Malware Analysis Report

2025-01-03 06:15

Sample ID 241121-1hkn4axrfy
Target EXM_Premium_Tweaking_Utility_1.0_Cracked.bat
SHA256 6bba081474e42a3ce8713a0619664e069ba15e271d28cc134009af3f53c7bdd1
Tags
asyncrat gurcu stormkitty xworm default discovery evasion execution persistence privilege_escalation pyinstaller ransomware rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6bba081474e42a3ce8713a0619664e069ba15e271d28cc134009af3f53c7bdd1

Threat Level: Known bad

The file EXM_Premium_Tweaking_Utility_1.0_Cracked.bat was found to be: Known bad.

Malicious Activity Summary

asyncrat gurcu stormkitty xworm default discovery evasion execution persistence privilege_escalation pyinstaller ransomware rat spyware stealer trojan

Asyncrat family

StormKitty

Stormkitty family

UAC bypass

Detect Xworm Payload

StormKitty payload

Xworm

Xworm family

Gurcu, WhiteSnake

AsyncRat

Gurcu family

Async RAT payload

Modifies boot configuration data using bcdedit

Downloads MZ/PE file

Executes dropped EXE

Reads user/profile data of web browsers

Drops startup file

Loads dropped DLL

Checks computer location settings

Drops desktop.ini file(s)

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Looks up geolocation information via web service

Drops file in Program Files directory

System Network Configuration Discovery: Wi-Fi Discovery

Detects Pyinstaller

Event Triggered Execution: Netsh Helper DLL

System Network Configuration Discovery: Internet Connection Discovery

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Browser Information Discovery

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Uses Task Scheduler COM API

Uses Volume Shadow Copy service COM API

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

NTFS ADS

Scheduled Task/Job: Scheduled Task

Suspicious use of SendNotifyMessage

Uses Volume Shadow Copy WMI provider

Runs ping.exe

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Delays execution with timeout.exe

Checks processor information in registry

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

cURL User-Agent

Modifies registry class

Opens file in notepad (likely ransom note)

Suspicious use of FindShellTrayWindow

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-21 21:39

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-21 21:39

Reported

2024-11-21 21:56

Platform

win10ltsc2021-20241023-en

Max time kernel

1020s

Max time network

1022s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\EXM_Premium_Tweaking_Utility_1.0_Cracked.html

Signatures

AsyncRat

rat asyncrat

Asyncrat family

asyncrat

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Gurcu family

gurcu

Gurcu, WhiteSnake

stealer gurcu

StormKitty

stealer stormkitty

StormKitty payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Stormkitty family

stormkitty

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\system32\reg.exe N/A

Xworm

trojan rat xworm

Xworm family

xworm

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000\Control Panel\International\Geo\Nation C:\exm\EXMservice.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000\Control Panel\International\Geo\Nation C:\Users\Admin\msedge.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk C:\Users\Admin\msedge.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk C:\Users\Admin\msedge.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
N/A N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\29ccd8ab9f4cfbe524edc3d0d7b48ba1\Admin@UIJZGLAR_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini C:\Users\Admin\svchost.exe N/A
File created C:\Users\Admin\AppData\Local\29ccd8ab9f4cfbe524edc3d0d7b48ba1\Admin@UIJZGLAR_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini C:\Users\Admin\svchost.exe N/A
File created C:\Users\Admin\AppData\Local\29ccd8ab9f4cfbe524edc3d0d7b48ba1\Admin@UIJZGLAR_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini C:\Users\Admin\svchost.exe N/A
File created C:\Users\Admin\AppData\Local\29ccd8ab9f4cfbe524edc3d0d7b48ba1\Admin@UIJZGLAR_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini C:\Users\Admin\svchost.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A icanhazip.com N/A N/A

Looks up geolocation information via web service

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2cdf02b5-1638-4a42-be59-975c3ef3d80d.tmp C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241121213938.pma C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A

Browser Information Discovery

discovery

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\chcp.com N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\chcp.com N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

System Network Configuration Discovery: Wi-Fi Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Users\Admin\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\svchost.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Control Panel\Keyboard C:\Windows\system32\reg.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Keyboard\InitialKeyboardIndicators = "2147483650" C:\Windows\system32\reg.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Control Panel\Keyboard C:\Windows\system32\reg.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Keyboard\InitialKeyboardIndicators = "2" C:\Windows\system32\reg.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Control Panel\Keyboard C:\Windows\system32\reg.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Keyboard\KeyboardDelay = "0" C:\Windows\system32\reg.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Control Panel\Keyboard C:\Windows\system32\reg.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Keyboard\KeyboardSpeed = "31" C:\Windows\system32\reg.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge C:\Windows\system32\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings C:\Windows\system32\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software C:\Windows\system32\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows C:\Windows\system32\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer C:\Windows\system32\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage C:\Windows\system32\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe C:\Windows\system32\reg.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\Theme = "1" C:\Windows\system32\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main C:\Windows\system32\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000_Classes\Local Settings\Software\Microsoft C:\Windows\system32\reg.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\Unconfirmed 339347.crdownload:SmartScreen C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Users\Admin\Downloads\Unconfirmed 436025.crdownload:SmartScreen C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\svchost.exe N/A
N/A N/A C:\Users\Admin\svchost.exe N/A
N/A N/A C:\Users\Admin\svchost.exe N/A
N/A N/A C:\Users\Admin\svchost.exe N/A
N/A N/A C:\Users\Admin\svchost.exe N/A
N/A N/A C:\Users\Admin\svchost.exe N/A
N/A N/A C:\Users\Admin\svchost.exe N/A
N/A N/A C:\Users\Admin\svchost.exe N/A
N/A N/A C:\Users\Admin\svchost.exe N/A
N/A N/A C:\Users\Admin\svchost.exe N/A
N/A N/A C:\Users\Admin\svchost.exe N/A
N/A N/A C:\Users\Admin\svchost.exe N/A
N/A N/A C:\Users\Admin\svchost.exe N/A
N/A N/A C:\Users\Admin\svchost.exe N/A
N/A N/A C:\Users\Admin\svchost.exe N/A
N/A N/A C:\Users\Admin\svchost.exe N/A
N/A N/A C:\Users\Admin\svchost.exe N/A
N/A N/A C:\Users\Admin\svchost.exe N/A
N/A N/A C:\Users\Admin\svchost.exe N/A
N/A N/A C:\Users\Admin\svchost.exe N/A
N/A N/A C:\Users\Admin\svchost.exe N/A
N/A N/A C:\Users\Admin\svchost.exe N/A
N/A N/A C:\Users\Admin\svchost.exe N/A
N/A N/A C:\Users\Admin\msedge.exe N/A
N/A N/A C:\Users\Admin\msedge.exe N/A
N/A N/A C:\Users\Admin\msedge.exe N/A
N/A N/A C:\Users\Admin\msedge.exe N/A
N/A N/A C:\Users\Admin\msedge.exe N/A
N/A N/A C:\Users\Admin\msedge.exe N/A
N/A N/A C:\Users\Admin\svchost.exe N/A
N/A N/A C:\Users\Admin\msedge.exe N/A
N/A N/A C:\Users\Admin\msedge.exe N/A
N/A N/A C:\Users\Admin\msedge.exe N/A
N/A N/A C:\Users\Admin\msedge.exe N/A
N/A N/A C:\Users\Admin\msedge.exe N/A
N/A N/A C:\Users\Admin\msedge.exe N/A
N/A N/A C:\Users\Admin\msedge.exe N/A
N/A N/A C:\Users\Admin\msedge.exe N/A
N/A N/A C:\Users\Admin\msedge.exe N/A
N/A N/A C:\Users\Admin\msedge.exe N/A
N/A N/A C:\Users\Admin\msedge.exe N/A
N/A N/A C:\Users\Admin\msedge.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\msedge.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\msedge.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\msedge.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\msedge.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\msedge.exe N/A
Token: SeDebugPrivilege N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\msedge.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\msedge.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\msedge.exe N/A
Token: SeDebugPrivilege N/A C:\exm\FortniteSettings\FortniteSettings.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\msedge.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\msedge.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\msedge.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\msedge.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\msedge.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\msedge.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\msedge.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\msedge.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\msedge.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4552 wrote to memory of 4508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 4508 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 1152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4552 wrote to memory of 4368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

