52972a23ab12b95cd51d71741db2cf276749e56030c092e2e4f0907dcb1fbd56

max time kernel
7s
max time network
397s
platform
windows10-2004_x64
resource
win10v2004-20230220-ja
resource tags

arch:x64arch:x86image:win10v2004-20230220-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
25-02-2023 11:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fucker script.exe
Size

104KB
MD5

db0655efbe0dbdef1df06207f5cb5b5b
SHA1

a8d48d5c0042ce359178d018c0873e8a7c2f27e8
SHA256

52972a23ab12b95cd51d71741db2cf276749e56030c092e2e4f0907dcb1fbd56
SHA512

5adc8463c3e148a66f8afdeefc31f2b3ffeb12b7641584d1d24306b0898da60a8b9b948bb4f9b7d693185f2daa9bd9437b3b84cebc0eabfa84dfcef6938e1704
SSDEEP

1536:m5iT3FccnYWkyjWpOku3yUyJCbyVAvy7+fRo:3LOcxkyjW3wvHq

Score

10^/10

persistence

Malware Config

Signatures

Process spawned unexpected child process 5 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process	5368	1812	msedge.exe	92
Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process	4168	1812	msedge.exe	92
Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process	5432	1812	msedge.exe	92
Parent C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE is not expected to spawn this process	952	3516	msedge.exe	189
Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process	7996	1812	msedge.exe	92

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	onedrive.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\LocalServer32	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileSyncShell.dll"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32\ThreadingModel = "Apartment"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe /cci /client=Personal"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\ThreadingModel = "Apartment"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\ThreadingModel = "Apartment"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32\ThreadingModel = "Apartment"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\ThreadingModel = "Apartment"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe /cci /client=Personal"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{6bb93b4e-44d8-40e2-bd97-42dbcf18a40f}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe /cci"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe /cci /client=Personal"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileSyncShell.dll"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32\ThreadingModel = "Apartment"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe /cci /client=Personal"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\LocalServer32	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileSyncShell.dll"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileSyncShell.dll"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32\ThreadingModel = "Apartment"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\ThreadingModel = "Apartment"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32\ThreadingModel = "Apartment"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileSyncShell.dll"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuthLib.dll"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32\ThreadingModel = "Both"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\LocalServer32	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32\ThreadingModel = "Apartment"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\LocalServer32	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileSyncShell.dll"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll"	onedrive.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
4500	7752	WerFault.exe	165
1632	1996	WerFault.exe	191
7096	8556	WerFault.exe	222
5392	8916	WerFault.exe	234
6592	7616	WerFault.exe	254
9736	7616	WerFault.exe	254
9172	5380	WerFault.exe	301

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	onedrive.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	onedrive.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	onedrive.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	onedrive.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{6bb93b4e-44d8-40e2-bd97-42dbcf18a40f}\ = "ToastActivator Class"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\FileSyncClient.AutoPlayHandler\shell\import\DropTarget\CLSID = "{5999E1EE-711E-48D2-9884-851A709F543D}"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Interface\{D0ED5C72-6197-4AAD-9B16-53FE461DD85C}\ = "IFileUploadCallback"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Interface\{53de12aa-df96-413d-a25e-c75b6528abf2}\ = "IGetSyncStatusCallback"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{AEEBAD4E-3E0A-415B-9B94-19C499CD7B6A}	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\SyncEngineFileInfoProvider.SyncEngineFileInfoProvider\CurVer\ = "SyncEngineFileInfoProvider.SyncEngineFileInfoProvider.1"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{0d4e4444-cb20-4c2b-b8b2-94e5656ecae8}\ = "IGetSyncStatusCallback"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Interface\{F0AF7C30-EAE4-4644-961D-54E6E28708D6}\TypeLib\Version = "1.0"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{10C9242E-D604-49B5-99E4-BF87945EF86C}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{390AF5A7-1390-4255-9BC9-935BFCFA5D57}\TypeLib\Version = "1.0"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Interface\{1b7aed4f-fcaf-4da4-8795-c03e635d8edc}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{B54E7079-90C9-4C62-A6B8-B2834C33A04A}\ProxyStubClsid32	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Interface\{0f872661-c863-47a4-863f-c065c182858a}\TypeLib\Version = "1.0"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{0f872661-c863-47a4-863f-c065c182858a}\TypeLib\Version = "1.0"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Interface\{B05D37A9-03A2-45CF-8850-F660DF0CBF07}	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{B05D37A9-03A2-45CF-8850-F660DF0CBF07}\ = "IOneDriveInfoProvider"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\ProgID\ = "FileSyncClient.FileSyncClient.1"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{9D613F8A-B30E-4938-8490-CB5677701EBF}	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{EE15BBBB-9E60-4C52-ABCB-7540FF3DF6B3}	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{c1439245-96b4-47fc-b391-679386c5d40f}\TypeLib\Version = "1.0"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\ = "SyncEngineFileInfoProvider Class"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\VersionIndependentProgID	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}\ = "IToastNotificationEvent"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\TypeLib\{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\SyncEngineStorageProviderHandlerProxy.SyncEngineStorageProviderHandlerProxy	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{5d65dd0d-81bf-4ff4-aeea-6effb445cb3f}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Interface\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A}\ProxyStubClsid32	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\SyncEngineFileInfoProvider.SyncEngineFileInfoProvider.1\ = "SyncEngineFileInfoProvider Class"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Interface\{9D613F8A-B30E-4938-8490-CB5677701EBF}	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Interface\{ACDB5DB0-C9D5-461C-BAAA-5DCE0B980E40}	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Interface\{F062BA81-ADFE-4A92-886A-23FD851D6406}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{AF60000F-661D-472A-9588-F062F6DB7A0E}	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Interface\{2F12C599-7AA5-407A-B898-09E6E4ED2D1E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\TypeLib	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\TypeLib\{638805C3-4BA3-4AC8-8AAC-71A0BA2BC284}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe\\1"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\ = "ErrorOverlayHandler Class"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\amd64\\FileSyncShell64.dll"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\ = "OOBERequestHandler Class"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{466F31F7-9892-477E-B189-FA5C59DE3603}	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\ProgID	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{390AF5A7-1390-4255-9BC9-935BFCFA5D57}\ = "IAlbumMetadataCallback"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{2387C6BD-9A36-41A2-88ED-FF731E529384}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\TypeLib\{C9F3F6BB-3172-4CD8-9EB7-37C9BE601C87}\1.0	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\TypeLib	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Interface\{AEEBAD4E-3E0A-415B-9B94-19C499CD7B6A}\ProxyStubClsid32	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\ = "UpToDateUnpinnedOverlayHandler Class"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Interface\{10C9242E-D604-49B5-99E4-BF87945EF86C}\TypeLib	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{10C9242E-D604-49B5-99E4-BF87945EF86C}\TypeLib	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Interface\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{c1439245-96b4-47fc-b391-679386c5d40f}\ProxyStubClsid32	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Interface\{c1439245-96b4-47fc-b391-679386c5d40f}\TypeLib\Version = "1.0"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{2EB31403-EBE0-41EA-AE91-A1953104EA55}\TypeLib\Version = "1.0"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\odopen\DefaultIcon	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\ProgID	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{F062BA81-ADFE-4A92-886A-23FD851D6406}\TypeLib\Version = "1.0"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Interface\{1B71F23B-E61F-45C9-83BA-235D55F50CF9}\TypeLib\Version = "1.0"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{F062BA81-ADFE-4A92-886A-23FD851D6406}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	onedrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Interface\{53de12aa-df96-413d-a25e-c75b6528abf2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	onedrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\SyncEngineStorageProviderHandlerProxy.SyncEngineStorageProviderHandlerProxy.1	onedrive.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1796	onedrive.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1796	onedrive.exe
1796	onedrive.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1796	onedrive.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1796	onedrive.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1796	onedrive.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 4732	2860	msedge.exe	91
PID 2860 wrote to memory of 4732	2860	msedge.exe	91
PID 2220 wrote to memory of 4840	2220	msedge.exe	90
PID 2220 wrote to memory of 4840	2220	msedge.exe	90
PID 876 wrote to memory of 4820	876	msedge.exe	95
PID 876 wrote to memory of 4820	876	msedge.exe	95
PID 4844 wrote to memory of 2868	4844	msedge.exe	97
PID 4844 wrote to memory of 2868	4844	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\fucker script.exe
"C:\Users\Admin\AppData\Local\Temp\fucker script.exe"
1⤵
PID:3612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044778
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0x40,0x104,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,12938102653533542024,10432494263716791895,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,12938102653533542024,10432494263716791895,131072 --lang=ja --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044904
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --lang=ja --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --lang=ja --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --lang=ja --service-sandbox-type=collections --mojo-platform-channel-handle=6684 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7192 /prefetch:1
  2⤵
  PID:6152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6ac5e5460,0x7ff6ac5e5470,0x7ff6ac5e5480
    3⤵
    PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --lang=ja --service-sandbox-type=none --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --lang=ja --service-sandbox-type=none --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:6312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --lang=ja --service-sandbox-type=none --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:6276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:7200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:7576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:7564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:7548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7444 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:7920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:7768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7232 /prefetch:1
  2⤵
  PID:8352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7432 /prefetch:1
  2⤵
  PID:8312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:8752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:9144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8080 /prefetch:1
  2⤵
  PID:8484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:9132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --lang=ja --service-sandbox-type=audio --mojo-platform-channel-handle=8008 /prefetch:8
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8044 /prefetch:1
  2⤵
  PID:8664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8280 /prefetch:1
  2⤵
  PID:8780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --lang=ja --service-sandbox-type=video_capture --mojo-platform-channel-handle=8036 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8388 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8372 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8348 /prefetch:1
  2⤵
  PID:9192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9196 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9348 /prefetch:1
  2⤵
  PID:9140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9716 /prefetch:1
  2⤵
  PID:9340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:9812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8068 /prefetch:1
  2⤵
  PID:9228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7792 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8020 /prefetch:1
  2⤵
  PID:9292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7600 /prefetch:1
  2⤵
  PID:9480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:9724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8552 /prefetch:1
  2⤵
  PID:9956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8532 /prefetch:1
  2⤵
  PID:9928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9784 /prefetch:1
  2⤵
  PID:9984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8092 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8296 /prefetch:1
  2⤵
  PID:8528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 /prefetch:2
  2⤵
  PID:9688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7864 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10216 /prefetch:1
  2⤵
  PID:7812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10304 /prefetch:1
  2⤵
  PID:8616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10284 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9080 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8188 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7192 /prefetch:1
  2⤵
  PID:9892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:9872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7708 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7668 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=176 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7732 /prefetch:1
  2⤵
  PID:9920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9376 /prefetch:1
  2⤵
  PID:8828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8964 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6980 /prefetch:1
  2⤵
  PID:7320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11420 /prefetch:1
  2⤵
  PID:6804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11856 /prefetch:1
  2⤵
  PID:8312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11884 /prefetch:1
  2⤵
  PID:6512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11196 /prefetch:1
  2⤵
  PID:7280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2780 /prefetch:1
  2⤵
  PID:7688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8584 /prefetch:1
  2⤵
  PID:6988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11972 /prefetch:1
  2⤵
  PID:6592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4400 /prefetch:1
  2⤵
  PID:6212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11148 /prefetch:1
  2⤵
  PID:6436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:8768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10100 /prefetch:1
  2⤵
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10084 /prefetch:1
  2⤵
  PID:9844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14567788046805364298,1419381084608127320,131072 --disable-gpu-compositing --lang=ja --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12332 /prefetch:1
  2⤵
  PID:9788

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe"
1⤵
- Modifies system executable filetype association
- Registers COM server for autorun
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1796
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe" /client=Business1 /hideWelcomePage
  2⤵
  PID:3404
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe" /client=Business1 /hideWelcomePage
  2⤵
  PID:7580
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe" /client=Business1 /hideWelcomePage
  2⤵
  PID:7288
- C:\Windows\SysWOW64\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1796" "3044" "3068" "2752" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  PID:460

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"
1⤵
PID:1744

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"
1⤵
PID:2924

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"
1⤵
PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?LinkId=521839
  2⤵
  - Process spawned unexpected child process
  PID:5368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:7876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?LinkId=521839
  2⤵
  - Process spawned unexpected child process
  PID:4168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?LinkId=521839
  2⤵
  - Process spawned unexpected child process
  PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:8932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?LinkId=521839
  2⤵
  - Process spawned unexpected child process
  PID:7996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0x80,0x104,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:3376

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"
1⤵
PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044904
1⤵
- Suspicious use of WriteProcessMemory
PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,12755187035387793849,812256530957328529,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,12755187035387793849,812256530957328529,131072 --lang=ja --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  PID:2888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044786
1⤵
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10554882960746517890,12422025867351790169,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,10554882960746517890,12422025867351790169,131072 --lang=ja --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  PID:5004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6092

