea5b74819f319280acf6ef0adc96a3d5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 1e36a8e64ef2934bdaafdf84810a6f28
SHA1 d5a13b2d0abec51fa6f2cc808a3ac41497872432
SHA256 68e5c5f6a058c4ad2ea405831812f9fca288b71db9b5b21072f154e0b48b895a
SHA512 c93011e4d1a8b1cc25748727a8d73a88d53dedb757589c3672cc8763eaa6f72b257012d0cf004ad29565a6ad54679bfa0d9a58545c2bb3f5e3bd22333c2e7402

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 87c4ed9fa8074928eefc9b231114ea97
SHA1 58e0a3e0b5c632d7a6e8fc2bec5b557972434837
SHA256 06ec11c88c8af2cfd7913c8ff68ebc454321195ea402d0c7f1375325d8a0e11c
SHA512 5d4116b63321df0bf1135e1c695f2b2c89479e86e88fab17e55001652874c14847b8f64d06511132d7f5b8097054849f4aa3f18d2337f6787ed57b822f9a80da

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e1521c17eb1ee38f5636701d6c3d9197
SHA1 fda630ef5b0edb144e14328b823947ef258ae1ab
SHA256 d805ef35f292f6a27cbeb1e3d717a6326f8c21fbcf244b16629e9d3a2990fe6b
SHA512 585f357fc2ae0141be0d81f0322ae0f1c3938bf7ad53851ff7f6e942e3aaaa00254e7f78eca5d17f5ebe73b9db0216fdb2c4dc04a5031801c67a4198a36b1931

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 9b5783230433adb6cedabd912c69d2ef
SHA1 85c7a987950046493e5ef4f186dcc6e3b4c805f1
SHA256 4fd69c5f7d4524b4f5eb8faacc1e9a26c113789879ad65a9b706d904f499908a
SHA512 1a009d919a5e8fe292a10e62f9127e2ba744119997281ec9f92107aa38e118ccb7ec86ff1739b3c79e206a19aa465833f1a71e8d6c2fe24a10dfc4faf5072efd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 428b33df07802bdfdc6dc328132050b7
SHA1 b002f21cfd56175d7cbf44f9c4b42f6c67cca38f
SHA256 a1d46349b049404dbaf2b1fafef020e1095bc0ee1bc3261105f21d50a4c4e3de
SHA512 c2212ce81f54fb3d57a805b324490db68b19ffcabe94be2d5166eb0c3384e210e7633f9871fe0728ea184e2c5f37488acfebb676e041b84b2854968f7086c300

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

MD5 e579aca9a74ae76669750d8879e16bf3
SHA1 0b8f462b46ec2b2dbaa728bea79d611411bae752
SHA256 6e51c7866705bf0098febfaf05cf4652f96e69ac806c837bfb1199b6e21e6aaf
SHA512 df22f1dff74631bc14433499d1f61609de71e425410067fd08ec193d100b70d98672228906081c309a06bcba03c097ace885240a3ce71e0da4fdb8a022fc9640

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 7f0c12279b6b2c18b22cb162493f8b3b
SHA1 dd678368fdbe7b3702481bf739cba9f671f4490a
SHA256 c43702cca550fffd9f9d53b038712c0fb43d6aaeb72c2ebe565756a7aeffdb9e
SHA512 0f01508e278613b977b88c18ad6a3bbcddcc3f9d7157c0060e0789df5a1dbc537355d1b3d8080c54d5ded842ed38b2402dcb736fc772b846d1819ea270a28bc3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a39ce.TMP

MD5 18561039075c999990f81269ee4209e7
SHA1 f3273e7340927661f494afe38243d109a5e37269
SHA256 5bc2c729a34482903e878add52a17ecb1e561468fa7e603dc3b9d88d5a0cf4eb
SHA512 b6c158a542e811f98803a90f29e559316587acf01180c304694f120805eea512a6ae5bef552973ac20b56beda03e39a878e1065223bb0b4d6883db451a825605

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 db1269425cbf59a51e8205576f894e17
SHA1 ab1c35e702712d55a9794f6195e2afd435c1dc48
SHA256 1903e57da207b728a28e3b3274b8103c1ddca4d4f5413f434d0bdaee4104a1e8
SHA512 8061d2038d87347d66572fa1a4ca380e2d77c5242466b98ebfeafe2d99950ac227b2c77d69a4a47c1e747577e51448b55bf859524cab72e99d20a0010d63f851

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 1e05028257c8fd4f100fad29db6f26af
SHA1 61c67944b9fa23074cf91db3476ff21aa59c81a1
SHA256 6553180caf04a72bee5f6e7f7a842ca558313ac19864f3d0712d40822810b737
SHA512 c3813e7c8906b03f5207d52af15a8c76a2ca3df45fa99195b55cf0c7a3bb3ca55aeb4d34947e343971c7c1259c869f9b2f5db1539341cd3ea34d67562c5f5264