cURL User-Agent

Description Indicator Process Target
HTTP User-Agent header curl/8.7.1 N/A N/A
HTTP User-Agent header curl/8.7.1 N/A N/A

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\EXM_Premium_Tweaking_Utility_1.0_Cracked.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe957b46f8,0x7ffe957b4708,0x7ffe957b4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6388 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6900 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6660 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff67e825460,0x7ff67e825470,0x7ff67e825480

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7880 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7884 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8064 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7296 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7480 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7144 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7828 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6404 /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\EXM_Premium_Tweaking_Utility_1.0_Cracked.bat" "

C:\Windows\system32\reg.exe

Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "RPSessionInterval" /f

C:\Windows\system32\reg.exe

Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "DisableConfig" /f

C:\Windows\system32\reg.exe

Reg.exe add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "SystemRestorePointCreationFrequency" /t REG_DWORD /d 0 /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -ExecutionPolicy Unrestricted -NoProfile Enable-ComputerRestore -Drive 'C:\'

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}

C:\Windows\system32\reg.exe

Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

Reg.exe add "HKCU\CONSOLE" /v "VirtualTerminalLevel" /t REG_DWORD /d "1" /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wmic path Win32_UserAccount where name="Admin" get sid | findstr "S-"

C:\Windows\System32\Wbem\WMIC.exe

wmic path Win32_UserAccount where name="Admin" get sid

C:\Windows\system32\findstr.exe

findstr "S-"

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\chcp.com

chcp 437

C:\Windows\system32\curl.exe

curl -g -k -L -# -o "C:\Users\Admin\AppData\Local\Temp\exm.zip" "https://github.com/anonyketa/EXM-Tweaking-Utility-Premium/releases/download/V1.0/exm.zip"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -NoProfile Expand-Archive 'C:\Users\Admin\AppData\Local\Temp\exm.zip' -DestinationPath 'C:\Exm\'

C:\exm\EXMservice.exe

EXMservice.exe

C:\Users\Admin\msedge.exe

"C:\Users\Admin\msedge.exe"

C:\Users\Admin\svchost.exe

"C:\Users\Admin\svchost.exe"

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "msedge" /tr "C:\Users\Admin\AppData\Local\msedge.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show profile

C:\Windows\SysWOW64\findstr.exe

findstr All

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show networks mode=bssid

C:\Windows\system32\timeout.exe

timeout 2

C:\Windows\system32\reg.exe

Reg.exe add "HKLM\System\CurrentControlSet\Services\VxD\BIOS" /v "CPUPriority" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

Reg.exe add "HKLM\System\CurrentControlSet\Services\VxD\BIOS" /v "FastDRAM" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

Reg.exe add "HKLM\System\CurrentControlSet\Services\VxD\BIOS" /v "AGPConcur" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

Reg.exe add "HKLM\System\CurrentControlSet\Services\VxD\BIOS" /v "CPUPriority" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

Reg.exe add "HKLM\System\CurrentControlSet\Services\VxD\BIOS" /v "FastDRAM" /t REG_DWORD /d "1" /f

C:\Windows\system32\reg.exe

Reg.exe add "HKLM\System\CurrentControlSet\Services\VxD\BIOS" /v "PCIConcur" /t REG_DWORD /d "1" /f

C:\Windows\system32\timeout.exe

timeout /t 1 /nobreak

C:\Windows\system32\bcdedit.exe

bcdedit /set tscsyncpolicy legacy

C:\Windows\system32\timeout.exe

timeout /t 1 /nobreak

C:\Windows\system32\bcdedit.exe

bcdedit /set hypervisorlaunchtype off

C:\Windows\system32\timeout.exe

timeout /t 1 /nobreak

C:\Windows\system32\bcdedit.exe

bcdedit /set linearaddress57 OptOut

C:\Windows\system32\bcdedit.exe

bcdedit /set increaseuserva 268435328

C:\Windows\system32\timeout.exe

timeout /t 1 /nobreak

C:\Windows\system32\bcdedit.exe

bcdedit /set isolatedcontext No

C:\Windows\system32\bcdedit.exe

bcdedit /set allowedinmemorysettings 0x0

C:\Windows\system32\timeout.exe

timeout /t 1 /nobreak

C:\Windows\system32\bcdedit.exe

bcdedit /set vsmlaunchtype Off

C:\Windows\system32\bcdedit.exe

bcdedit /set vm No

C:\Windows\system32\reg.exe

Reg.exe add "HKLM\Software\Policies\Microsoft\FVE" /v "DisableExternalDMAUnderLock" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\DeviceGuard" /v "HVCIMATRequired" /t REG_DWORD /d "0" /f