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\441fca4c508c42729eeeb639dbc25f70 /t 3228 /p 3224
1⤵
PID:5268

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:6396

C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe
"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch
1⤵
PID:3476

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\16828460547d43caae79b09e80371c31 /t 6484 /p 6396
1⤵
PID:3672

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3760
- C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"
  2⤵
  PID:5328
- C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"
  2⤵
  PID:5900
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe"
  2⤵
  PID:5376
- C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044904
  2⤵
  PID:5508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044778
  2⤵
  PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x40,0xb0,0xdc,0x104,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:3832
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"
  2⤵
  PID:8152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044778
  2⤵
  PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044904
  2⤵
  PID:7224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe0,0xe4,0xd8,0xdc,0x108,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:2984
- C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"
  2⤵
  PID:7116
- C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"
  2⤵
  PID:7196
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe"
  2⤵
  PID:8028
- C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044904
  2⤵
  PID:7836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:4656
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"
  2⤵
  PID:7040
- C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"
  2⤵
  PID:8048
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe"
  2⤵
  PID:6336
- C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" /recycle
  2⤵
  PID:3516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2083734
    3⤵
    - Process spawned unexpected child process
    PID:952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
      4⤵
      PID:1596
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"
  2⤵
  PID:5664
- C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"
  2⤵
  PID:1484
- C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"
  2⤵
  PID:6788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044782
  2⤵
  PID:7032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044786
  2⤵
  PID:4352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:7236
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe"
  2⤵
  PID:436
- C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" /recycle
  2⤵
  PID:8160
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"
  2⤵
  PID:7432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044786
  2⤵
  PID:6780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:7060
- C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"
  2⤵
  PID:7988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044904
  2⤵
  PID:7092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:8112
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe"
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044904
  2⤵
  PID:6936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:6096
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"
  2⤵
  PID:8324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044786
  2⤵
  PID:8488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:8508
- C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"
  2⤵
  PID:9016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044904
  2⤵
  PID:9008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:9044
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe"
  2⤵
  PID:7752
- C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" /recycle
  2⤵
  PID:7272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044778
  2⤵
  PID:7396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:7824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044904
  2⤵
  PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044782
  2⤵
  PID:2216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xe8,0x104,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:8696
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044778
  2⤵
  PID:8560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:8952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044904
  2⤵
  PID:8604
- C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"
  2⤵
  PID:9140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044904
  2⤵
  PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:6796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044782
  2⤵
  PID:7372
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"
  2⤵
  PID:9400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044782
  2⤵
  PID:10212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd4,0x108,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:7680
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe"
  2⤵
  PID:6212
- C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"
  2⤵
  PID:9776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044904
  2⤵
  PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0x9c,0x104,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044778
  2⤵
  PID:6660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044786
  2⤵
  PID:1080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:6076
- C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"
  2⤵
  PID:6700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044778
  2⤵
  PID:2144
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe"
  2⤵
  PID:5468
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe"
  2⤵
  PID:8172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044786
  2⤵
  PID:5472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044786
  2⤵
  PID:2272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:1184
- C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"
  2⤵
  PID:8624
- C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044904
  2⤵
  PID:6628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:9588
- C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044782
  2⤵
  PID:8276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:9856
- C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"
  2⤵
  PID:9656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2044778
  2⤵
  PID:9800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xd4,0x110,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
    3⤵
    PID:6848
- C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"
  2⤵
  PID:8584
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\onedrive.exe"
  2⤵
  PID:8884

C:\Windows\system32\wwahost.exe
"C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa
1⤵
PID:2588

C:\Windows\system32\wwahost.exe
"C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa
1⤵
PID:3676

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:736

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:6264

C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe
"C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe" -ServerName:microsoft.onenoteim.AppXxqb9ypsz6cs1w07e1pmjy4ww4dy9tpqr.mca
1⤵
PID:7752
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 7752 -s 2268
  2⤵
  - Program crash
  PID:4500

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 404 -p 7752 -ip 7752
1⤵
PID:3424

C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe
"C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe" -ServerName:microsoft.onenoteim.AppXxqb9ypsz6cs1w07e1pmjy4ww4dy9tpqr.mca
1⤵
PID:3020

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:7228

C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe
"C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe" -ServerName:microsoft.onenoteim.AppXxqb9ypsz6cs1w07e1pmjy4ww4dy9tpqr.mca
1⤵
PID:1996
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1996 -s 3104
  2⤵
  - Program crash
  PID:1632

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 944 -p 1996 -ip 1996
1⤵
PID:6808

C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe
"C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe" -ServerName:microsoft.onenoteim.AppXxqb9ypsz6cs1w07e1pmjy4ww4dy9tpqr.mca
1⤵
PID:4292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:6332

C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe
"C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe" -ServerName:microsoft.onenoteim.AppXxqb9ypsz6cs1w07e1pmjy4ww4dy9tpqr.mca
1⤵
PID:8556
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 8556 -s 2972
  2⤵
  - Program crash
  PID:7096

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 944 -p 8556 -ip 8556
1⤵
PID:8400

C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe
"C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe" -ServerName:microsoft.onenoteim.AppXxqb9ypsz6cs1w07e1pmjy4ww4dy9tpqr.mca
1⤵
PID:6360

C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe
"C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe" -ServerName:microsoft.onenoteim.AppXxqb9ypsz6cs1w07e1pmjy4ww4dy9tpqr.mca
1⤵
PID:8916
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 8916 -s 2808
  2⤵
  - Program crash
  PID:5392

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 932 -p 8916 -ip 8916
1⤵
PID:7876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
1⤵
PID:8948

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
1⤵
PID:8692

C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe
"C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe" -ServerName:microsoft.onenoteim.AppXxqb9ypsz6cs1w07e1pmjy4ww4dy9tpqr.mca
1⤵
PID:7616
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 7616 -s 3664
  2⤵
  - Program crash
  PID:6592
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 7616 -s 3664
  2⤵
  - Program crash
  PID:9736

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 748 -p 7616 -ip 7616
1⤵
PID:9236

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\04b03e2a6c34418b96191a8ca3a24002 /t 3532 /p 5900
1⤵
PID:8368

C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe
"C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe" -ServerName:microsoft.onenoteim.AppXxqb9ypsz6cs1w07e1pmjy4ww4dy9tpqr.mca
1⤵
PID:5380
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 5380 -s 2700
  2⤵
  - Program crash
  PID:9172

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 484 -p 5380 -ip 5380
1⤵
PID:6564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa9e7e46f8,0x7ffa9e7e4708,0x7ffa9e7e4718
1⤵
PID:8352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177

Filesize
471B

MD5
c70aa0323664e361c1cfc7a721ba0e26

SHA1
1b1f314e286ad41b9aae1a10fd9d806cf9af3a14

SHA256
6e5bde9b6e22786e7712c4968ef5a6cb89858b7a4d612d2fa8f38281d73f1b71

SHA512
263628e5a90b09ffa8655dca0df81aa0d4608e3f35cdd98725ee85a19540def7b76d0bb1929fd61bb3bb522c1426eac54cf69314a1d9c8e6d055c637887088b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177

Filesize
442B

MD5
23ce8698c900d02fb54871ffdee46e91

SHA1
4a94be26f9b5ea0a6ac4ef9b173937d4a78693d8

SHA256
16c5ad39e8ef654a7fe60ef5c86f4b7627fe6d8a4a2913c8920c53b1387a3cca

SHA512
1cdf49b5006f0928bfff3bb2acae3dfaeba488ff722700f7b6bf7526ef2259907a8261406876ea31bfbc12e7d8b3d9bb8b24f06fef1b41265420b40bc261ec37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
89dace12b757246520216f56ab949723

SHA1
7e49b4dbebcb2a43239d41e099d470abc964e1bf

SHA256
0feab16f16de58d94d39fab2e6184f70430ade9f07df8ad78180a227bec07beb

SHA512
9b69f0698d15326e98b4fc2b461849b8e4edf510e3e2a1b96b025c7fcb967aa6a6cf67da17cadf3b622e02ea03bbce9c8d0d980152e4abebd38b7e20dab6c8dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0820611471c1bb55fa7be7430c7c6329

SHA1
5ce7a9712722684223aced2522764c1e3a43fbb9

SHA256
f00d04749a374843bd118b41f669f8b0a20d76526c34b554c3ccac5ebd2f4f75

SHA512
77ea022b4265f3962f5e07a0a790f428c885da0cc11be0975285ce0eee4a2eec0a7cda9ea8f366dc2a946679b5dd927c5f94b527de6515856b68b8d08e435148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0820611471c1bb55fa7be7430c7c6329

SHA1
5ce7a9712722684223aced2522764c1e3a43fbb9

SHA256
f00d04749a374843bd118b41f669f8b0a20d76526c34b554c3ccac5ebd2f4f75

SHA512
77ea022b4265f3962f5e07a0a790f428c885da0cc11be0975285ce0eee4a2eec0a7cda9ea8f366dc2a946679b5dd927c5f94b527de6515856b68b8d08e435148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0820611471c1bb55fa7be7430c7c6329

SHA1
5ce7a9712722684223aced2522764c1e3a43fbb9

SHA256
f00d04749a374843bd118b41f669f8b0a20d76526c34b554c3ccac5ebd2f4f75

SHA512
77ea022b4265f3962f5e07a0a790f428c885da0cc11be0975285ce0eee4a2eec0a7cda9ea8f366dc2a946679b5dd927c5f94b527de6515856b68b8d08e435148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0820611471c1bb55fa7be7430c7c6329

SHA1
5ce7a9712722684223aced2522764c1e3a43fbb9

SHA256
f00d04749a374843bd118b41f669f8b0a20d76526c34b554c3ccac5ebd2f4f75

SHA512
77ea022b4265f3962f5e07a0a790f428c885da0cc11be0975285ce0eee4a2eec0a7cda9ea8f366dc2a946679b5dd927c5f94b527de6515856b68b8d08e435148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0820611471c1bb55fa7be7430c7c6329

SHA1
5ce7a9712722684223aced2522764c1e3a43fbb9

SHA256
f00d04749a374843bd118b41f669f8b0a20d76526c34b554c3ccac5ebd2f4f75

SHA512
77ea022b4265f3962f5e07a0a790f428c885da0cc11be0975285ce0eee4a2eec0a7cda9ea8f366dc2a946679b5dd927c5f94b527de6515856b68b8d08e435148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0820611471c1bb55fa7be7430c7c6329

SHA1
5ce7a9712722684223aced2522764c1e3a43fbb9

SHA256
f00d04749a374843bd118b41f669f8b0a20d76526c34b554c3ccac5ebd2f4f75

SHA512
77ea022b4265f3962f5e07a0a790f428c885da0cc11be0975285ce0eee4a2eec0a7cda9ea8f366dc2a946679b5dd927c5f94b527de6515856b68b8d08e435148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0820611471c1bb55fa7be7430c7c6329

SHA1
5ce7a9712722684223aced2522764c1e3a43fbb9

SHA256
f00d04749a374843bd118b41f669f8b0a20d76526c34b554c3ccac5ebd2f4f75

SHA512
77ea022b4265f3962f5e07a0a790f428c885da0cc11be0975285ce0eee4a2eec0a7cda9ea8f366dc2a946679b5dd927c5f94b527de6515856b68b8d08e435148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0820611471c1bb55fa7be7430c7c6329

SHA1
5ce7a9712722684223aced2522764c1e3a43fbb9

SHA256
f00d04749a374843bd118b41f669f8b0a20d76526c34b554c3ccac5ebd2f4f75

SHA512
77ea022b4265f3962f5e07a0a790f428c885da0cc11be0975285ce0eee4a2eec0a7cda9ea8f366dc2a946679b5dd927c5f94b527de6515856b68b8d08e435148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
425e83cc5a7b1f8edfbec7d986058b01

SHA1
432a90a25e714c618ff30631d9fdbe3606b0d0df

SHA256
060a2e5f65b8f3b79a8d4a0c54b877cfe032f558beb0888d6f810aaeef8579bd

SHA512
4bf074de60e7849ade26119ef778fe67ea47691efff45f3d5e0b25de2d06fcc6f95a2cfcdbed85759a5c078bb371fe57de725babda2f44290b4dc42d7b6001af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
425e83cc5a7b1f8edfbec7d986058b01

SHA1
432a90a25e714c618ff30631d9fdbe3606b0d0df

SHA256
060a2e5f65b8f3b79a8d4a0c54b877cfe032f558beb0888d6f810aaeef8579bd

SHA512
4bf074de60e7849ade26119ef778fe67ea47691efff45f3d5e0b25de2d06fcc6f95a2cfcdbed85759a5c078bb371fe57de725babda2f44290b4dc42d7b6001af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
425e83cc5a7b1f8edfbec7d986058b01