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 d51b5dbf03366189df5e87161a5c0f95
SHA1 3d4a2cf516c1a78864c0a5189ffecde40d78e690
SHA256 2c56d5c031d66054d59dd0ce7424860ded7de33e20e4c8fbd3da6fc1cac20da8
SHA512 444c06751cef3f2dc4719a6a341bfe5134cae5fcd4c2c0b409b5c8a9a8755b6421b659b9ff9536eab5bca49dc640c6f39ce618d0aa10f9edabaaadccb1c2bf65

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 cb76c4815b181d7054ad39bdbc11c28d
SHA1 5d452ee8ad4bcd2d892f06c361de98d25480340c
SHA256 f4136bdf879d4082a41da9060cd63706deaf024e171f237477b6216b917d3f33
SHA512 45039e9b99928e3fc45e6f1e48fbf4c0031df76548a219bbdca5c1b45f921dcacf3275a9aaa22f54fca609e972b8a467af1de07c13a98d3c546b784b57dce31e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 e45cdce70a7105925b5ac09fd312ad06
SHA1 a24acd910c0fee89f8206c7eb34dd8fb44dd4a43
SHA256 1015d318010fdf8b9dec2207b390640d67a5dba0bf872106516e2bc658976c8f
SHA512 07d7754f94a03ce5a775d2288a9cf5cc3da9807dca9c7b1850b8c032b13fb59b09cea1023bb59eeacb33ff871df8f24a1627c724c702232bdfc8edeabde6cad1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 9a8af4f113e0220d05122463dec0e2a0
SHA1 1250f07aba0235d36d4016d434bacb8f5bc016df
SHA256 f01bc94072fd569f778e1790c55a2575d8ffdf05900b7004766277a46675b395
SHA512 3943e0e7d7e4328c870a503aa4ec9704e48c313c716125e9f9a2484049dd3f1315e01d10b832ff9d7683a2d88f3e08abdd8490790c603c281cd197257b7eea0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\43ac5f99-1913-4b94-b88a-ea957578d0ac.tmp

MD5 7bb9a9b4824c0bb6efb83fdb50b72363
SHA1 7ef74e2c0451fb515d6ef3e828af966617711a6f
SHA256 a6a8c79e53fc9e297b0136d62fe0ea494e0a458765f77aa2f2a12013a1854047
SHA512 a82f47bf6fb6188f6f77585a3d1856c9a09e303cf092e3057c53910e98803f6c9c1cab90f21887344200c44e56767761b5a1432c58896424e4bbe97cc6eef113

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 5961410596e54f4ca48aba31503eac27
SHA1 f3ea7f28b2f74d1d1c0eab3bcf5e0782764b7892
SHA256 9dccdaed39338fe45ed2de3a9629286e941581f40d36b06feae1c58263e64087
SHA512 003e769f4972503f2085424633c86a8cea31e186cbac94dc1f5f0c490bd67f86642ee6e437402e38bf385c84223cee3962b3ff31d73febaffd9e1586703fe959

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 9d351a39e8494e2ebfc0b7a09e75527a
SHA1 50662dfcb749d995a1729cf513714f97f323b96d
SHA256 4a1a6c478d97f8a22cc7f60a808242e673a38db360a83bc459c032b10fa5f3a7
SHA512 e6d71727723b7522992355f6d1736e63bee4f3deea1302c87bff286c491b49b7f689616e895e00a529e0d64adf60891472cf81d0168d7deae420193a87ac0db0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 aec69bf14ddeb49b9dc71fb96789a08c
SHA1 7a7d406c4261066e81e77d1da6b37186c2dec138
SHA256 a1432ee51cdc9bee1e6b586a40972d5a70817b853b1eff625a0624646d01920b
SHA512 829c72cee676f42df20952897ecbdb892e2abbb080b84c8effb1bc2972b3a693f7b86c9b590d70c4a10382ae591bf96409ef2b98657746a5a4c996ceb0f3b0a2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 2e0b59fdcc6e1ec9ff3acdb21bac64cd
SHA1 689693ccb5236920eb875cf828dc38ddb7905bcd
SHA256 01882a318315eb651a698b0d1990b81fef8f4e92717edc40165735064bffba0b
SHA512 8460bb13bc4299d5f4ccd08efded1c74238d156c650710bb83ad4e847e200e6bc371ad3135a63642766315832110a9fa4584f2cb8be6c8ab216a7f37e3252585

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 d888cdc6ac1376e0c4e48f992913d48b
SHA1 9d2c64bd7beda47b5e55ad8cea0d4c31985a992f
SHA256 f196cb457dde04181bbc2abee642725baca7f4bc50a67ba0fb79eecb0879ef0b
SHA512 adcc7f0e40a302d30a1d2bf5c15612f2a807a823249d2f757e5f13c15a93f7a6512f73ab2477fae68b3d138f20afa8ddcd3090ff1421f1aa4ed0ec212b69fcae