C:\Windows\system32\timeout.exe

timeout /t 1 /nobreak

C:\Windows\system32\bcdedit.exe

bcdedit /set x2apicpolicy Enable

C:\Windows\system32\bcdedit.exe

bcdedit /set uselegacyapicmode No

C:\Windows\system32\timeout.exe

timeout /t 1 /nobreak

C:\Windows\system32\bcdedit.exe

bcdedit /set configaccesspolicy Default

C:\Windows\system32\bcdedit.exe

bcdedit /set MSI Default

C:\Windows\system32\bcdedit.exe

bcdedit /set usephysicaldestination No

C:\Windows\system32\bcdedit.exe

bcdedit /set usefirmwarepcisettings No

C:\Windows\system32\timeout.exe

timeout /t 1 /nobreak

C:\Users\Admin\AppData\Local\msedge.exe

"C:\Users\Admin\AppData\Local\msedge.exe"

C:\Windows\system32\reg.exe

Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "EnableTransparency" /t REG_DWORD /d "0" /f

C:\Windows\system32\timeout.exe

timeout /t 1 /nobreak

C:\Windows\system32\reg.exe

Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "TaskbarAnimations" /t REG_DWORD /d 0 /f

C:\Windows\system32\timeout.exe

timeout /t 1 /nobreak

C:\Windows\system32\reg.exe

Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ListviewAlphaSelect" /t REG_DWORD /d 0 /f

C:\Windows\system32\timeout.exe

timeout /t 1 /nobreak

C:\Windows\system32\reg.exe

Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "EnableBalloonTips" /t REG_DWORD /d "0" /f

C:\Windows\system32\timeout.exe

timeout /t 1 /nobreak

C:\Windows\system32\reg.exe

Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "DisallowShaking" /t REG_DWORD /d "1" /f

C:\Windows\system32\timeout.exe

timeout /t 1 /nobreak

C:\Windows\system32\reg.exe

Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\People" /v "PeopleBand" /t REG_DWORD /d "0" /f

C:\Windows\system32\timeout.exe

timeout /t 1 /nobreak

C:\Windows\system32\reg.exe

Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\System" /v "EnableActivityFeed" /t REG_DWORD /d "0" /f

C:\Windows\system32\timeout.exe

timeout /t 1 /nobreak

C:\Windows\system32\reg.exe

Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowTaskViewButton" /t REG_DWORD /d "0" /f

C:\Windows\system32\timeout.exe

timeout /t 1 /nobreak

C:\Windows\system32\reg.exe

Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider" /v "RestoreConnection" /t REG_DWORD /d 0 /f

C:\Windows\system32\timeout.exe

timeout /t 1 /nobreak

C:\Windows\system32\reg.exe

Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "HideSCAMeetNow" /t REG_dWORD /d 1 /f

C:\Windows\system32\timeout.exe

timeout /t 1 /nobreak

C:\Windows\system32\reg.exe

Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Feeds" /v "ShellFeedsTaskbarViewMode" /t REG_DWORD /d 2 /f

C:\Windows\system32\timeout.exe

timeout /t 1 /nobreak

C:\Windows\system32\reg.exe

Reg.exe add "HKLM\Software\Policies\Microsoft\Windows\CloudContent" /v DisableSoftLanding /t REG_DWORD /d 1 /f

C:\Windows\system32\timeout.exe

timeout /t 1 /nobreak

C:\Windows\system32\reg.exe

Reg.exe add "HKLM\SYSTEM\CurrentControlSet\Control\FileSystem" /v "LongPathsEnabled" /t REG_DWORD /d "1" /f

C:\Windows\system32\timeout.exe

timeout /t 1 /nobreak

C:\Windows\system32\reg.exe

Reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSyncProviderNotifications" /t REG_DWORD /d "0" /f

C:\Windows\system32\timeout.exe

timeout /t 1 /nobreak

C:\Windows\system32\reg.exe

Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

Reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t REG_DWORD /d "0" /f

C:\Windows\system32\reg.exe

Reg.exe add "HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main" /v "Theme" /t REG_DWORD /d "1" /f

C:\Windows\system32\timeout.exe

timeout /t 1 /nobreak

C:\Windows\system32\reg.exe

Reg.exe add "HKEY_USERS\.DEFAULT\Control Panel\Keyboard" /v InitialKeyboardIndicators /t REG_SZ /d "2147483650" /f

C:\Windows\system32\reg.exe

Reg.exe add "HKCU\Control Panel\Keyboard" /v "KeyboardSpeed" /t REG_SZ /d "31" /f

C:\Windows\system32\reg.exe

Reg.exe add "HKEY_USERS\.DEFAULT\Control Panel\Keyboard" /v "InitialKeyboardIndicators" /t REG_SZ /d "2" /f

C:\Windows\system32\reg.exe

Reg.exe add "HKCU\Control Panel\Keyboard" /v "InitialKeyboardIndicators" /t REG_SZ /d "2" /f

C:\Windows\system32\reg.exe

Reg.exe add "HKEY_USERS\.DEFAULT\Control Panel\Keyboard" /v "KeyboardDelay" /t REG_SZ /d "0" /f

C:\Windows\system32\reg.exe

Reg.exe add "HKEY_USERS\.DEFAULT\Control Panel\Keyboard" /v "KeyboardSpeed" /t REG_SZ /d "31" /f

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16824941738369061451,6866354018295071517,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2480 /prefetch:2

C:\Windows\system32\PING.EXE

ping ping-nac.ds.on.epicgames.com -n 25

C:\Users\Admin\AppData\Local\msedge.exe

"C:\Users\Admin\AppData\Local\msedge.exe"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\exm\FortniteSettings\FortniteSettings.exe

"C:\exm\FortniteSettings\FortniteSettings.exe"

C:\exm\FortniteSettings\FortniteSettings.exe

"C:\exm\FortniteSettings\FortniteSettings.exe"