SHA1
432a90a25e714c618ff30631d9fdbe3606b0d0df

SHA256
060a2e5f65b8f3b79a8d4a0c54b877cfe032f558beb0888d6f810aaeef8579bd

SHA512
4bf074de60e7849ade26119ef778fe67ea47691efff45f3d5e0b25de2d06fcc6f95a2cfcdbed85759a5c078bb371fe57de725babda2f44290b4dc42d7b6001af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
425e83cc5a7b1f8edfbec7d986058b01

SHA1
432a90a25e714c618ff30631d9fdbe3606b0d0df

SHA256
060a2e5f65b8f3b79a8d4a0c54b877cfe032f558beb0888d6f810aaeef8579bd

SHA512
4bf074de60e7849ade26119ef778fe67ea47691efff45f3d5e0b25de2d06fcc6f95a2cfcdbed85759a5c078bb371fe57de725babda2f44290b4dc42d7b6001af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
425e83cc5a7b1f8edfbec7d986058b01

SHA1
432a90a25e714c618ff30631d9fdbe3606b0d0df

SHA256
060a2e5f65b8f3b79a8d4a0c54b877cfe032f558beb0888d6f810aaeef8579bd

SHA512
4bf074de60e7849ade26119ef778fe67ea47691efff45f3d5e0b25de2d06fcc6f95a2cfcdbed85759a5c078bb371fe57de725babda2f44290b4dc42d7b6001af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
45KB

MD5
e109d6a987336a30917c611637c5c227

SHA1
f7a36402693232c91adef4fa047e16a585f6a164

SHA256
3087ebdbf258df09647307c2ceab45c6b1b0f169ca199e9d259145e988aa330a

SHA512
eceb31972de745895b4842ea1f72c472a6809235c2b0a3e63ba6ef8dae89a265151b7b7817dbe9c2a75db5260ea3ce2d6a5c02869cd87664b39624784a62a824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
110KB

MD5
cccf805fe56bd07f69a6b7a0aaac53ea

SHA1
d675d883e761d15b3453bf030f3a3b248b00cda6

SHA256
3c2672b5a54e4d6e1bd8556e8ded9c6db5c587e54e6bc86e2a354c0fef5d5334

SHA512
b7ecc76db5e6aa826dbdb1109ba874714e98a1d20fd63a7e1d59a648559e38572961b37e0b9df15dfebe108f55da66f6031d083cc7d0a90e6889f6d9b14881c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
55KB

MD5
b15c7576ce37c75b9b32221e0e29ad6a

SHA1
66c22b2eba8e86f68cdde8ae68126890f8657f8a

SHA256
77611eefe32e8150e78a6bfeda5657fa838a57b96ec93b9ab8ab7523c683d635

SHA512
9a5c9bd59331e056b761ebe8d3924553e41b9d16c351286d186d40ae6beeb9a5e0c13d408f4fe2bb55c26d4906b26bc461d3487ba88080bb57619957a4740569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
292KB

MD5
fe5a2893e794fde825f1f81ce58069d3

SHA1
b6504426426485d7f101cc977821b90f887e81c9

SHA256
6d34efaa549497cfaab006127b3a2972de32107f90bb546e5ab58f366263d66f

SHA512
b82e91c199cff3fbf32f74ca6e308270a88df6b5c1ebea685fcda9e3b96a6f665fb40b1526f3af0f4585c0020a2ebb3f65e5483f664c50ed232a250f2e60b506

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
208KB

MD5
071bb289e3df2fbbc0934b4938205d4c

SHA1
80327009ae5a103558db5478590fc29b79b90aac

SHA256
ade8067055df4334df200b438f8d96aac86c5b2a38f10787426fcf0d9c0bb764

SHA512
54509a380e10cea0293133e7201e79c5bfdb749a14bf5a2013906f21e366a9fb33172539dd161f843958212d589140ac025c3574be5128d750619f7777196b99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
51KB

MD5
6ac2dfe90eb92f3e73f455336fb398d0

SHA1
28c6222c9adf5611aa0a9711aadce61b121f1e01

SHA256
3c39fdff9ff023b20fcd57492ce73477638f794f92de4af613e3acd11489fc4e

SHA512
b89edf1774589c8b01776e7e25cd462698b96bd8747f8dc4857c45ce4c218ed4ca6ac8aadba205a64fff2db66b5b2f596df6c9362974515df16134c329089c54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
111KB

MD5
86bd1c0c4b83992ef8fecb2cda5ec95d

SHA1
1d7f95cffb0a5e1bcedef8457f893d4c830dfe2c

SHA256
51b0649321fc3dff512f71dd9683267e4c1b586805f0f4774f18965490346649

SHA512
17949f910c1c0d2ee4dcc0bbd2dd378795a082050f2c679bc2e88c26e8e99838a2d003cbb65737e58f468ba3ca13e41df09d5dce4fde8a269cf2daba9ff009a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
31KB

MD5
f08085f6a14c2943810e3c32098abf3d

SHA1
7c5ac63e0f523335bcf06bc2fa177b456761fef1

SHA256
122df630130376e3f002dee8b8d46fdd680d836ecc5c5f073e906d782ebdc2d1

SHA512
43af01eb6a6ed1b87105bd0f1da1fb91d1ca447db8760fb15557f370d37bc48bba8e63643244826a6b1cb2ddb59f01dc64958da4e1fb35652a98536f92ada378

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
19KB

MD5
f4adbf9c60a3ef95809a6008f6764d08

SHA1
b55c98c403b111b494c1ece263dc06eabc0ab075

SHA256
6a59a4f890ea26ef050b83d0722aafc3ad70ddbce706806381c4f159a5db7497

SHA512
14e1d5037910e7cea689516b9751f812254b5771c31b28b51c7b6af8cc24c5c086eaac79e40b544b36da48ff6a7ee3b6402c55a7ccfb2c307bd40742b126f40c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
25KB

MD5
d0263dc03be4c393a90bda733c57d6db

SHA1
8a032b6deab53a33234c735133b48518f8643b92

SHA256
22b4df5c33045b645cafa45b04685f4752e471a2e933bff5bf14324d87deee12

SHA512
9511bef269ae0797addf4cd6f2fec4ad0c4a4e06b3e5bf6138c7678a203022ac4818c7d446d154594504c947da3061030e82472d2708149c0709b1a070fdd0e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
17KB

MD5
7916a894ebde7d29c2cc29b267f1299f

SHA1
78345ca08f9e2c3c2cc9b318950791b349211296

SHA256
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3

SHA512
2180abe47fbf76e2e0608ab3a4659c1b7ab027004298d81960dc575cc2e912ecca8c131c6413ebbf46d2aaa90e392eb00e37aed7a79cdc0ac71ba78d828a84c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
34KB

MD5
a64a98cfae7f7a2b199185feef5f554f

SHA1
f1101c0a31dbac4dcce2dc4095ed9b594433ab1b

SHA256
5897e6de06f512109fc00d22075aabf56a40d992608814e66b97ab7291c6675f

SHA512
16cc787d7633e48c1a195481f98e5d940f8d808208e4f4a5e2124b6c6cd94ccd81e5ea79c2434f2b5e4e6227be88c0a5386a84cb7802c78f504c74cf16be9863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
22KB

MD5
b56ba1453670c0956d8d1abaf87489e0

SHA1
e179ae21fedb13ffb650bfebbe84f7c0bee29c37

SHA256
ae7833af7ee814817c1f08fcdf3115e5627e15eb6306b1034a0dae577b665686

SHA512
f2746cd2f4fc561d921c78d6445ed389667c5a899073564c2ed25670ec2a6782b12698768bd71fb107ae5f225ef9686694dc5c041a95a924bdc1cfb8a3d3bf29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
35KB

MD5
d95e11ceb03f2345a320093cab78025e

SHA1
61a86a14316100b63da779f7e173849643e687f5

SHA256
e51a46060665f507a73982f7aa0a4088fc5b371023c237fefa0a1d806b56f6b0

SHA512
80bc373efe00d567e441ac8a4af23fffd4b682277b54c784a0b43908cd246b70e3afb975e716ff2fda0bc052eca45260cd2915fec5840f158350defe6f5270c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
17KB

MD5
35893ff010a9cb8af65b4a9c944140a7

SHA1
c765628849e861ebd79103ef7455adf2ebe064c2

SHA256
222a835cc9204eb4d64b349d0195d6d1a62ce6859f5ef7334dba18c2265b9456

SHA512
5705596a7b9ca7e3781f30c5b6dd47494bd369ad8d344e64b3f5f98accfaf96fc5ffce8fef39df36b0367d35a74f272c8abe335b494356d10aaa499caa7d2b9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
37KB

MD5
5e71c40aaa27dcfea19d7de24dcca58d

SHA1
618239e0a0e0038ee4a8bb82115e24aaa9a37dfd

SHA256
7841a9a76fcacd3ff43f26e65a97b6daf10e2da993a17b2ebbb9236455f952fb

SHA512
88754a54a084964be7b51861c681d5b5d2826b17e1879862e7c31a4bd9173f102b50c3c5ee9efea7e3383f645b1a619cadc2226b6ea8427c347b4658c1e9a270

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
70KB

MD5
c017bcfa358fbe5472bc88e9e601d064

SHA1
d26143033fc2d594dacb0a1004249a8ac34391b5

SHA256
15daa0913d6079904266e1d05fd991cde9b5e64a608720d4353fc108050afa91

SHA512
318553eb38ce7285f089e01a15dc5f678b9d5f17c45cefa00b3958de9d426cfbe5eac4ad498697fcd021fd3114d507fc4f5030f1108fdc235766e01f8544192f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
41KB

MD5
f5071447b2a40eb141c36b788c3a1922

SHA1
f8794bbc451a868a0f9addf1599bc161cac52804

SHA256
3282aea4cd07ab93cf17407cfe9c92315c86904cbd37e40d8922601c1167da06

SHA512
b9c24dfe72477f935b85ed7f07902b15480cf6bcb4b978513421b1da414fbe0155dfecd6f2e5ecba1ad8f4ce3278db524ffdf5e609ac66d48572208b631dbaaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
32KB

MD5
00e1bac20bbc1ebea406ae099221fc45

SHA1
6433953bb6ec56899e6a2f415f7c0efaf31f0156

SHA256
0539a7150fa3c95d6f9383253439958e7538e64eedb336239436a201cf648483

SHA512
8b6baf54a06af36973d2b5b47363660e3bb8f87ada5f4980534dc79362ea31b9fd3db9531fb4a3bd3ca8e398cbd99dc755c48bf76914d12a0def67b78a55209d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
32KB

MD5
8ceba0c76357e463fee720e481912773

SHA1
8b4667917071f9a59b8ac0f43aad044944c6d187

SHA256
920160cd77b51d38d6e7436d0a3e15d5105711dceafbad856ecc6a0966a50129

SHA512
854d24aefd632661e5d7d2ba6652dbe1b540c02ff7933c5d920cdf04961651cf663e4759ddcaeade08a279b83809ac089ad3ec89f53acf7e179010a647e64679

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
34KB

MD5
f0fae6cca4684f96b1f29fffbb903cda

SHA1
75498a2f748c94474030c6bf5b1e489e68863487

SHA256
11d7864e75664b91d97679cf93d3ac63187b0854b86245f484592631da8ffc81

SHA512
2179748cae8e88740e919de485f33c57d0c2efa62cb7af09f4f1b6b733b28864019c7958747e1f45aedb5ef20c26a9c2a4ea77aaafc8b0fce3c62ef246f3e72c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
35KB

MD5
70c1d43a35b7a48d088d830ea07fcf77

SHA1
025e0e281139c70c5538e09bfa7927141af0cc0b

SHA256
942e5dd201200674506b0df50c1afef021fff6d5bd7bb7f600ded8617dbcb386

SHA512
e40b2ceaa1f672891bff21f7c22a8b473dcf998fdc0a74b3dd1999190ba281c330c871d4bc82f89561e2ad7d97fe3169f33748ad368184bd1b4850941822d921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
32KB

MD5
637b1f43de4b96b9446adcc107c5f688

SHA1
3fad425f0c1cfe8711888cd877e122e5f8d2c15a

SHA256
0ed2dc761ddf650b9aab0c366f43ddea0db81e13bbe603a21f2bfef519387ce9

SHA512
9b48ed55813f9a372f1e1be5fef737b0583e8990b9b0d57a7810eec5f55d5c9cc55739d3dc3a2851009964c34c82f1d0d9b58ec05a212779667a023db8804bf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
40KB

MD5
e8ea6dc81ab52c7d6124e89ebcac926a

SHA1
b7bf79d3d738b06dfe9e567feee25d9b983135bb

SHA256
1ee846986fbf0bfc9f0996f563d748589a32b29af6a6e444312c5a4da27504c1

SHA512
b25a7582b9fb6a146aa927bebc91d4f34b1820017c75dcc3dafa8ace22547579e3aad82788c89c2f373330f71f970500bcdee7c520c1a791f374a4e8dd5e3396

