Analysis
-
max time kernel
1527s -
max time network
1592s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 16:06
Static task
static1
Behavioral task
behavioral1
Sample
CairoSetup_64bit.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
CairoSetup_64bit.exe
Resource
win10v2004-20230220-en
General
-
Target
CairoSetup_64bit.exe
-
Size
3.5MB
-
MD5
1f69e8a557b018eaacbe77d7242095ef
-
SHA1
afd6f7fc776979f0ff4e36aa243b3a56ba8489e4
-
SHA256
c84ce4f35dfe0ada475f680551d653d264855a1d477ead3af5c0564e8b74a4a7
-
SHA512
73c690204af95930e27b29f704f6802ef67a545bbbb41309b70ba5a67b8e3335bab5f6ba6bf7cb72679d4c9c648dff519a1c0c582442a2f955a1b409b30eb984
-
SSDEEP
49152:6pDzGV9EVA5Nm2VkrORk8+hJplCe7ye1sCqkrH0RKOrCbpS/vFdQ1aNv:6JzGIVATZV7RkplyWq6XOrGS3Qkv
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
CairoSetup_64bit.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files\\Cairo Shell\\CairoDesktop.exe" CairoSetup_64bit.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
CairoDesktop.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation CairoDesktop.exe -
Executes dropped EXE 2 IoCs
Processes:
CairoDesktop.exeCairoDesktop.exepid process 4668 CairoDesktop.exe 1484 CairoDesktop.exe -
Loads dropped DLL 23 IoCs
Processes:
CairoSetup_64bit.exeCairoDesktop.exeCairoDesktop.exepid process 2028 CairoSetup_64bit.exe 2028 CairoSetup_64bit.exe 2028 CairoSetup_64bit.exe 2028 CairoSetup_64bit.exe 4668 CairoDesktop.exe 4668 CairoDesktop.exe 4668 CairoDesktop.exe 4668 CairoDesktop.exe 4668 CairoDesktop.exe 4668 CairoDesktop.exe 4668 CairoDesktop.exe 4668 CairoDesktop.exe 4668 CairoDesktop.exe 4668 CairoDesktop.exe 4668 CairoDesktop.exe 4668 CairoDesktop.exe 4668 CairoDesktop.exe 4668 CairoDesktop.exe 4668 CairoDesktop.exe 4668 CairoDesktop.exe 4668 CairoDesktop.exe 1484 CairoDesktop.exe 1484 CairoDesktop.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
CairoSetup_64bit.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Windows\CurrentVersion\Run CairoSetup_64bit.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CairoShell = "C:\\Program Files\\Cairo Shell\\CairoDesktop.exe" CairoSetup_64bit.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
MEMZ-Destructive.exedescription ioc process File opened for modification \??\PhysicalDrive0 MEMZ-Destructive.exe -
Drops file in Program Files directory 62 IoCs
Processes:
CairoSetup_64bit.exedescription ioc process File created C:\Program Files\Cairo Shell\System.Text.Json.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\CairoDesktop.MenuBarExtensions.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Microsoft.Extensions.FileProviders.Abstractions.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Microsoft.Extensions.Logging.Console.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Microsoft.Extensions.Logging.EventSource.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\System.Security.Principal.Windows.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\System.Runtime.CompilerServices.Unsafe.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\CairoDesktop.Interop.WinSparkle.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Microsoft.Extensions.Configuration.Abstractions.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Microsoft.Extensions.FileProviders.Physical.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Microsoft.Extensions.Hosting.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Microsoft.Extensions.Logging.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\System.Diagnostics.EventLog.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\System.Text.Encodings.Web.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Microsoft.Extensions.Configuration.Binder.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Microsoft.Extensions.Hosting.Abstractions.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\System.Data.OleDb.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\System.ValueTuple.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\RemoveCairo.exe CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\CairoDesktop.exe.config CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\ManagedShell.Interop.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Microsoft.Extensions.Configuration.FileExtensions.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Microsoft.Extensions.DependencyInjection.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\System.ServiceProcess.ServiceController.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\System.Threading.Tasks.Extensions.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\CairoDesktop.AppGrabber.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Microsoft.Extensions.Configuration.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Microsoft.Extensions.Logging.Debug.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Microsoft.Extensions.Options.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Microsoft.Extensions.Primitives.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\ManagedShell.AppBar.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\ManagedShell.UWPInterop.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Microsoft.Extensions.Configuration.Json.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Microsoft.Extensions.Logging.Configuration.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\CairoDesktop.Application.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Microsoft.Extensions.Configuration.UserSecrets.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\System.Diagnostics.DiagnosticSource.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Microsoft.Extensions.Logging.Abstractions.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Microsoft.Extensions.Options.ConfigurationExtensions.