C:\Users\Admin\AppData\Local\msedge.exe

"C:\Users\Admin\AppData\Local\msedge.exe"

C:\Users\Admin\AppData\Local\msedge.exe

"C:\Users\Admin\AppData\Local\msedge.exe"

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\FortniteGame\Saved\Config\WindowsClient\GameUserSettingsDocumentation.txt

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\FortniteGame\Saved\Config\WindowsClient\FNsettingsmanager\pgmconfig.txt

C:\Windows\system32\timeout.exe

timeout 2

C:\Users\Admin\AppData\Local\msedge.exe

"C:\Users\Admin\AppData\Local\msedge.exe"

C:\exm\FortniteSettings\FortniteSettings.exe

"C:\exm\FortniteSettings\FortniteSettings.exe"

C:\exm\FortniteSettings\FortniteSettings.exe

"C:\exm\FortniteSettings\FortniteSettings.exe"

C:\Users\Admin\AppData\Local\msedge.exe

"C:\Users\Admin\AppData\Local\msedge.exe"

C:\Users\Admin\AppData\Local\msedge.exe

"C:\Users\Admin\AppData\Local\msedge.exe"

C:\Users\Admin\AppData\Local\msedge.exe

"C:\Users\Admin\AppData\Local\msedge.exe"

C:\Users\Admin\AppData\Local\msedge.exe

"C:\Users\Admin\AppData\Local\msedge.exe"

C:\Users\Admin\AppData\Local\msedge.exe

"C:\Users\Admin\AppData\Local\msedge.exe"

C:\Users\Admin\AppData\Local\msedge.exe

"C:\Users\Admin\AppData\Local\msedge.exe"

C:\Users\Admin\AppData\Local\msedge.exe

"C:\Users\Admin\AppData\Local\msedge.exe"

C:\Users\Admin\AppData\Local\msedge.exe

"C:\Users\Admin\AppData\Local\msedge.exe"

C:\Users\Admin\AppData\Local\msedge.exe

"C:\Users\Admin\AppData\Local\msedge.exe"

C:\Users\Admin\AppData\Local\msedge.exe

"C:\Users\Admin\AppData\Local\msedge.exe"

C:\Users\Admin\AppData\Local\msedge.exe

"C:\Users\Admin\AppData\Local\msedge.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 68.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 www.upload.ee udp
DE 57.129.39.102:443 www.upload.ee tcp
DE 57.129.39.102:443 www.upload.ee tcp
US 8.8.8.8:53 s7.addthis.com udp
NL 23.210.16.184:443 s7.addthis.com tcp
NL 23.210.16.184:443 s7.addthis.com tcp
US 8.8.8.8:53 du0pud0sdlmzf.cloudfront.net udp
FR 18.245.200.108:443 du0pud0sdlmzf.cloudfront.net tcp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 102.39.129.57.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 184.16.210.23.in-addr.arpa udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
GB 216.58.201.98:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 nav.smartscreen.microsoft.com udp
GB 51.11.108.188:443 nav.smartscreen.microsoft.com tcp
GB 51.11.108.188:443 nav.smartscreen.microsoft.com tcp
US 8.8.8.8:53 region1.google-analytics.com udp
US 216.239.32.36:443 region1.google-analytics.com tcp
US 8.8.8.8:53 data-edge.smartscreen.microsoft.com udp
GB 51.140.244.186:443 data-edge.smartscreen.microsoft.com tcp
GB 51.140.244.186:443 data-edge.smartscreen.microsoft.com tcp
GB 51.140.244.186:443 data-edge.smartscreen.microsoft.com tcp
US 8.8.8.8:53 ndtheyeiedm.info udp
US 8.8.8.8:53 strangineersalyl.org udp
US 8.8.8.8:53 ghabovethec.info udp
US 8.8.8.8:53 paintydevelela.org udp
US 172.67.146.219:443 strangineersalyl.org tcp
N/A 224.0.0.251:5353 udp
ES 18.154.41.17:443 ghabovethec.info tcp
GB 18.164.68.122:443 paintydevelela.org tcp
GB 18.164.68.122:443 paintydevelela.org tcp
US 8.8.8.8:53 getrunkhomuto.info udp
GB 108.156.46.40:443 ndtheyeiedm.info tcp
US 8.8.8.8:53 ukankingwithea.com udp
US 104.21.68.94:443 ukankingwithea.com tcp
US 104.21.68.94:443 ukankingwithea.com tcp
GB 13.224.81.61:443 getrunkhomuto.info tcp
US 104.21.68.94:443 ukankingwithea.com tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 crt.rootg2.amazontrust.com udp
GB 157.240.221.35:443 www.facebook.com tcp
BE 142.251.173.84:443 accounts.google.com tcp
BE 142.251.173.84:443 accounts.google.com tcp
FR 3.164.163.59:80 crt.rootg2.amazontrust.com tcp
US 8.8.8.8:53 108.200.245.18.in-addr.arpa udp
US 8.8.8.8:53 40.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 34.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 78.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 38.201.222.52.in-addr.arpa udp
US 8.8.8.8:53 98.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 188.108.11.51.in-addr.arpa udp
US 8.8.8.8:53 36.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 145.154.216.23.in-addr.arpa udp
US 8.8.8.8:53 203.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 186.244.140.51.in-addr.arpa udp
US 8.8.8.8:53 219.146.67.172.in-addr.arpa udp
US 8.8.8.8:53 122.68.164.18.in-addr.arpa udp
US 8.8.8.8:53 40.46.156.108.in-addr.arpa udp
US 8.8.8.8:53 17.41.154.18.in-addr.arpa udp
US 8.8.8.8:53 94.68.21.104.in-addr.arpa udp
BE 142.251.173.84:443 accounts.google.com udp
US 8.8.8.8:53 primenetworkchain.com udp
DE 168.119.149.123:443 primenetworkchain.com tcp
US 8.8.8.8:53 61.81.224.13.in-addr.arpa udp
US 8.8.8.8:53 35.221.240.157.in-addr.arpa udp
US 8.8.8.8:53 84.173.251.142.in-addr.arpa udp
US 8.8.8.8:53 59.163.164.3.in-addr.arpa udp
US 8.8.8.8:53 utll.techproductupdate.com udp
DE 18.185.197.179:443 utll.techproductupdate.com tcp
US 8.8.8.8:53 net.geo.opera.com udp
NL 185.26.182.112:443 net.geo.opera.com tcp
US 8.8.8.8:53 123.149.119.168.in-addr.arpa udp
US 8.8.8.8:53 179.197.185.18.in-addr.arpa udp
US 8.8.8.8:53 112.182.26.185.in-addr.arpa udp
US 216.239.32.36:443 region1.google-analytics.com udp
US 8.8.8.8:53 ep1.adtrafficquality.google udp
GB 142.250.200.34:443 ep1.adtrafficquality.google tcp
US 8.8.8.8:53 ep2.adtrafficquality.google udp
GB 172.217.169.1:443 ep2.adtrafficquality.google tcp
GB 172.217.169.1:443 ep2.adtrafficquality.google tcp
GB 13.224.81.61:443 getrunkhomuto.info tcp
US 8.8.8.8:53 34.200.250.142.in-addr.arpa udp
GB 172.217.169.1:443 ep2.adtrafficquality.google udp
US 8.8.8.8:53 1.169.217.172.in-addr.arpa udp
GB 51.11.108.188:443 nav.smartscreen.microsoft.com tcp
GB 142.250.200.34:443 ep1.adtrafficquality.google udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
DE 57.129.39.102:443 www.upload.ee tcp
GB 142.250.200.34:443 ep1.adtrafficquality.google udp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 8.8.8.8:53 1.80.190.35.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 fd.api.iris.microsoft.com udp
NL 20.31.169.57:443 fd.api.iris.microsoft.com tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 185.199.111.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 133.111.199.185.in-addr.arpa udp
N/A 127.0.0.1:50841 tcp
N/A 127.0.0.1:50844 tcp
US 8.8.8.8:53 179.154.216.23.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 172.67.19.24:443 pastebin.com tcp
US 8.8.8.8:53 24.19.67.172.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 i.ibb.co udp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 8.8.8.8:53 161.58.19.162.in-addr.arpa udp
US 8.8.8.8:53 icanhazip.com udp
US 104.16.184.241:80 icanhazip.com tcp
US 8.8.8.8:53 api.mylnikov.org udp
US 104.21.44.66:443 api.mylnikov.org tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 8.8.8.8:53 241.184.16.104.in-addr.arpa udp
NL 149.154.167.220:443 api.telegram.org tcp
FR 162.19.58.161:443 i.ibb.co tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 66.44.21.104.in-addr.arpa udp
US 8.8.8.8:53 here-machinery.gl.at.ply.gg udp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 8.8.8.8:53 ping-nac.ds.on.epicgames.com udp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 8.8.8.8:53 checkappexec.microsoft.com udp
GB 51.11.108.188:443 checkappexec.microsoft.com tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
US 8.8.8.8:53 208.143.182.52.in-addr.arpa udp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 8.8.8.8:53 here-machinery.gl.at.ply.gg udp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 8.8.8.8:53 here-machinery.gl.at.ply.gg udp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:6606 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
US 8.8.8.8:53 here-machinery.gl.at.ply.gg udp
US 147.185.221.22:17473 here-machinery.gl.at.ply.gg tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:8808 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
N/A 127.0.0.1:7707 tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp
FR 162.19.58.161:443 i.ibb.co tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 e87625b4a77de67df5a963bf1f1b9f24
SHA1 727c79941debbd77b12d0a016164bae1dd3f127c
SHA256 07ecc7bd328990f44b189112a1a738861b0f4528097d4371e1ab0c46d8819f4e
SHA512 000d74220ba78628b727441c1b3f8813eec7fc97ff9aa6963eb2ab08d09525fa03935b32e86458c42e573b828a22b0b229af02b47eee511dc83de4ed3b5e726b