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
16KB

MD5
12e3dac858061d088023b2bd48e2fa96

SHA1
e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5

SHA256
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

SHA512
c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
175KB

MD5
7107c752f3901d95bdc4e9d46ac2b6d8

SHA1
747a0d933dc2ef38a98fa11a44ba661ec6a5eae3

SHA256
c4a5ecaf090da5f8115afcf0d4b723810054ecf3de31acc5ea6d48f9eb2d4111

SHA512
71d4ff3fa6c9a902b299302109d034d4610ac8a31ace170f09a3f66bd0d1259c41361fc29f2205fec6eb49995ffc73563399a6ccc536b8412bf1064485caabd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
159KB

MD5
78450fe21afa3391dc4dc62d5f1e09f2

SHA1
8aed39e81b26f10dd32c5b131eb7493d6d41b06a

SHA256
4903f015531ad7a745aa8c5155780c51adba6e0f671607c3fa1447795f33b794

SHA512
46db3beebdbfc0ae2b4e6d8f015e0f122851cf57662d5f445e2c4cd4f7ca2097690a610247e08f789685411d75b018cc35bc0a679b4dcf9e68c9fa164f347256

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
165KB

MD5
34049e45a502035c1ee78f0b0967588e

SHA1
dd604c54963f4ae0cb4cc1c6890b66822a6d7b82

SHA256
a84c114bbb185448de945b27fca0b6ee207f4801505e3046f35db050f4720eaf

SHA512
07b046af74583dc5ccb2dd1a636042b36dd4ee50aa6e7a3871cc26bec7aee823dcb2ef8bae3f465a374b04ae92b8cfb90f41ad3a76a0d2db1b6ca764d8eb204c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
142KB

MD5
928fb5d28ebafb63d0009b589456b85b

SHA1
26cae5261aa911e1750d577d31e39e0bc8641602

SHA256
c2cd1dc558fcb9520710a22445f1154aa2d49167d5a69e136dd83e3c5cce0e4a

SHA512
1c9795b968d44e7ec50f0c87dcae51f7aed821a829d5b28a07896df2b1b9babba2b46e5dc366fd247e02264ba8f97367f96518eb79ead1cc3c6b1a939bacc224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
43KB

MD5
820f40594a0e8d5f9d58546208aa9060

SHA1
e17ed5116a34c432013a244c979ac9da53829d74

SHA256
f8f708049e1e1609af3959cd21eaf313c8192d3e962887a7a2e1f9b353d3fc80

SHA512
95879b255a90ccdc41c8696bf7aa05796db56528fc4be78f2d13eb2233740ac8cf0f92bdeaa169ebc5c745f3e76ee9fc67d2626160b9e01c5f5a19b8cbea605f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0e926423839426f5_0

Filesize
115KB

MD5
9c40b52ad444064af1dc849bd914f819

SHA1
2367bfd01beb896315f40a0931195c98ae72ddff

SHA256
bcd7b2897f2ea87794bf243a8e211ec44b2c8a78c5850da480366ac11a2ca24b

SHA512
8f0e2945072e35b22a4f8f6a7b1ae096a24a6aed8e35d6afbee888718988e6afd36d107143147ceb6d1e8ccbb6a1aa953ec0a25eb15d31ccd7da62245b80324e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\15833c1149e8baad_0

Filesize
1KB

MD5
537fdb8874bc9cc35d261cc61313e054

SHA1
bb96aaaf8023c05737b8d5b9f6f829ad1d0b728e

SHA256
3544559f3e9b0920b47cdd0fdb10281f6486a3619099c22036cb4876af61e847

SHA512
c79f5ac13ae055616e62de6412926318c05f285eab88f6fdddb73d11d2f7f14fb3feb4a4c88235caf8485c8f18d0829ac5262494b53f270d9b6aa51841c2aaff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2e1771ed6f6ae203_0

Filesize
248B

MD5
26250a8e896203426b2d71ad088cc8db

SHA1
20788d3b4a39631864defb8e9587254b588f6268

SHA256
5a5ff0869131c5072750af2cb05f74ca782ae563b811b6fc27a57dc4abcc92be

SHA512
17e090ded91f4977990f8033813b16465960e584c49453b773fbc5383fdf1f98046de4b474a14f94c369f211f39698d458a3117162012d5f72772bcd11e98cfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4204f9d2f1eff842_0

Filesize
180KB

MD5
c63459e969efc37f441df8bda0e17d62

SHA1
2ceea8de6169e66bb17ce1ec990bc227f64a193b

SHA256
f098bebd49b8542a04c8b3a8e008646e7f876a416fe369c1305095b02ba15fd9

SHA512
159e3db741ffa932577bfb3240a47135ae2cdc9ab66ba7c397c387b880111ca435ea8d96a855168fe37c3cfeaa773d5836a92a79508da3e644714e597b7c38a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5727382f9067765e_0

Filesize
221B

MD5
7f250349a5f51895c2c886f7ca2a11d8

SHA1
ca086da92bc21701988cf04ad43693319e9b7baa

SHA256
61579e28b415b64de5a3dc0a05962fdfad6b8de32d9254e39904f096e9eb5afb

SHA512
491d071ec6556a25ad5a478b13b552dfd2e9a1c7cf0c62fe8ad521a3c0d8b656049048427cf4c51990b67acb1b7efee9ba16801500bd6bd7b2ce98f821539781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\610588584ce7fcc3_0

Filesize
67KB

MD5
44b1474574dcf52567d63ccc051855b3

SHA1
a84a2dc583baaaf04864c5bfc9536d73c030b488

SHA256
addcd2ccbcc0875e254f7054aade90576da968b43839211bffa4f26860570b11

SHA512
8413d3a3078d579f9a2da2b5beff520631bb574c223d1310ac963c521c7ca5945fb027b56bbc60f8486eb8a8c523cfa38292ef1d01367e071fe5abb07b981185

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7efbd352fc1df2d7_0

Filesize
10KB

MD5
202f14f5244bc625b34cd4a620a51424

SHA1
565e1d86e794cb28015c6ff13f440694686d55f3

SHA256
5080a9288f3bdf4c4e6a5044e01848e0bc89cf2697a9bec8e3f4659e05caa6e3

SHA512
23d3f6fd0a6980b0747c45b6abb532c3c7302d246345ef47c326e27305e6f0d158bdef5b14d89f082955dbf6e8d2a447cc54f883cbce802a49c82d91b704da33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9b3f678b4cb26d4d_0

Filesize
334B

MD5
c55b62926fcfb972ab3d5be13cb16248

SHA1
638c6239a2e766a76f162808415846a78c4cad3e

SHA256
a95d12ad13071fd00eb6c07ac4ee7e58c1ae4788c0c240d07368fd814740f34c

SHA512
cad39f62676b716491ec2bb258d343d7da422d3cffd659fcf71581371c8d452a1133b3e970f28b5f631248f9503a3d37326f4f7e3e824fa900ef8a0e0df69301

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c66c19ee8c0865bc_0

Filesize
153KB

MD5
0989d3ca380251b186f387c16eb25e7e

SHA1
471c60d3251a8b27410860e8d2a255b373086fa5

SHA256
2c463ab9c8af3c2a264299ef0401ec76b3c7189058b7945268d321f2054d602b

SHA512
89638390b4b1131243593b479ecd5a462cdd300feac538a6d692735fc3f744d75e7db9556b5e2575c2093a545822c6e40ff310d089e7812dbd0d93ba5279ecdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ec4c766f49ca4bfd_0

Filesize
311B

MD5
e4b7f6e52c56f7b96efc6a3daa174491

SHA1
1488d51cc96280fcd9a9e8e6b21ea19c8b204ae9

SHA256
9d631d2f6ae7f43bca27d4ee75954b706ce358cf8bf1c7d0ff95ec64965fa143

SHA512
e2427cf40c29e513c2e02a954dda151006ff8032ded418456f79d767ae1f443c86ec4a37e5f517f2f24d5678bd2b25cb5f2a2ceedd1c6b55b45e83b00e76eea9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\eedcebb77767f198_0

Filesize
297B

MD5
543aa1042fc22d6f275ea1cb2319c4f8

SHA1
96c5a459e3316b0ca959e8c6c569ddc2d26b120d

SHA256
77cf1367ab2a7f7c105e4bc45b408b06321cb0e06f561ef8675444e7b6482232

SHA512
c4e90be22996a15ee0906f2cdf54a506d8e505bf74ac0037e4bfcefdb86dee14e1cfbf4558a8a4ad0746eca569c5e259e264003e844c47c43c28c0499e8d7a0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
349078435cdd8467fa339939869e1838

SHA1
8a44460dc0a32a7296112bad75a040320c7a3dd4

SHA256
4b266108d3dd22ffc1d1754b59dfdeabd4b76923e5d8ddac31bab37130803ef2

SHA512
ed812e1184f8821f3cb881f31fa556001515ed77bac002cd8bad4c39195e83cf9064d1377dcb00fc6d659a28253f888878ffdb5d8b0edf47cf3a3fa85d3eb741

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
33fc8d90e1237520bffc4bcd0093c166

SHA1
e1766b1bb66973b58ba7dfe3f08bc056e69f3a26

SHA256
51e370730089a6d7ba6def5f1114173e39ad5c629e0c421e5afee0d412ddc338

SHA512
6b01abad75fdea7335fac6303072d03bab680652f8ac8a172f09315ca6b50fc47ca4183951c351efaca836d82c19528a2ce9a144a46fac2cffb1d9e35949aa28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
59b2679d340ea3201cb3d9234f9e436c

SHA1
6842f53ab0e1dc0b75afac7017c51f591c1f3d19

SHA256
3f8198acf93e86865c8b0f8e9d20d4b24d0d0a342008756a704ec678720d211f

SHA512
60454203f7cddd3953caa5a78416d6c96c2d9f0637858a0c1da64f41b01f40c290244571640bda476531d06ecf76c5dd70f8b0f10a9b8d066e5284c6164ae382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
f056358c3df60b630a7d101377bf0fd7

SHA1
be0453e2841fff8d8964525bb01a86ea15263f2a

SHA256
e5753de9377f2fa88af81de1a36a8ad5d9daf39a5b9fb57ee22e8b85e06aa544

SHA512
09ca223e868d32ae55136fa71483006242e8fbb40b962da1a9a73984a5bad010f75ecd283b74d071928748da6c1ab72f65b3723f8130f3efcc8a68777b42c413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b4ea4e9d4e41ec4a33fc56b8a8677c7f

SHA1
82b2beaafac2eea2c88b6656dadc652afa1a396f

SHA256
9b1192bcc4d966d7b79e5489284575d8272d53a2a111eaec00fdcd0044bd6c16

SHA512
09983dddc667671f4011c67e538a6dc7c9541bf4e33e7c7efd85b7a34c523be811e8617ab9cbcccd3bb8c1263b3ffd4ee75dd8dc169ef49f48c7f47a0bb9790e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d74303503343516eb2e85ffa26d78fa8

SHA1
672fb93af1b17f4955f4855022b3c09c353c58a6

SHA256
d42a50a1ea7c3940d3e881619fefcccfa38ef433d8d95cebbed185ed79b4ef97

SHA512
5164e2daa5a65bbbd3d540a91779b09e2ba818a02b1f48abca5bc150734da3a78ab797ed2d87f2f52052b1b5fdd8f32ce6b3d538077e183e9bdd57cab088eaac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
485B

MD5
23ad5553d1dec6f9ca72fafc6816d650

SHA1
de1bf0887da0605754e696f68626d794f3849275

SHA256
e7ad78e2bfc11196139349bf016187fd89835ad3ff6d0b6461f2249e28a7c292

SHA512
91a1a229643c6f74f02cc968ab13d92dfdeee76ce402a0e70812ea7b98308428794b833da854dd07e533fa5018e4439c4ea6bea6aab16a085d740adf49a85e1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
485B

MD5
b65053c0903721d51bc9881600e34199

SHA1
84bf4317a532de100b607ab3db2f2317447a6fbe

SHA256
6c1facb747c31a372f6b17a90b98722898a99271e1cc562d09b973cb732f901d

SHA512
c3b8f83f68fa00055e8cb13779cdb112f69b2af7b48ef4d1a56286dda07b71b80b0c12ffa5fc32ed453e00a707c3d0363e64d78ee724d671c6b2b97962ded533

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b5fd9b56dad58abd9519814b4b68a75f

SHA1
6219269d8bdc3c0225f2172f300cd0a5819ef88a

SHA256
e75f9f2171f86ca5a7a8fbf480a2ea1b8922917300a9343abce8fe1bc60cc319

SHA512
9294f68c7fc28ab71bab9bff9b1d0d3af8d19ad56d73d1d7bec10deb2e6f8c2818cd21ce52da282b6ddcb15250fb870408da989166298157d4eaaf65861686a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f9684abbf046c9fd8008152820c1138f