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\ManagedShell.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\System.Numerics.Vectors.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Themes\White.xaml CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\ManagedShell.ShellFolders.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Microsoft.Extensions.Configuration.CommandLine.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Microsoft.Extensions.DependencyInjection.Abstractions.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\WinSparkle.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Themes\Flat.xaml CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\CairoDesktop.Localization.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\CairoDesktop.exe CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Microsoft.Bcl.AsyncInterfaces.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Microsoft.Extensions.FileSystemGlobbing.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\System.Buffers.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\ManagedShell.Common.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Microsoft.Extensions.Logging.EventLog.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\System.Memory.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\CairoDesktop.Common.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\CairoDesktop.Infrastructure.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\CairoDesktop.Interop.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\ManagedShell.WindowsTasks.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\Microsoft.Extensions.Configuration.EnvironmentVariables.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\CairoDesktop.Configuration.dll CairoSetup_64bit.exe File created C:\Program Files\Cairo Shell\ManagedShell.WindowsTray.dll CairoSetup_64bit.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3888 4668 WerFault.exe CairoDesktop.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 33 IoCs
Processes:
msedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exeWINWORD.EXEmsedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies registry class 64 IoCs
Processes:
explorer.exeSearchApp.exeCairoDesktop.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "3" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-101#immutable1 = "Customize your mouse settings, such as the button configuration, double-click speed, mouse pointers, and motion speed." explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos800x600x96(1).left = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos800x600x96(1).top = "0" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-103#immutable1 = "Customize your keyboard settings, such as the cursor blink rate and the character repeat rate." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-2#immutable1 = "Change default settings for CDs, DVDs, and devices so that you can automatically play music, view pictures, install software, and play games." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-6#immutable1 = "Color Management" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-15#immutable1 = "Troubleshoot and fix common computer problems." explorer.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ CairoDesktop.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-1#immutable1 = "Speech Recognition" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-2#immutable1 = "Protect your PC using BitLocker Drive Encryption." explorer.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\HotKey = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\LogicalViewMode = "2" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\IconSize = "48" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-2#immutable1 = "Manage your Windows credentials." explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000000000001000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\MuiCache SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-1#immutable1 = "Power Options" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Recover copies of your files backed up in Windows 7" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Rev = "0" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-2#immutable1 = "Check network status, change network settings and set preferences for sharing files and printers." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3001#immutable1 = "Sync files between your computer and network folders" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-2#immutable1 = "Recovery" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "2" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-100#immutable1 = "Mouse" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-10#immutable1 = "Ease of Access Center" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-300#immutable1 = "Sound" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:PID = "0" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-102#immutable1 = "Keyboard" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4312#immutable1 = "Internet Options" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-1#immutable1 = "BitLocker Drive Encryption" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos800x600x96(1).bottom = "560" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12123#immutable1 = "Set firewall security options to help protect your computer from hackers and malicious software." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-160#immutable1 = "Uninstall or change programs on your computer." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-301#immutable1 = "Configure your audio devices or change the sound scheme for your computer." explorer.