\??\pipe\LOCAL\crashpad_4552_SKQLKMYRBZSFVOLX

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

MD5 e5e3377341056643b0494b6842c0b544
SHA1 d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256 e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA512 83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 5d9c9a841c4d3c390d06a3cc8d508ae6
SHA1 052145bf6c75ab8d907fc83b33ef0af2173a313f
SHA256 915ea0e3e872d2b2e7d0e0ca30f282675139c787fec8043a6e92b9ef68b4f67d
SHA512 8243684857e1c359872b8e795a0e5f2ee56b0c0c1e1c7e5d264c2c28476e9830981bb95244f44c3b2ed334c3e1228f3d6245cce2f3d1f34cdbce8e2af55b4c85

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 137094a3453899bc0bc86df52edd9186
SHA1 66bc2c2b45b63826bb233156bab8ce31c593ba99
SHA256 72d823cac2d49660cdd20ebf4d3ac222c4dd15aae6e5ac4a64f993ef5c4fdd44
SHA512 f8f149c9eab06e8d7e1aa62145f0fc588dc36fc521ef4dceceb80a191b72d79586d920feb5f3b1d19595109cc6d608c143e32f521a4da1068c708a2538899ada

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e6bfa62527ec5a9e3b72f900db07f323
SHA1 38c808fc5fb99f20985020429009749670fd7877
SHA256 bbb39c761421d851fa07c79ce29c0bf64743f4786b54cc1968ffe6edaa726a48
SHA512 4cb46d739d2a5b50be9d1be4ce04127a8cf4f0cdc8da37f117b5c4ac37937e8bfe30b5af33bbe372518739161aebb5e367d9d1ef2f27d524987572c7759d6e4b

C:\Users\Admin\Downloads\OperaSetup.exe

MD5 5c0bd423d58252499c5f5f7024cd888e
SHA1 3f88fbbbdc6c2673e00c8c2612602a43a680329c
SHA256 c9b7209c292ee13ce3f510f02dbd657747e58c1704237eccdf17e06e08310211
SHA512 fc0000222c083e93c302d9eff5edac70e087aec11a7d04d79155d6f53915d4c07f08aceb42b51a4c76647b50ad701bbcd513f729a8862702f81c3c82b6624459

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

MD5 40fde583683b801ffdc35a1eb86f3fdd
SHA1 f00800982d040e6800e0e909483bfaca04f9e7da
SHA256 e5c6c1119051be2504aef77079feb0cea02cfda09b2624d679cdb133df714e5b
SHA512 39cdd99410de79839a5107900b0227aec1ce5e775a397cd043215e36650526be3d907678df3896c1d6f6a1a4f6f01bc6125a90e57509b95b220c96ae664ce896