SHA1
7a77117e51be1165d64dbe156f51c8b41fd14bef

SHA256
83edc75cb7cba5607e3b31e6625a37a04f93f3c60fc07bc07848aed622470110

SHA512
376a6bcc32f0f76f93e141c87ab1d9236a3709e8460dd5086298f85490f6c73d8e948d8f87431d35e94ed3c9011f19acf921c4718a39f00dba6965c55a11cc8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
720b6ec50966be631fbee72b1c02b382

SHA1
5e5ea72b6c33f426f05cab59f9ea12a193fa800b

SHA256
33fff8d5deda7acb8819c807ded3ad9238a0ab21269fe565fe320d339203ba3d

SHA512
1210f840e66a98050d1e63bb3b0556c1f120946dd352047797796129379325b1e0b33728cf1c127675f2d93826419cd391ba12111c5714756a0f219e8d4e9f0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5c570a8c862b994d251b27c64b00c83f

SHA1
55a96e18d7d10e643b45aaff651771da280b70c5

SHA256
18800b8d86c7fb0a892ff9f7fd61e95442e105314ad4a68f88cf40f1394cdb86

SHA512
fdbb6ebfdad1d34428bbf521c08cc05a85900414f2678ce0fb8604fcb43942f90e725c0fcc829cc7f563486e5e2fce971c1330ba9ab5d4a03d48c0ac0c22c0b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
365a0a11c646b454dd798e66b1f5c43a

SHA1
73ca3483ebc420fff4767a24c91352ea6ee29ab4

SHA256
1cbbc36f2316dbd269870dfdcf6d2f16e4b17fc78a3425dc16d8e131db1e7c37

SHA512
6302bbb16a09bcdf15054485472008d1f05b9898f0f9d68d556315cd0f27e814073138f0956519e1d98a84a2f98cbe1f870a22ebf37c7d793eb98a79410fd366

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f4f45da82c03c42d62ea9e26c43a3c58

SHA1
1391ed85c9f1164b200e83ed31565d4f70068d61

SHA256
727410a0442e507980e0ba18415b4fd9310b105bb5edd7fb5d337f447f7945ee

SHA512
738713a0078f4cae933d14931187facee93590184aa159bc2e2a10b36cef5787045d7e7354069a953dd30dc3b77b0520fc6d2e20156af68344156521f084cd3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
99fb94b67c6808bbf60caff5845313d4

SHA1
7dc31e5fb0df8aa8de46f5a399946066502780f7

SHA256
c3ff33c7b298d3b281f0b2660a76cf6ef5ce51d9c8c43defb80741596f15d136

SHA512
3afc5d64c71fd19b3c4c5d7687ab5e940999ef07ca363d20a22c9b67ba14e0883302b6e93b6fc12cffda9b8b302d1a6c4026ea4110e4c48d6b614f3980ecb9f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
74f1a1590485dd0d9ab7f5c48aa8e3e3

SHA1
4e803c62ab5407fe54b5b9586ed37699ca362e9d

SHA256
a883d8dd6568908d3b127e85da01a20ab42bbca56801537807003f19616729de

SHA512
1ecb2186cbf10f7d6298fe2246f87f84fde882b52e44a107556d5d40f9b5b8308355968bb755b77252ae534a62aaac6fd1b4b63571c8e0e524a5f1ff6a69033f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fdeb6608ad82e13a311b873cd6cb92e3

SHA1
05dad608ac7b7e879ac691a1529917c64aaad6ec

SHA256
b20ed2dad8d7beeae30feadfdcb608aa67676ee89b75d5243eb8fab223644c81

SHA512
00a2995c33187163415bc8feba0f0274c19a203dc79af654e4f02387d546ae5765aea53fe961f76423c0d2d4e2de28b128aae7b21d8b10b341d5cfb256b3d0c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
02ac38730b9f0a6296e357c64f46ffd6

SHA1
ad3883b936a989938d8af892c3887004895e62d4

SHA256
59e4f314f720deb39213b805d481b0f193d5dbb4a2be93020901fd2f1323bd55

SHA512
7482d19b1df8160a21735894a9de332f49a8d6486c39978d016701ac84b6557b7f5d233c255fc49ff626e1c16d5bdd538aacf7e2be02f63bf5bb28a331d4364f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8ffac33e782c0a2c23dbae47010851cd

SHA1
3334f36422ca321f83d022a7820e46784c80fe4b

SHA256
2b6c4ffb0012c87d63f4f9d2d1cbd34f543d2b894d978617bc4f263ad1c4807c

SHA512
a256875ef618febaec2416b617964e2b68e6dae99cfc53a49b3d08047d277132953b046d19708d07028c87450e6da4d039d7626b6c8597c907d2090439e3733b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
531fc2045b98598a6e35aa3273e8cc38

SHA1
7ae2b83952f0406ddca8efc8ddcda15ab85a5aa1

SHA256
958de5171cd1fa5e508b9d594df3c5f008041e550ec3f71ccca05e6d5c3ec27e

SHA512
54f53aa12d5f05cc5eca9f1f09d0a5ece90c3433d19ed3a510e4d384621e2309886deeedf77ae96ab1158ae63c948eab595674dd86bdeff876c8fe8c30107784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
44c652f184885b8d6c5ad7e2d5b500c9

SHA1
2da80a874bfcd85ccd636bbb2db654899d1788a6

SHA256
6518a7e103409a72597e4bd54cc0e7d3d93e049686a241e7467eb761949582fa

SHA512
6ae840db9cc98b9f262f1e4c3cb8d714eca8b449eb39756415dcc022e4bf388756dc8dac1072cec3da9c5998ea25589130647b38e1c986c187be9dad25897df7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
33cfde5fd6a38235fbf55fabf481a659

SHA1
0bfdd58121f8dc32514aebff35e1cd29db5f4a9f

SHA256
fca5252968bb2de36a21dbffa1e14c7217d80fcd7c098526d2afbe773b499565

SHA512
e82db17963f8324c97de16da2f79011d7c673914f1815535641a3620552526d99c4344bdd12e5994395ce71312097f98e60622667910676582bc6a9dc41a2482

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e058693b34dc3812389f5acb06cbf571

SHA1
1356d2a4edbfbdd8ec23247576a3978d678f0b4f

SHA256
5136aee7deb4ff2a064d2d4d41365ecf85599be2bd3be86b99a3c9729ddcad3a

SHA512
760cef8a400e40f978d7e3f8b661cc575cd64fd8aace420c00db00f88b1bdbe238e3989540286cbaa965f81961cc6c4a72de580a52d5d13d9e0359daa213a225

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bfa79304f52356ac3c684e7d1a08dcdf

SHA1
dab3db85445cdf0ee81fe31a115e0ec1356dd92a

SHA256
9e475eb321bba4b5887886cf49611249c68f9a6a29032c3404cfc4a9b2910c91

SHA512
cb519877f583da5125a24ac2423659cabd62656c9d9e02d86a61ad2b7ea2de5d382296c329012fe87b72b37470a97eda8f0ae4637bd4f0100c04c2c384d35eda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d5d98b9a38251b3232f4f7c887ca4035

SHA1
5b6cf11a31f15564a1e1ef947fa701f57ad183e9

SHA256
c60a1a88d234f0f613aaada26a9790dab5de872edf438ef2950b7378ae31f588

SHA512
6f5ea4476fdd0a3829161985f9aa2484261c5ba82eb841752b4a4700580658750624a1ef0b84034794c04b15a9b0250164ecefcb8d0809a454230478942ea772

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4414b8acd49045a15baac7080251696c

SHA1
547ae83502e4b4c4db97471d6cfbcd656a8a6dd3

SHA256
3023ca4b5dbfef34cec21cfc6521648ba63b2a17d161dc4d9e355b37068ab15b

SHA512
8c677063c7e3fa0ca73f6887d82543e46de872b6d8d35c7959d054bb8946ad85a4ea8419549caae3bd3e08fec9b5a365d45c756e63bb09263aaf7772fef9e43e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c61a2fd702fdf5964cd09e62be5cea9c

SHA1
9b2394182a524ef049284c378ba21c8b044dfb2a

SHA256
02413ae5bd524b2cbe200623ede166c7318779a2aa1794d286ff891d8d4c2403

SHA512
57ac46aa6926e7c4ac8679e043af92ad695553451755efa8d592a8791864eafab4502143cfc4b92fb8d5fdb6fc4c4d3f742527f49051c1cd4b779cb36f9a8150

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d53ac35ab3976e67caeed75c4d44ffc1

SHA1
c139ab66d75dc06f98ada34b5baf4d5693266176

SHA256
647867c7236bcb78b7d585b476d82a101a077fac43c78dc59e612253fbf69437

SHA512
391355c71734ded913239a6db10a3202087e756bccc8e29411108f21b3f2460d9a9c606619aadd785285be70eddcf61ef9519441cd387cd3823c1399a6967cc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b64049e20bd7e3b09d3a2098bc1bdca0

SHA1
b019bc55fd63f6ee787c891eb02e65b10062e0b6

SHA256
6eedefa0f8ad1d0d41b9c8591f68884bfa98e87830263a391dd3668d13f9c43a

SHA512
de863dbc0aea503715a099a62a04eda49b2f623361ec717be0909b9095bf94b3e618058a5bd151c76f363d7f9071a15555b373b71649b395559ae2a33fdfeebf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0d555ef19adf71c428dc6aad1eac3247

SHA1
4b7dc9a95c169e0df7a7e9615dbefe68351e4610

SHA256
c84d94a2022a44bce22527c8952f5e82fd94871b2a0970f1b1d362309fabc85d

SHA512
0721a3fc67bf5f31228f51d831b27f8b283d6a1b0ad2d60e615e98983c95489ca4bca8318c6c448179117f85d83dffa3bb5d46a75aa8246c7bd719c618e5ab8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5b3b6e7b6de0922b5dbac6d879e13d87

SHA1
d17cca16f481e6d56b76de4bcbb78e32120b3344

SHA256
822b6d8f7781d0966a698cf303751476178774d8fec690fe871191675bbac2b8

SHA512
841b3595fe33d7cdbcb6a02b9a654e10c4f7d50a742f36e327b82dd4473f715385a020b80478026f9b13c0f2e61fc23187eea365b121c9dcb1b0a326c51923d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d8f5042653c18b1515f1c7086823c087

SHA1
5bacedd6733482d9dd082f6f2d7fc6fb907cbb45

SHA256
a50492acc709c9963200c23fe87663d0ebea4bb99f9482e01041fa581aa4da75

SHA512
e761258b61bf62f19b83fc954f1849216e3dc67510c490584c328f6161fdd55d19e4ed8295344636a2307ac66e3017d893d9c4eedcacf5f011fa106e88c7b753

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
4146abaa8968057ec81e528187d0dc8d

SHA1
5059be8632d2c288139a5683ac95282f4b0e4cb2

SHA256
e16519deac272c0d8ebbcee80d4284735a08f521befdfed2188c9952b97c7377

SHA512
cb870280c68a9ac7b6652f60e1bb0322c2a017761558b436f6cc580b91baff567bc01dcdf08b5bc3fc34dffa8dfd55d7ef38a27126e5e26a00d5f04fea63b914

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
126891d522604fe34f88f8dbbdbcc67b

SHA1
3e72bf7e1c077b1bc08fd1e97800122c1b35a2a0

SHA256
d076e6eeeae267990d9fe07d8b23fffbb1c23657a2a4c5d0bea860d5102dc239

SHA512
26b9171ce411a48967db9cdafbe2022452c0bf2042cd93a4836b2c13b8effd58ad292ce4602f82aa4080738286256d1145fdc1bb1e8b6f0e38874c3ea1c8a636

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
3cca63d63d903fdf69b9c3249655302a

SHA1
824524f572199892695b64072ed1e7b1ec8f1626

SHA256
cc317beda0f618fffbd3c14a3f1f10a4fa3effc9c8de6ec4cf157371734b46ad

SHA512
2aff3e10392aa08cee17625209c0ef091be613c6bf4445e123e2acfd754ab789cf5b7eb672cb2d5bc34d956b6c6f5676bbd4995617edef88a62b7b9f828d6d05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8f57123eb9c04e61da012675f2b8ebb0

SHA1
d3a385d8c5a4dc1c47d8e365f71866f4e9b8dfde

SHA256
9a8ee4c0bef357528343ebfc5929044ef005fdc05c03e3f1603bbcbfff208716

SHA512
64457b827a318ed10a153999021b74d676581db6a440b3d3066c116e894580eea8efbeb5d04b66984ac0ff32fdc683a2048f7c2b5d09a870f76d7058be1f3b8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
4bf815bf2b935f32d1d7a2e0a31d6ab3