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

MD5 0319e02785cf17492beade97efa0739e
SHA1 3723d1e496d18a49f2a313c0e15356a022c3ca3c
SHA256 7cc962a379bffb3c2d83d60613268cc6d43475d6ec8dcf2fb874055f9f2ac5c6
SHA512 03defa1f6cd0a8b64233627cb62aaf8f27179f12df4e5216bd2397c6d9d78c840082b7c8045c1bf2cfb75067582ea490cfadb6f0325ebaac32e6ada98b48c935

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6c06372b8046aa4373102348bdad205d
SHA1 91f272ed7e56a0250494cccf0101d660c9ae2422
SHA256 7dca00afd8de0748884a7c96dbdcfa55d53997ff7703067eb306461678180a2d
SHA512 5a88cd677972dde1794fcbbf3905d02904c3fdde50bb82924650ae89d209b943830cd55db0856145c6805e45534afbc6d1fbff58a39f05f1447c5eccde77c7b1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 9c7e2791c5993e6d8a3b20ff07ad2c65
SHA1 49b4f75288b60fe18082a2536fb96cfa4598f058
SHA256 68a6dfb2011009a6308f43ad9359e010a141a73277d009aef8659f3e2417e0b6
SHA512 c08bedbbede5491120fa205bcd7928deedb03ce2b43d1e85dcc3df30e90a73438178cc0b74f631dbdd63b4e855756e7a46bd4552d158ce70118de648c9e3b432

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1e2cc8f0-759c-4f32-8d05-f457418d9196.tmp

MD5 364592d2cc18adf665987584bf528cba
SHA1 d1225b2b8ee4038b0c42229833acc543deeab0f6
SHA256 bd97dd6797bb763681cfb1fc3cc21a44a273aab1d9a4f4f9332675c662d2136c
SHA512 0e852db825e451464cbcfda95eae2dfe780874bd20e7b467604962428007d1735ece752aa5901d468708a68d66d029271d5567b39c530d2d44b875abbff9aa40

C:\Users\Admin\Downloads\OperaSetup (1).exe

MD5 2a2d56e5df539fb3601cebf23a07ece2
SHA1 1dc31acde13de54df06dd31f9bc90eb53f0a0a5e
SHA256 35e6586bceb2b483df7a047e98c279c47394355b839d44973755ec8b1345cc9d
SHA512 1356c172ec8e2477e555eeb39889f47bc9928b2dca207f50cfb61b7ed0ac8e0a18cc5b8e9d6448bf856ad0318be6f0533647cfb19a49003d73db04517c744a13

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\Downloads\Unconfirmed 137934.crdownload

MD5 f9ca73d63fe61c4c401528fb470ce08e
SHA1 584f69b507ddf33985673ee612e6099aff760fb1
SHA256 16431cc14917abeb316e0bc44045440a8f86b7ac4fdd0dce99de6435d493ecca
SHA512 6fd03320ec84baf09a16a127c2c0ed3c265906fcb1a3b807c13001e775c396b66539238392438a8f290be04b8b8684050736331f8f99dbe8b868b44f154dd9de

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 5f80edce6e2ecfea16dfd5d00a234678
SHA1 9b3533e840629e28e7b496028688f58e6b542dc2
SHA256 6333cf6d11699ec4a29515b7bba54d1080a874ac16442a2bb31e8d323e810da5
SHA512 3e16d883d53ce4af644376866a28868d7419d0b4c8df35bf8cb966cc341693dc65f98758e6667b2ba165cfcb2aadef51ca4032fc40678f1a53fcc5f8598c4d84

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 c6e3804030cd8032ae9dfc2368d1f648
SHA1 fd42ba7733c4ba55835f7d0d5c72328c0b4c0f64
SHA256 aaa152e4cadd5943832393c8c07c64e7b82e5b9567fd152ffedb1e334df83fcd
SHA512 4c6bce1838ecbbba5382549699521725f1160ae0fa909fec6c3e40d1384a46c5df8ab9d31352cbea45497dd9652b0e306767a15f614a0796973c8b6ee139c3dd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5859f2.TMP

MD5 772e71cc9031183decef62ad37bed0ae
SHA1 8a85898bf7711f7a0d62329f786b8ef9bf9bc874
SHA256 9130f0d755299f9b4b2133d0820707d1f318f1815931544a5557045e7835a00f
SHA512 b4e4740c7b5352c87527ec416c83888da0eaf74c1957aaab5e0e1caeb88054b6840ff67703bf767322f19672d5bd28d8cd1004cb8647e1e66c80dfa8a3053a2d

memory/5616-386-0x000001D66FD10000-0x000001D66FD32000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zanjgxia.s1v.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 7189e96565d41f7d37b9569b0dabceb3
SHA1 79d3b4897e708d2891d15c9c8662aaa22b7bee39
SHA256 fcb1c2a50e2746acce96a1ba353f714387613159f2a714ef6ccd70420dadfef6
SHA512 9a250c47d94e46d29b4c57b4324af5ffa84b19624b7bf976fe59ae37a7673400ceba454a733f85e6d1622021752ab0c8c2e25287ed4c0e45dbd6a79c37644e99

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 daebb9aa4ba326c43035078bff6707fc
SHA1 3b3dbd3d9e85b59a9485c16ca867fe49cfa6992d
SHA256 21c5133e08f5bc2a80eb2680e2ca65794579531e06a64868cefd8139b7223e8e
SHA512 e139ac123b402efd4952d33ad1d68947757f398627712d4eec1549df25f34ea6cd1ae3356166c865ac6cee11df61534446421243221b7e22a650909fcecc1ae9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 d223648d8fcb331dc141c6c03d8ca8d5
SHA1 941b6a68b5dcc7dcb85eec0da4baf8b5a8a9717e
SHA256 d4f74376a15af588440f4536d3fe68bf2ca04ff8e90275ee904d37625f92aeb4
SHA512 0ef4e9e68f533c6d438825f80886bd192dc0f7406e12c28d5d8a526b3b4607c04f60187bd29a5a3c0fbc759a09a0361cd72b18d0ba6b6744bb7095d7d71ad979