SHA1
5a597a9aba041e7d78a4ddb3840180bd92e0b290

SHA256
d03f24548a72f4e35f2db7356240ff184aa0e19d550df890ba299f2a53f4be62

SHA512
53bf8a3dc757e6278804780f46000494c91b50a49962a847c4c1183218ff443a5a4b52515dee3469b440458a17a4306767c2139044e286a2ec5c7640f8a8849d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6a49bfe4f46301d142ebef64f62ab288

SHA1
af141c7e2e4fdd5a3a50a897510b39c0e95a2946

SHA256
6d49cce2648062e7e285acc7d1f639b14d187496c441f1bbe271d1e1ddf51bb8

SHA512
6b6dc7a0abefa6325a1ac40bdc2f34c958ecf3a4bf1ff73f76c9ddabf0698370a96a6c79d20f8f5dc9a626b7b90c0c963bea034fb74cc6101fe30ca04e1257bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
f66eb483df7ecd61f73f2cb838844310

SHA1
5c3f8325598c4c754397d786f7436b5b8627f7da

SHA256
493b648818cb6526d982b40ca9c7d5632c8be26c6e4b7fdf58d4b26694833549

SHA512
3d9b7d78765ad46b413980f08c49925bf9259fc7947b5db6c1d63061ada12f9427cb720f0092754c747d89e108263eaa2c3bd6d88f6f60ff920e476907b73630

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
334bd62cd6dc8fda41f8ec3b2bb48284

SHA1
4de25cb275ca1edc8fd10cfb4e3f577a5fda15a5

SHA256
27624a1cdb54582d94ed464cee6dfbb2b5249c2ef4cb188fdd6571562849df98

SHA512
5e8816e53e6d48bd577af51217990c40301f9fe708535a61dec44e4160f776f0a5ceb4bf0fcbb1b5a81d7822b9fd7c02d0acf5f4ba4ff968f7819a4154e8b7ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
79ad2231b16e0efaf7832431d4a23a19

SHA1
00c0d4fb020044baa38781101d85f8bc80566e62

SHA256
2f192923144aeab7b68029559b5f34fbf1232e1873d7de8e37f1b70f9730dde8

SHA512
7bf2b57396d9155b38f192a18c6d9eebcabfecf399865b881f88e13d426f61bf11990859652c6a7c0a096a9ffb259417c490d14a2b17e72609d3f3a0cc8ff925

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9e9bf51999a4349eb49f5ad41ad87082

SHA1
8cb27be2c72d296b748ffe4dcdfdff8c2a534250

SHA256
3199ec38698afd348b51496646aa6eebe6d642ab2ac1636dcc37d03d97e082a4

SHA512
b8db3dd5f92d241b7556e22b4c6eca096ac314fa2e2a92111f6e79e01a86ed945de5e17468f13b8369dade81f903644c527d8f8417d85aa6c20fbc7b4b2ac00e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
95b83d80ce35db322511c4c3a0503334

SHA1
a48bba318dff6c680a40c18f29c320a88df17733

SHA256
d4966efe0dfa0a24868f279613d380a5eeb2131f1efcf5a15ff97043384605db

SHA512
62d8e77b4c897053f3bb53eeadc6d956a5a9bda42844de4d0b9ce47c1a04d14e71dafee97db6d7480fb06184c5d02cfc00e35dc77166175a5586e957d0dbf8fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
62afc56873a68fdb5cc2d892af73ea33

SHA1
05ac793646d82487c15d1ba03ce082c6f916986f

SHA256
f1ae1dbe22ae0659e312704b666bb1c20d666e5ca0017e7b72ad916e5a571f24

SHA512
5b5c9faacbaff0fcac8f143f3718d627735235c372c339325d5f0a2a8452e1f8235b54b9cc8b1a2949bc16b582790d226b2c67fb469821d67394b639fdcbc9fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
bf089a12b27b00cb86908ca3ee00b1c5

SHA1
291ed80eef14533c0357865ac17c294f93a4746b

SHA256
45f34489f8eb5961a1d3d02a448dd6319772ad4c2ee91be3d19f875b67f40083

SHA512
fa480c1690abd9ddcf0ed7d477df3abb13b9ccf842b61bd733df6a19fbceeed4296c4344c9d0a5bd6827d49d6bf3cf3535dddb9d5bff5fbd11d23fdc3e0a795d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a1fa97a2852c642d850dd2c67ec6dbdb

SHA1
7f6c874e03107f96181fa0cffa1e4467244f79da

SHA256
f4c48ad3cb4a773ee9f960f67714a192a68ffc494056fcafa5b5186cce2ec141

SHA512
ba586a81b9c7c3853ed7f63503547c721f581c0002ae10adf123e40fde57da4fe9a38f8e6e9e0e78648613cac5628ec5d5a6fe21be30f1950dbb1af32314f361

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b4ab078dccfd8401a03f41e3d17ae34c

SHA1
616ba94017c1ea8c294cb0a55ae0d4dab0af8a63

SHA256
d7682635d4a9066b4d21226e11344694ecc06f2785a49a8257cf85d33a20b782

SHA512
3da5283c05472a44094472b8e24976f7e5e4e4a5bc94be29857b975c744c0d883a40001f23de998b55ff743f42d7b730bf73f841faac782cfb7c1351ccb0e2de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
247002869ff1d0bc7072fe062112decd

SHA1
5d1f41fd9da20b0b23bb30910ca61b356539cd19

SHA256
c4f0bf0192f082fd3340da9056c92381a2a14bbb0a4c83c9471d77734825d0e3

SHA512
e5cf1f2866f2bb1482ea1178a0efa5a4ee8af9f69256bb40f3d8f1bc8be0088f9ff0b39015767132ed3e6470f1b2075b8e8b0d4f8072ef0160e9a0ad731abfba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578e26.TMP

Filesize
371B

MD5
5ec576e6a96dc0625c60811d2374fed9

SHA1
d91b0b1db5227816602014874ee2eff65341203d

SHA256
3b4a4c5db9b6b88f2eb5a0d89d9b13b5058d58dfd27c4c96d3c68cbb2f4e64ef

SHA512
369cc89729faa726c7e4bb7dc5e2bc0705263a0e27e5efca658ad244d49e280d50df0a722b310db8e3efe77a37b2cf2799ea604b6005ef840efbea795f057792

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cc71734a-d9bb-4935-a116-f28eb1e951b4.tmp

Filesize
2KB

MD5
c5aa80ecb6970e4cedd340b183ac2e64

SHA1
b9cd39060f2d5005cb74c33cfda18f0e1004ea80

SHA256
a809ee78f5870bc5a6f52a630fae1ef8ba6c26458973ea943c84fc48564fe589

SHA512
b0f829f438fbf51a62052755529f0a5420445f38e9cd381242b4657c78cbcf82769081180c0032e37a99167531df4cd01c15854bc3ac2054454b28eadce1192f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
439a97a8b347d495353fe6bec0b5a34c

SHA1
28a69f36d03530e21a3aba005c09ea26081773e8

SHA256
6d042fcf67b4ab26cb7bbd7a881996aa243516281a6aa95a64224181e0e4f20c

SHA512
adbc82e706457367237fe2ea0e1d9ef2470c5a20764c5987cff4b4a285e039fbf094069dbf27b1a316ed4bed17e936728308c36f8985900e48d09ba893f604a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
439a97a8b347d495353fe6bec0b5a34c

SHA1
28a69f36d03530e21a3aba005c09ea26081773e8

SHA256
6d042fcf67b4ab26cb7bbd7a881996aa243516281a6aa95a64224181e0e4f20c

SHA512
adbc82e706457367237fe2ea0e1d9ef2470c5a20764c5987cff4b4a285e039fbf094069dbf27b1a316ed4bed17e936728308c36f8985900e48d09ba893f604a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
adb0a8725cfec2e8b7dd3ae5beb5e85e

SHA1
0fd699f5c5e24dc92c76a75a85308a0133b321f8

SHA256
b90c092db80ed523d66a8ccd3b76f99fa508c6eade11508a8d8f76225e655b93

SHA512
08721ab3f7cd08197697b8d844f2fa7157196ccba5906b9e96ca6eb7789c9bcc71d540548144c1bc3087bf0f71d805346ab91f815f2502be5df65ee320ec094e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
adb0a8725cfec2e8b7dd3ae5beb5e85e

SHA1
0fd699f5c5e24dc92c76a75a85308a0133b321f8

SHA256
b90c092db80ed523d66a8ccd3b76f99fa508c6eade11508a8d8f76225e655b93

SHA512
08721ab3f7cd08197697b8d844f2fa7157196ccba5906b9e96ca6eb7789c9bcc71d540548144c1bc3087bf0f71d805346ab91f815f2502be5df65ee320ec094e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
2e858ada3521d7b68446d30e3a220d73

SHA1
d4efdcda1d31eeb613c7ae340f85d9d773afb2ae

SHA256
50e4dc81250c87ffd3e6fe7965a14f1adc4b89393a8692390f8603450d081fe8

SHA512
c0f2f5e01e07ea5733960e31a7faf4a59fdc114d1dd55167c49c593268ecfb2c7b82385496e92cf4e12b6ce41c16872a7351d3348e5581bafc32ea7a2cfd9e54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
439a97a8b347d495353fe6bec0b5a34c

SHA1
28a69f36d03530e21a3aba005c09ea26081773e8

SHA256
6d042fcf67b4ab26cb7bbd7a881996aa243516281a6aa95a64224181e0e4f20c

SHA512
adbc82e706457367237fe2ea0e1d9ef2470c5a20764c5987cff4b4a285e039fbf094069dbf27b1a316ed4bed17e936728308c36f8985900e48d09ba893f604a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
adb0a8725cfec2e8b7dd3ae5beb5e85e

SHA1
0fd699f5c5e24dc92c76a75a85308a0133b321f8

SHA256
b90c092db80ed523d66a8ccd3b76f99fa508c6eade11508a8d8f76225e655b93

SHA512
08721ab3f7cd08197697b8d844f2fa7157196ccba5906b9e96ca6eb7789c9bcc71d540548144c1bc3087bf0f71d805346ab91f815f2502be5df65ee320ec094e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
ad350806761aebd6dab7262c27cf9396

SHA1
7f1afd33a92d2e63c2d7acdaeb6172440de79432

SHA256
b590835c47f9e01538923759392921617bba2266758fdddf1c3bfffe3824a15b

SHA512
be08723abf99dc5a46338c2954de9dea7f686a48d339b90d6a76d5979947c98f025adaf2bd825e315bc6f261adf2dd49abc2cfcc15e5c91eb3705cd65f5b3cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
3bea03019f837cc834711b1fad5e419e

SHA1
c386f8370319f627fcf75bd5321b805b4bac2d90

SHA256
31f0060127d14ac8e452f02e8cfe79d51e7e702789ff169139258f564655151a

SHA512
e282fd17ab7c620c1ac9db87a8adeeee676132df04cd67027799ad7be59335d45548a0ea871776be3ff2fb98debbdfb304d67f5d217cb543487fe2ae69be923b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
11e6ecc1f50aff5be7a6ffb366c3e215

SHA1
a16098077e52ca00f047924ab52337209368f03f

SHA256
6dca24d1b45552bb42c539d2943a71dd7b86dc415e4c59345ebbcaa91ed0bbfb

SHA512
8783b0e8dbde7f6abc94c74dff3f018a1242857fee28bede8f4e7aca9ff73a8641291a73127c61e258b93de5b466e5ae27fce72119c7e8129ea16ea325c89439

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
6edefb059d27c197eaa7ce38dce01f07

SHA1
b1ec3d9aca30299f1986f96569925e324adc652e

SHA256
ffeb1dfb989e67eb1cb0924f9655b308c1220f662d911effd20b5edce118acaa

SHA512
9a7071147d1dd459d227c9b7de8965d49ac1dae5385a10a50aa1d6b0ad583d33acbc44da8e5ce85e185abd6df95e51d9841f2df51a0379b9a047d3ba0536ed44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
052d72d2a43f51c355c12839f5248665

SHA1
23b946472d330c390c97c992291081c5e172e43c

SHA256
cf472b8ce0d758e78d939f99113847da93ead7160805d4706d4c3010563c5415

SHA512
ada7cef291e296f7307423f468bef48b12d1c17d6ebb521bdca235bb9023b67022f0bce1921fa9ced9a2380e3594f38407a07f115f10898de361b7cf288b0be1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
85339b898269bb1b2046ce5ddfb7c9f6

SHA1
897f1dd7b3c46f57176244ee1b36a6487be55451

SHA256
de0da91e796e738c99b92a30c1028a2cdb0058402a539e2009a384e1ef8b7996

SHA512
65a1d14ae4854115b1d16c452c7ddffe532899161b4335e41b121daa86f181f3c7352b5ad3ad702fa9c1b5d5a49e4fe0309cc0d2da519ad58069b5432e07e950

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fb9c60ed-8efe-45b7-aba1-3011c43970ca.tmp

Filesize
2KB

MD5
2e858ada3521d7b68446d30e3a220d73

SHA1
d4efdcda1d31eeb613c7ae340f85d9d773afb2ae

SHA256
50e4dc81250c87ffd3e6fe7965a14f1adc4b89393a8692390f8603450d081fe8

SHA512
c0f2f5e01e07ea5733960e31a7faf4a59fdc114d1dd55167c49c593268ecfb2c7b82385496e92cf4e12b6ce41c16872a7351d3348e5581bafc32ea7a2cfd9e54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml

Filesize
327KB

MD5
9c86a2952e4e93ef846462e612e360a4

SHA1
2053a18441136f24ecee467dc5dae946e73d024c

SHA256
5d9cd3a2221eef8dfb1f77a043d55f84d597e6dbb27bd9cec89ef97fd4eab823

SHA512
f4d1ade5ac962003ebeb17c1384133911b4ef7ca406b79f4fe0f4357ea36bedccfa451e835c2e8375723e5a80cfffa145296d1de9e1891810967dfce54d7d8af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\TenantInfo.xml

Filesize
76B

MD5
0f8eb2423d2bf6cb5b8bdb44cb170ca3

SHA1
242755226012b4449a49b45491c0b1538ebf6410

SHA256
385347c0cbacdd3c61d2635fbd390e0095a008fd75eeb23af2f14f975c083944

SHA512
a9f23a42340b83a2f59df930d7563e8abd669b9f0955562cd3c2872e2e081f26d6d8b26357972b6d0423af05b2392bddbb46da769788e77fd169b3264ff53886

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db-wal

Filesize
1.1MB

MD5
5c5c431066e82f1da8804d05e95d2f7a

SHA1
599e77214bb905c5536616c95373ca9767a14d31

SHA256
36dbc0547af80b7b50243843b240bf622df47f68ec02909267d5e5700bc6f7f9

SHA512
845132c99d8492bbf92035e34b85f8edd238fa62c79e83197271c879eb43cc3f8375f7dcee6b3a8d11973aafb7c7ba05766159d78d78b14796520e05cdc83036

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db-wal

Filesize
8KB

MD5
5d9b05e556957bc147686e4b2a2d81c5

SHA1
914108aa2535eb29797c18a539d50d697e9ad2a7

SHA256
05098fdbfcf629c15effb570f199c3b641624b3a94ba3be97f556b02ddd47f62

SHA512
e28b1c4c3d9332314f3eb4bf26dc13cbe42ed743cd6ee58457181666983da661c6e09f43ea6c13c1febe30606873eed6be7197ad27a0ba760097a0ec9616a755

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db-wal

Filesize
12KB

MD5
6663fdf96e6b293a94010d14451c0e81

SHA1
33dfdacf85aafeecaf76a1f6333bad6815f1bf5d

SHA256
10170d9f8684343ffb7eb8b3119e5be8f8476357b0039c16946153da1e5b8d88

SHA512
9ce9c52db48f48a55b7e03c5a96776ab24a0374ae6e538a39e439d23b25e52743a054a5e9e49ddff1cdbe3776b951880e53233e5dc01466eb0872bee93db6dab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Personal\SyncEngine-2023-2-25.1230.7752.1.aodl

Filesize
3KB

MD5
e195ef5d29b47ea7d1c5d048e210a9a9

SHA1
8943c55fa572728838e7a3d5ef9d7e14abe70708

SHA256
d3a87c6cdf91228bbd66a2cd59854dd7900c29eda72771b4ef3f7cee90c7e70a

SHA512
490979991de8e038356df2c37fc1e45f9dc393e57e3c89274e86be54de583734c1835dee98d251cbc56a90953d8f4a8f330cb316cd201c156c78ce505246a776

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\logUploaderSettings_temp.ini

Filesize
38B

MD5
cc04d6015cd4395c9b980b280254156e

SHA1
87b176f1330dc08d4ffabe3f7e77da4121c8e749

SHA256
884d272d16605590e511ae50c88842a8ce203a864f56061a3c554f8f8265866e

SHA512
d3cb7853b69649c673814d5738247b5fbaaae5bb7b84e4c7b3ff5c4f1b1a85fc7261a35f0282d79076a9c862e5e1021d31a318d8b2e5a74b80500cb222642940

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\PreSignInSettingsConfig.json

Filesize
63KB

MD5
e516a60bc980095e8d156b1a99ab5eee

SHA1
238e243ffc12d4e012fd020c9822703109b987f6

SHA256
543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7

SHA512
9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
e07ce1a0368247e4a1579e51df6654e0

SHA1
2d8075612b2d52eceec279ed7f0343d180de16e0

SHA256
32373fe47284e313a565ff5d9d8998ee98699e1bebecba78690b25f2e0f5bcc4

SHA512
b368bdfde66fce989461ef34e510cc5f9f48f243323491c3ff87c507f3a2466402f45d0b9ac0d19f48c3c37ebd382c8c743c83b596a3be877916b101108dd492

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRC0001.tmp

Filesize
18KB

MD5
43357b4ae28ca7f6ea4a4f13a91d7e18

SHA1
395114058bbbfcdb7d798305ee2d2710dfacb175

SHA256
07758f164d6d44a0d441bec4d609c74793febc2dd8780654b2080ddd3d327cf1

SHA512
d51e8ad1a3d5ea09c44258c7d629f9a7d7d762d0a785503fce4046151c21039b7b827e36311803ffe5ef4b2e4405d8c4a22b5791318f9b442cce10fe2e855824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5AN3FZ97\update100[2].xml

Filesize
726B

MD5
53244e542ddf6d280a2b03e28f0646b7

SHA1
d9925f810a95880c92974549deead18d56f19c37

SHA256
36a6bd38a8a6f5a75b73caffae5ae66dfabcaefd83da65b493fa881ea8a64e7d

SHA512
4aa71d92ea2c46df86565d97aac75395371d3e17877ab252a297b84dca2ab251d50aaffc62eab9961f0df48de6f12be04a1f4a2cbde75b9ae7bcce6eb5450c62

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html.~tmp

Filesize
104KB

MD5
effecce1b6868c8bd7950ef7b772038b

SHA1
695d5a07f59b4b72c5eca7be77d5b15ae7ae59b0

SHA256
003e619884dbc527e20f0aa8487daf5d7eed91d53ef6366a58c5493aaf1ce046

SHA512
2f129689181ffe6fff751a22d4130bb643c5868fa0e1a852c434fe6f7514e3f1e5e4048179679dec742ec505139439d98e6dcc74793c18008db36c800d728be2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\2ETHRUWU\microsoft.windows[1].xml

Filesize
97B

MD5
ac7b902bf7872a360234c2680391dd8a

SHA1
4da3ec0b3aba6665f9be020ab00d31caacaa107e

SHA256
3d86e889d3d0d339cffc538f971c62fcced54ba121152643d0e9ae4147da126a

SHA512
e5b01a2c3a82e6b94701c12db57d7c0b3c8628acf761b11cbe1faf9d63a6d4336d90fa3a74336a662b0942c7f22c3b51364b8aec22730a3f15b9c66082f5fcde

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133218017776890649.txt

Filesize
78KB

MD5
38828c8e0b709fd9b0e12b33431a3938

SHA1
f1cbc52e45a77ff8b395b479e355cb2effbc3fdd

SHA256
f8b3a5d99a3d7b46137f2b8c8681cb51a72ef4b5d7dbbfca67105ec083127706

SHA512
621c73b985f6c59a8ac1a8a73375a1752ebf6406ba2a25722a372a0cfd59b7dccb08bc4b122daf00f73c46bebaad28c0dda87b75165c2b66b79e7b334296e0cc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat

Filesize
11KB

MD5
1b523df9c466e0135d513a1a8d18c46a

SHA1
4809c7af850d5861b39b2409fd7c59c7e95aac5f

SHA256
93ab1f8051eb7cd509ab44fdc0b843804785f98d5a1a2d27d0f68ad4bebc7866

SHA512
8ff616974463a465220b1002337eeb0da76595c3caeb33d7425cf7de1e41321344cf798da0dda1e385c9ba9601d793c53a77373a9ff67a50a70bb87a67927d66

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat

Filesize
16KB

MD5
af9d34d292d5d4ace349dcea8e8e4c4e

SHA1
5f17c7ad66b0a14ed5ef81fd40232898b00b1a6b

SHA256
277a89b1c74f664122e89a6217c5c174dad392c34f1b1d88f8f350dd67a418a1

SHA512
886303e882c03ca6e1d8350ec56b62fc565e10e333f4bf26a21b134fbe3efb95567a84d4189e270a8e32c7938d7238c5298b318fcf7647a1392b409851087491

Download Submit
C:\Users\Admin\AppData\Local\Temp\338EF71.tmp

Filesize
26B

MD5
e0a0ed720424ba7cabbcaf3c3b88385a

SHA1
a7d9472f31a0886f1069ba87e2f752adaf2ebd67

SHA256
eb569fcefe72a453ea7216a1ca3a9d756371cfa73b0a984b25e5e5d86b7f2f31

SHA512
e5a025ddf5cb4302af6d6593757c29aaaad4afb84ee29dc0d03a1b1d3041f253b6de022dd59c02cd67d9d9e977631152a2da6bcff219adef3459a99a529d9dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\4D05227.tmp

Filesize
26B

MD5
e0a0ed720424ba7cabbcaf3c3b88385a

SHA1
a7d9472f31a0886f1069ba87e2f752adaf2ebd67

SHA256
eb569fcefe72a453ea7216a1ca3a9d756371cfa73b0a984b25e5e5d86b7f2f31

SHA512
e5a025ddf5cb4302af6d6593757c29aaaad4afb84ee29dc0d03a1b1d3041f253b6de022dd59c02cd67d9d9e977631152a2da6bcff219adef3459a99a529d9dd5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk

Filesize
2KB

MD5
f056358c3df60b630a7d101377bf0fd7

SHA1
be0453e2841fff8d8964525bb01a86ea15263f2a

SHA256
e5753de9377f2fa88af81de1a36a8ad5d9daf39a5b9fb57ee22e8b85e06aa544

SHA512
09ca223e868d32ae55136fa71483006242e8fbb40b962da1a9a73984a5bad010f75ecd283b74d071928748da6c1ab72f65b3723f8130f3efcc8a68777b42c413

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\Files.docx.LNK

Filesize
1KB

MD5
9efb21a4c65e014f9771ec9736fb88dd

SHA1
50b0c7472e6766743df4f07c959e997d2044a7b4

SHA256
8cedb3f69aa0328687b1acb2f8be085fc4718d2f9985368e056504d84608a5ab

SHA512
76fc730d7cd841bc3e5017629098fae0690c27921d96dc899d7c41e06f2825acd579cb2affbf9c4bbaaa9b1604d15a58e7b83d6bb694e9299ba0052639385851

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
201B

MD5
b2ac875103aac6f8b1faeae04137efac

SHA1
dd560f54b7ff42e9e9cd4916aff57d44650c347d

SHA256
66bdb5d4a4e3ce2d087db62018f3ce1a56d89b0e837f19c1f6aa4893a5488de9

SHA512
9314d9510951deb4a08ef564de1c08bf9fc6128734232e4f80ace7d1d7998a1876d240a88e50f43429a1d05c95b6e4786fa5b6fff970a00ccaaf3b65431ca48f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
202B

MD5
4566d1d70073cd75fe35acb78ff9d082

SHA1
f602ecc057a3c19aa07671b34b4fdd662aa033cc

SHA256
fe33f57205e2ebb981c4744d5a4ddc231f587a9a0589e6565c52e1051eadb0c0

SHA512
b9584ebfdd25cc588162dd6525a399c72ac03bf0c61709b96a19feba7217d840ae2c60d7b0d3b43307a2776f497a388e79ef8a646c12ae59a7f5cc4789bbf3c8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
201B

MD5
35375f95b1430c8b11ebeb931fba0dda

SHA1
5122d139ac357db969c191b941bd479ceb9dc59f

SHA256
fd5691afe44306226fa973037fe144c3214867067cf88cb2285394888d959d5b

SHA512
b9043a4d4470ac90f83244a81fad5de8944b83ba1e8ab6bbc7d29fb216c2ded74bf1c7b1ca8c84535b989075660e83f676e273a1b524f9e5dd8e04fee412cc6b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
201B

MD5
35375f95b1430c8b11ebeb931fba0dda

SHA1
5122d139ac357db969c191b941bd479ceb9dc59f

SHA256
fd5691afe44306226fa973037fe144c3214867067cf88cb2285394888d959d5b

SHA512
b9043a4d4470ac90f83244a81fad5de8944b83ba1e8ab6bbc7d29fb216c2ded74bf1c7b1ca8c84535b989075660e83f676e273a1b524f9e5dd8e04fee412cc6b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
201B