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 713ad359b75fe6d947468ec1825202b9
SHA1 19dcd19f18a2ad6deb581451aad724bd44a592a4
SHA256 56572269ec031c63d966c6d3b4712600b908d38826c59c0f9a8225d0a783e9f4
SHA512 4df344dec422bed85b186909dc7f9c35126b3bb45e100f18fb95b4a9943ace242479adf5f0194b054d38b67032498f897a5a54b49026efee0c4797cb5a5e54e8

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a6c9d692ed2826ecb12c09356e69cc09
SHA1 def728a6138cf083d8a7c61337f3c9dade41a37f
SHA256 a07d329eb9b4105ba442c89f7cfa0d7b263f9f0617e26df93cf8cdc8dc94d57b
SHA512 2f27d2b241ce34f988c39e17ca5a1ebe628ac6c1b8ee8df121db9ad8929eaadf5f24ad66457591cccf87e60d2ba2eab88af860ab9c323a5c2a9867045d6e7ba3

memory/5720-437-0x000001A557990000-0x000001A5579A2000-memory.dmp

memory/5720-438-0x000001A557970000-0x000001A55797A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\exm.zip

MD5 57a6527690625bea4e4f668e7db6b2aa
SHA1 c5799fd94999d128203e81e22c6d9fdb86e167ee
SHA256 076e01b09f9c5cccc273b2f7dfa1a1efccc1a8e8ebf98a7eee756024b93bad17
SHA512 d86c7f79989eb0781e15f8631048506ffab338f933ddfedbcc2c7464447770beaf21b7ed3cba2ebb97be5ffdc9a450f2df2e2313efaeb8e8101f2ee53c066e4e

C:\exm\EXMservice.exe

MD5 aab9c36b98e2aeff996b3b38db070527
SHA1 4c2910e1e9b643f16269a2e59e3ada80fa70e5fa
SHA256 c148cc14f15b71a2d3f5e6bce6b706744f6b373a7e6c090c14f46f81d2d6e82f
SHA512 0db75756a041a7cda6b384718581aaf11e6873614465dd56e81f17ad171cffe380e288a3c2ee540222190392904921f26df8a1d66d4108051c60fc8e5b2df779

memory/644-480-0x00000000002E0000-0x0000000000346000-memory.dmp

C:\Users\Admin\msedge.exe

MD5 f1c2525da4f545e783535c2875962c13
SHA1 92bf515741775fac22690efc0e400f6997eba735
SHA256 9e6985fdb3bfa539f3d6d6fca9aaf18356c28a00604c4f961562c34fa9f11d0f
SHA512 56308ac106caa84798925661406a25047df8d90e4b65b587b261010293587938fa922fbb2cfdedfe71139e16bfcf38e54bb31cbcc00cd244db15d756459b6133

C:\Users\Admin\svchost.exe

MD5 1bea6c3f126cf5446f134d0926705cee
SHA1 02c49933d0c2cc068402a93578d4768745490d58
SHA256 1d69b5b87c4cd1251c5c94461a455659febb683eab0ebd97dd30da2319ffc638
SHA512 eb9f423f6adb5e686a53f5f197e6b08455f8048d965a9ec850838fdf4724ef87f68945c435ace5a48a9a7226006a348e97586335d0246ea0dc898a412dea5df3

memory/6004-542-0x0000000000EA0000-0x0000000000ECA000-memory.dmp

memory/5848-547-0x0000000000300000-0x000000000033E000-memory.dmp

memory/5848-559-0x00000000050C0000-0x0000000005126000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

MD5 72211aa293dac3ba5f24f45a8ff4eb1e
SHA1 f5f017375aa30e7b2e88d8940c0aa8ef7b9113bf
SHA256 5928de13a17e8e2f115dd501bc706a1cb59148bc37dc3a695cf2b89519279d21
SHA512 3d1b680fa86198c0a85baeec77c3657b36ba26a00ac00dbe7c287c3ca01f1e17fca7120fa0f8fc559732d54ac290e69ba3850cd91f05742c0be307292da1b540

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 83e2daf81e67294ce7e02eaf70271aac
SHA1 15d50093ed9d57e229adac299f3f9d3b1139c165
SHA256 d328fb035133258f28159d117c05edef12f1a73636765b2aec9961f2f992aa13
SHA512 13ad1fed9ed4795ad6e66e08d507392c4bc0cd3bc47a3ab83f3a986fbf3158902a6e49300f78d56fa285d0a0844c8e7317de9f750ba3e75bbdee3a7a81eaf7b2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

MD5 46c1de1047da395f16f108960df46001
SHA1 49832b2716d031bfa01242f1d63fe65cbc57fd39
SHA256 c1dc69004ced6127305aadfee3ae59ba4a19c1cdde2915b7ff83c5e9077d6c76
SHA512 dac9f00b255d80c9232a272ccc25cbdd9fa958460973cef397c49867429c0e128f801f2ef2371a6aff87768559794c6d2c0a6a3d2f69e646c9ae690ae58f0b45

C:\Users\Admin\AppData\Local\29ccd8ab9f4cfbe524edc3d0d7b48ba1\Admin@UIJZGLAR_en-US\Browsers\Edge\Cookies.txt

MD5 3641de2763413c3ff1bbd018251c6f94
SHA1 2cd84366be139ad49acd00294f2e2efcc38a18bd
SHA256 0cf5cc69dedd9e4c8fa9a1c2c43836a090b8eb7d51f70a8242fc692b3d69b98e
SHA512 ed7ac9ff19cf1434c9f7dab9928f1bcd02a6ad872ab59799a5d7c3c1a48dc35ae4a345e35d92da19100e13974102e3cd6ce3e7a7596cce4f4efcd48f7fe6dd5b

C:\Users\Admin\AppData\Local\29ccd8ab9f4cfbe524edc3d0d7b48ba1\Admin@UIJZGLAR_en-US\Browsers\Edge\History.txt

MD5 2b8554f6f582794d07e7b7f5770877c3
SHA1 ea2a166c6535caa058f8cfcdea41e773419d94a3
SHA256 ece386806b3c13b88032ab8daae3f9ece639c5fb6fbdb5848a5b8f3a15602c12
SHA512 35e20aeee751f378d466963e76311d9dbaf68ca449cf8e3690353db054501c98a4bf0f41fd6e40486faf0fce111dab07356f06e79c9b90a538813aef147fa018

C:\Users\Admin\AppData\Local\29ccd8ab9f4cfbe524edc3d0d7b48ba1\Admin@UIJZGLAR_en-US\System\Process.txt

MD5 6f875c903465ddc4f2c05bc979150319
SHA1 a2f12cf87862ff55884a23292278095df8d2ed99
SHA256 0b7ff5490ed78939a721dc56326b3abd6923c4997aab2e89d5c60073d560a5f4
SHA512 37ba85d78d2519a995bdeb46749fab26dcabe17ceaee67eae712ed41402e76aded113ee7a107d0720d0eaeaa7f26d38221d810194b8cd40c747c75dbf3f4f16b

memory/5848-711-0x0000000005CA0000-0x0000000005D32000-memory.dmp

memory/5848-712-0x00000000062F0000-0x0000000006896000-memory.dmp

memory/5848-717-0x0000000005D40000-0x0000000005D4A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 6b29b789ee92da979c3e9cf7d20d78ff
SHA1 1e81ed350e8ee4c3dfc660602dd1845248d3875b
SHA256 a9daab413b25b02dee875c2d0d3351e30bd1e7b2e8945cf930607cdcd7aab6af
SHA512 89452b94eda4e965873e47a3873b6576f93ba9b15726281c6e6e1e0d755a5dc1dbc40e947b384a8e24f589fa5a18902b9854b2ed644382a6c0ccef9dcabd6e7f

C:\Users\Admin\AppData\Local\29ccd8ab9f4cfbe524edc3d0d7b48ba1\msgid.dat

MD5 028188166d8e2bfc87cadf1a1abe429f
SHA1 5141709f6a688fe8418fc0b8946f73d0c4891153
SHA256 9b838f3485481578b3dd8ec59a9424b4268b7462017f6258330d4e8b1a59f013
SHA512 b8a2babea72f1a1c1d3261717978b8629c08823c4ff0a54ae261c0d26753ec6b5016c768aac423ff65a21fc6356b851653b1c068f63c42197e4e4380ab73ad0b

memory/5848-744-0x0000000005DD0000-0x0000000005DE2000-memory.dmp

C:\Users\Admin\AppData\Local\29ccd8ab9f4cfbe524edc3d0d7b48ba1\Admin@UIJZGLAR_en-US\Browsers\Firefox\Bookmarks.txt

MD5 2e9d094dda5cdc3ce6519f75943a4ff4
SHA1 5d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512 d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\msedge.exe.log

MD5 11c6e74f0561678d2cf7fc075a6cc00c
SHA1 535ee79ba978554abcb98c566235805e7ea18490
SHA256 d39a78fabca39532fcb85ce908781a75132e1bd01cc50a3b290dd87127837d63
SHA512 32c63d67bf512b42e7f57f71287b354200126cb417ef9d869c72e0b9388a7c2f5e3b61f303f1353baa1bf482d0f17e06e23c9f50b2f1babd4d958b6da19c40b0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 d73dcbb49df6245d2fe721801af54a0d
SHA1 83ddc94c67ccb7d5507cc0d7891be621915c91f1
SHA256 029734695cb1dd1bbf306670b6e8e8633f7b919a365c3ee9684525d6522ed666
SHA512 8ecb09c56521d0a99a98206728cdda4e6ea40d1e1dc38d476fc45ac305501e12e6f4ee61011ff193924efa99944463f5ad32966ec9f79c4a1f75e73f239f09ba

C:\exm\FortniteSettings\FortniteSettings.exe

MD5 a39de0d010e9d34de70abad81f031e23
SHA1 9903ee2dd6b87369eb33de49d5a3d13135309899
SHA256 3b4e1a5a0d85269d9491e155864e630339e292a9228dc1eb37ff61b0a657ff6e
SHA512 6247314d4ccf1fc14d8a999d476a6370b4e553bab76fb086f4cbf163f59c982643b0820d7d829ed3d3415456a613c777f90ac8c0ff3112be0ec44a7ee126a9d9

C:\Users\Admin\AppData\Local\Temp\_MEI22442\python310.dll

MD5 deaf0c0cc3369363b800d2e8e756a402
SHA1 3085778735dd8badad4e39df688139f4eed5f954
SHA256 156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d
SHA512 5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

C:\Users\Admin\AppData\Local\Temp\_MEI22442\VCRUNTIME140.dll

MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

C:\Users\Admin\AppData\Local\Temp\_MEI22442\base_library.zip

MD5 9c322d6c7170657a6a395ed999075f7f
SHA1 6fc20c00dc2e808d1475192bd95ff3155959e4ac
SHA256 16c81033f5134edd1b615d721fdf38181babd030abc0805abdfdc6f926606d43
SHA512 3170b8f275525457545fed852c434c1f1c1de54bdfbbde7b3edd83b0fe776099671b5ef3109b8e978ba6c4e5387a405da7d8b0858528394b4d678d860b734375

C:\Users\Admin\AppData\Local\Temp\_MEI22442\python3.DLL

MD5 c17b7a4b853827f538576f4c3521c653
SHA1 6115047d02fbbad4ff32afb4ebd439f5d529485a
SHA256 d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68
SHA512 8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

C:\Users\Admin\AppData\Local\Temp\_MEI22442\_ctypes.pyd

MD5 ca4cef051737b0e4e56b7d597238df94
SHA1 583df3f7ecade0252fdff608eb969439956f5c4a
SHA256 e60a2b100c4fa50b0b144cf825fe3cde21a8b7b60b92bfc326cb39573ce96b2b
SHA512 17103d6b5fa84156055e60f9e5756ffc31584cdb6274c686a136291c58ba0be00238d501f8acc1f1ca7e1a1fadcb0c7fefddcb98cedb9dd04325314f7e905df3

C:\Users\Admin\AppData\Local\Temp\_MEI22442\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

memory/3340-1824-0x00007FFE84EE0000-0x00007FFE84F00000-memory.dmp

memory/3340-1838-0x00007FFE84EE0000-0x00007FFE84F00000-memory.dmp

memory/6336-3695-0x00007FFE84EE0000-0x00007FFE84F00000-memory.dmp

memory/6336-3710-0x00007FFE84EE0000-0x00007FFE84F00000-memory.dmp