MD5
35375f95b1430c8b11ebeb931fba0dda

SHA1
5122d139ac357db969c191b941bd479ceb9dc59f

SHA256
fd5691afe44306226fa973037fe144c3214867067cf88cb2285394888d959d5b

SHA512
b9043a4d4470ac90f83244a81fad5de8944b83ba1e8ab6bbc7d29fb216c2ded74bf1c7b1ca8c84535b989075660e83f676e273a1b524f9e5dd8e04fee412cc6b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp

Filesize
18KB

MD5
3ea0c24ea1d78ad5f4939a2909d04775

SHA1
ebf44b8507e6db3f7446d8d8f1862f62a420b59b

SHA256
06a605c1c3366eb0d5f5e8e7d65bf8662e0f730ed6578497a0aeaa986560ccc8

SHA512
d805f0111c87c707fa56bd6490288e34397ad50633ec561ad6a19ef2e2de39432b6df50f12168695e49fa90c504903f681aac4e7d0a7cbb9c986820ee3edc69b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms

Filesize
8KB

MD5
dace6e726a001e43ae55bb7eeeaf3c3e

SHA1
7884477ca4971cd196c900a1781032882b7470d4

SHA256
9c6d4d213c7ac838b827ea7a3b171c725adaebc721b5349dafb1008b2949e335

SHA512
d226bf52a7cf92bfc3aaa14da1ce6a175198e1f7ab570c5e347a21f0a707170246b5e60a840d35a1e4ec0434c8a0cc9f505c971024f7b4be319d10c9e890774b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Filesize
7KB

MD5
b8b517894d5083fb33611d76683aa017

SHA1
7efef4d1d3f01a695b99e1d936ae266a84ad5def

SHA256
97c5db9754dfec7c44947f6c68b99499bfd182fa206f441cf15d837c6f6e1107

SHA512
e712e5e96fbf5fdc74464422854819db269a1112dbc59370b87b319e3b1ea156cc5dacd7c70b45db5be187cf7090d70009785fe724f5685c7ecdeca8334c4097

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\fb3b0dbfee58fac8.automaticDestinations-ms

Filesize
8KB

MD5
8521bdda6e37680fd6a37741fe700cc4

SHA1
d167e4ae2c2c0692ccdbc0e095bfec93f455913a

SHA256
f26993f2b719d8fd970187d092ae6d74ad357861755665ef63196549d39acc65

SHA512
ae3253a97720605c9b047fb7d9385506a444937516fd3072ded864918c7c9f092b0a8f835cb03b3a399f5c583024feb237ab4bd2577ef8956ce16918d0f8198a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5FC5UKPU2HAH7PR7ZOB0.temp

Filesize
24B

MD5
4fcb2a3ee025e4a10d21e1b154873fe2

SHA1
57658e2fa594b7d0b99d02e041d0f3418e58856b

SHA256
90bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228

SHA512
4e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8PB9NUPP7TD6L41FEGN6.temp

Filesize
3KB

MD5
9955170f560cb4bef85397d569558976

SHA1
35256d3200ce67069c9b3a36da2150518c491781

SHA256
34ac9b92de504a1e081f967e578cf349da8a55813c3f57f18f79a9ae7c367843

SHA512
041cb771870b2f1a7e3e6acf4765db83c54de3e94989b8caf7a271c2046315e8250143f45322ce332d1a3ff933344ce0474bdd941ab97e6c5b2c046bfdfd7dcc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
643016f72c4aaa8195b5a612b901d592

SHA1
20bb045dd3aa42cbeb2b0a6fd61835ec58f63d61

SHA256
7d4dd5ac7258047796f4c461c9d4506727cb3aee5d2ff413c7e0f71150322b8a

SHA512
cdb0ae4ae8c7b6816f43e0e05bcd8f7ec268d7f746da39bd19df4d3112e40836b1bdc34f71e1ac70268c91b45cd6fa29229648b07f028666ef6d3375d30847c5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
890ef3ab6b1fd3bfc273500c18e7ff41

SHA1
6439e339c89de2d604e16594f81c3d95a13f3502

SHA256
e6cfcfa5c9c95c3ca9691bf196f0b9fd1e4a5c3394b6a2a3203ef8ed5b8badc7

SHA512
8f59b62aafff875bb7d252c63b9fd8295e767e4a76612a3c13cd9d0f5b42269a426ebf30a285293409dce6684dd98ab0dfab15b6bde472ee4b945a39c4dc6a11

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
a541c3405c2f5783dd37b242c14ae4de

SHA1
3bdfb4e486bbe039d0fde60ebe1fe2a89521629f

SHA256
b67a854495dceb003c35141f20a02cb1f3f008a8b7738da4af6cf2e8fecd8617

SHA512
f3a418a77d94843dd65437dbc0262c125088bcfa2568fb77f4a109d63cc63550ecc0362b28b664b94dcd3c357c91cc2a264142666d34d4408877190b3241b354

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
0ee64d3769cd48a7bda5f781f57aa75d

SHA1
d6df14807d0f21800dd90b5550030613051177a3

SHA256
c7e9f389e512e05cf026eefdf889378e9f9fef7f1c0b2d9af73b8982d13f9dfe

SHA512
1da81fdb412a77e57743d7ae6b442be9f5a65ae6b7c623b5e64da9abf0d5d75f3e834d0a04497b19f6de26d98124732469a63b37101895209525a37e618cc5d0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
0ca9c95b2803bc2a2d11e3d49864e25e

SHA1
a348e2a6c5bd3694b6a58895e0a1aaba6854a433

SHA256
aa3f8fc39440c3a8932140341a4b7d08c7e8fa32aa87bd601009f89fe3059bbb

SHA512
0f2cbfedf730d218016df130b6ee4c008a8d3bb89eaa58995b2a7ba7eb9b2fc66dd5f821decc71fe703a9fa489afecca43706f5b790f53fd7017ede26b1fb553

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
0ee64d3769cd48a7bda5f781f57aa75d

SHA1
d6df14807d0f21800dd90b5550030613051177a3

SHA256
c7e9f389e512e05cf026eefdf889378e9f9fef7f1c0b2d9af73b8982d13f9dfe

SHA512
1da81fdb412a77e57743d7ae6b442be9f5a65ae6b7c623b5e64da9abf0d5d75f3e834d0a04497b19f6de26d98124732469a63b37101895209525a37e618cc5d0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
0ee64d3769cd48a7bda5f781f57aa75d

SHA1
d6df14807d0f21800dd90b5550030613051177a3

SHA256
c7e9f389e512e05cf026eefdf889378e9f9fef7f1c0b2d9af73b8982d13f9dfe

SHA512
1da81fdb412a77e57743d7ae6b442be9f5a65ae6b7c623b5e64da9abf0d5d75f3e834d0a04497b19f6de26d98124732469a63b37101895209525a37e618cc5d0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
ed1e7a9d5a4f307d790d09ce0c6bcc5b

SHA1
b190712312fe4a186c7d6957bf7f6acf8212a8bd

SHA256
a3ca48cec8b48ab0ba28ca7ac19cc8348c15a11332abc72a857b3a5c4f2b1fc9

SHA512
74bd4a499954496154cfda443c2e25c7cf2329b2ba3735aa9218c88e3614cb7907e79ecfe74d5fd7eeb36334e719b6b4eb593660406dd2762ef0546eb55341a4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
a0db346c9383178b8f469ad0ed8bd26e

SHA1
06e0630cc2745f425784e024bfd4cc23d617349e

SHA256
4f389c1080043f399c354444dde925eea4131791fc468ee44eeefb6f591d57b6

SHA512
885f0bef4af72d3186a2edc629f8775280d17615d4dc23c85627e0410217c6ff3f0f6e7ba0ee09d7f545d5c8e9363c50dc21a884a555ac06484582c9bf5c272d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
a0db346c9383178b8f469ad0ed8bd26e

SHA1
06e0630cc2745f425784e024bfd4cc23d617349e

SHA256
4f389c1080043f399c354444dde925eea4131791fc468ee44eeefb6f591d57b6

SHA512
885f0bef4af72d3186a2edc629f8775280d17615d4dc23c85627e0410217c6ff3f0f6e7ba0ee09d7f545d5c8e9363c50dc21a884a555ac06484582c9bf5c272d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\Files.docx.lnk

Filesize
634B

MD5
056c3a71fca90f7ae7c3a9c5174417eb

SHA1
deac51aa0a500a7a8198536a9c98ec20dbaf8467

SHA256
57859ab753e660798997fc2b153eaf844f3b702668b15c86920a61d0d46e7139

SHA512
9b8b96a961bb417a06314613e010b4668f993608281540a55a3cdad6153388ca5f56ac05920e44487cf01ba3b49cbc14cfd39536980c13fb0af6306c72d44652

Download Submit
C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Quick Notes.one

Filesize
383KB

MD5
bf337b9c208c492805c7286b30fbdddb

SHA1
6bc94045c6f7b14b21e70cf2ba731a547a8c08c9

SHA256
9112c50d002b5d0815e8d84711c62b42eeba601fc3188b88cd2aa6b62ceb5841

SHA512
aa12db215d5aec74bfb808f1208efa83a6d3c1b4cbdfc2a504f6c568f2e561a3d31058e3a66e6fc2a9a452452b767fe94cd82a7fcbde0474a3f53b4bdbe8285e

Download Submit
C:\Users\Admin\Documents\~$Files.docx

Filesize
162B

MD5
32e0b929d28bc7a027e9e4f10005de3c

SHA1
67cafffffe3e61686363f7b5b4825bcf05285334

SHA256
a5ffc98dcce3b5a93c3389f20772aacd8a4fddba7277310869274b0a4b24b289

SHA512
503814c0d486a17a975fb858a3c27c6c8ad217358e3320a22b0d05886fa300c0743c37d6824fd77cf80930f15cce62a2e27893f97510456d1b318028f6ab988d

Download Submit
C:\Windows\INF\vhdmp.PNF

Filesize
7KB

MD5
47298a8a565e0e5ddfd619f95509f772

SHA1
992d5efc0d34b734f600e4efe4f43ac852d20365

SHA256
802213ed6691cdc2db07485601b4d35b934db804d377a2675de93860e572ce69

SHA512
3dfd4b08a28ed6ec77770cf99ca3fc83c27104b7d52720ed42252556701c15c8d1db92704c3f21d5db17d43723d144df8ea747af5d9c538564c4d73998e53060

Download Submit
memory/1812-155-0x00007FFA7ED30000-0x00007FFA7ED40000-memory.dmp

Filesize
64KB

Download
memory/2192-222-0x00007FFABE810000-0x00007FFABE811000-memory.dmp

Filesize
4KB

Download
memory/2924-242-0x00007FFA7C580000-0x00007FFA7C590000-memory.dmp

Filesize
64KB

Download
memory/2924-163-0x00007FFA7ED30000-0x00007FFA7ED40000-memory.dmp

Filesize
64KB

Download
memory/2924-557-0x00007FFA7ED30000-0x00007FFA7ED40000-memory.dmp

Filesize
64KB

Download
memory/2924-558-0x00007FFA7ED30000-0x00007FFA7ED40000-memory.dmp

Filesize
64KB

Download
memory/2924-175-0x00007FFA7ED30000-0x00007FFA7ED40000-memory.dmp

Filesize
64KB

Download
memory/2924-555-0x00007FFA7ED30000-0x00007FFA7ED40000-memory.dmp

Filesize
64KB

Download
memory/2924-560-0x00007FFA7ED30000-0x00007FFA7ED40000-memory.dmp

Filesize
64KB

Download
memory/2924-167-0x00007FFA7ED30000-0x00007FFA7ED40000-memory.dmp

Filesize
64KB

Download
memory/2924-195-0x00007FFA7C580000-0x00007FFA7C590000-memory.dmp

Filesize
64KB

Download
memory/2924-159-0x00007FFA7ED30000-0x00007FFA7ED40000-memory.dmp

Filesize
64KB

Download
memory/2976-561-0x00007FFABEC10000-0x00007FFABEC11000-memory.dmp

Filesize
4KB

Download
memory/2976-562-0x00007FFABE160000-0x00007FFABE161000-memory.dmp

Filesize
4KB

Download
memory/3476-461-0x0000013D67810000-0x0000013D6781E000-memory.dmp

Filesize
56KB

Download
memory/3476-467-0x0000013D69CD0000-0x0000013D69CDA000-memory.dmp

Filesize
40KB

Download
memory/3476-468-0x0000013D69D00000-0x0000013D69D08000-memory.dmp

Filesize
32KB

Download
memory/3476-573-0x0000013D6B710000-0x0000013D6B81E000-memory.dmp

Filesize
1.1MB

Download
memory/3612-302-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/6264-694-0x000002A2BCD40000-0x000002A2BCD60000-memory.dmp

Filesize
128KB

Download
memory/6264-696-0x000002A2BCD00000-0x000002A2BCD20000-memory.dmp

Filesize
128KB

Download
memory/6264-698-0x000002A2BD100000-0x000002A2BD120000-memory.dmp

Filesize
128KB

Download