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-5#immutable1 = "View and update your device hardware settings and driver software." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-101#immutable1 = "Recovery" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4313#immutable1 = "Configure your Internet display and connection settings." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-101#immutable1 = "Backup and Restore (Windows 7)" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-10#immutable1 = "Choose which programs you want Windows to use for activities like web browsing, editing photos, sending e-mail, and playing music." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-3#immutable1 = "Region" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-2#immutable1 = "View information about your computer, and change settings for hardware, performance, and remote connections." explorer.exe -
Runs regedit.exe 2 IoCs
Processes:
regedit.exeregedit.exepid process 3864 regedit.exe 2768 regedit.exe -
Suspicious behavior: AddClipboardFormatListener 3 IoCs
Processes:
explorer.exeWINWORD.EXEpid process 4584 explorer.exe 4424 WINWORD.EXE 4424 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exeMEMZ-Destructive.exeMEMZ-Destructive.exeMEMZ-Destructive.exeMEMZ-Destructive.exeMEMZ-Destructive.exepid process 4588 msedge.exe 4588 msedge.exe 4116 msedge.exe 4116 msedge.exe 3952 msedge.exe 3952 msedge.exe 4628 identity_helper.exe 4628 identity_helper.exe 1484 msedge.exe 1484 msedge.exe 1484 msedge.exe 1484 msedge.exe 1608 msedge.exe 1608 msedge.exe 2344 MEMZ-Destructive.exe 2344 MEMZ-Destructive.exe 2536 MEMZ-Destructive.exe 2536 MEMZ-Destructive.exe 4488 MEMZ-Destructive.exe 4488 MEMZ-Destructive.exe 3512 MEMZ-Destructive.exe 3512 MEMZ-Destructive.exe 3856 MEMZ-Destructive.exe 3856 MEMZ-Destructive.exe 2344 MEMZ-Destructive.exe 2344 MEMZ-Destructive.exe 2536 MEMZ-Destructive.exe 4488 MEMZ-Destructive.exe 2536 MEMZ-Destructive.exe 4488 MEMZ-Destructive.exe 3512 MEMZ-Destructive.exe 3512 MEMZ-Destructive.exe 3856 MEMZ-Destructive.exe 3856 MEMZ-Destructive.exe 2344 MEMZ-Destructive.exe 2344 MEMZ-Destructive.exe 3856 MEMZ-Destructive.exe 3856 MEMZ-Destructive.exe 3512 MEMZ-Destructive.exe 3512 MEMZ-Destructive.exe 2536 MEMZ-Destructive.exe 2536 MEMZ-Destructive.exe 4488 MEMZ-Destructive.exe 4488 MEMZ-Destructive.exe 3512 MEMZ-Destructive.exe 3512 MEMZ-Destructive.exe 2344 MEMZ-Destructive.exe 2344 MEMZ-Destructive.exe 2536 MEMZ-Destructive.exe 2536 MEMZ-Destructive.exe 3856 MEMZ-Destructive.exe 3856 MEMZ-Destructive.exe 3512 MEMZ-Destructive.exe 4488 MEMZ-Destructive.exe 3512 MEMZ-Destructive.exe 4488 MEMZ-Destructive.exe 4488 MEMZ-Destructive.exe 2536 MEMZ-Destructive.exe 4488 MEMZ-Destructive.exe 2536 MEMZ-Destructive.exe 3856 MEMZ-Destructive.exe 3856 MEMZ-Destructive.exe 2344 MEMZ-Destructive.exe 2344 MEMZ-Destructive.exe -
Suspicious behavior: GetForegroundWindowSpam 4 IoCs
Processes:
CairoDesktop.exemmc.exeregedit.exeregedit.exepid process 4668 CairoDesktop.exe 372 mmc.exe 3864 regedit.exe 2768 regedit.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 56 IoCs
Processes:
msedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exepid process 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 1180 msedge.exe 1180 msedge.exe 3780 msedge.exe 3780 msedge.exe 3780 msedge.exe 4020 msedge.exe 4020 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 4744 msedge.exe 4744 msedge.exe 4744 msedge.exe 4744 msedge.exe 4744 msedge.exe 4744 msedge.exe 4744 msedge.exe 4744 msedge.exe 4744 msedge.exe 4744 msedge.exe 4744 msedge.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
CairoDesktop.exeAUDIODG.EXEsvchost.exeexplorer.exeAUDIODG.EXEmmc.exedescription pid process Token: SeDebugPrivilege 4668 CairoDesktop.exe Token: 33 1952 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1952 AUDIODG.EXE Token: SeManageVolumePrivilege 2968 svchost.exe Token: SeShutdownPrivilege 4584 explorer.exe Token: SeCreatePagefilePrivilege 4584 explorer.exe Token: 33 2876 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2876 AUDIODG.EXE Token: 33 372 mmc.exe Token: SeIncBasePriorityPrivilege 372 mmc.exe Token: 33 372 mmc.exe Token: SeIncBasePriorityPrivilege 372 mmc.exe Token: 33 372 mmc.exe Token: SeIncBasePriorityPrivilege 372 mmc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
CairoSetup_64bit.exemsedge.exemsedge.exeosk.exemsedge.exepid process 2028 CairoSetup_64bit.exe 4128 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 1504 osk.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
msedge.exemsedge.exemsedge.exepid process 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3952 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 3832 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe 1180 msedge.exe -
Suspicious use of SetWindowsHookEx 32 IoCs
Processes:
SearchApp.exeCairoDesktop.exeosk.exeMEMZ-Destructive.exeMEMZ-Destructive.exeMEMZ-Destructive.exeMEMZ-Destructive.exeMEMZ-Destructive.exeMEMZ-Destructive.exeMEMZ-Destructive.exeWINWORD.EXEmmc.exemmc.exepid process 728 SearchApp.exe 4668 CairoDesktop.exe 1504 osk.exe 1504 osk.exe 1504 osk.exe 1504 osk.exe 3540 MEMZ-Destructive.exe 2536 MEMZ-Destructive.exe 2344 MEMZ-Destructive.exe 3856 MEMZ-Destructive.exe 3512 MEMZ-Destructive.exe 4488 MEMZ-Destructive.exe 384 MEMZ-Destructive.exe 4424 WINWORD.EXE 4424 WINWORD.EXE 4424 WINWORD.EXE 4424 WINWORD.EXE 4424 WINWORD.EXE 4424 WINWORD.EXE 4424 WINWORD.EXE 1460 mmc.exe 372 mmc.exe 372 mmc.exe 384 MEMZ-Destructive.exe 384 MEMZ-Destructive.exe 384 MEMZ-Destructive.exe 384 MEMZ-Destructive.exe 384 MEMZ-Destructive.exe 384 MEMZ-Destructive.exe 384 MEMZ-Destructive.exe 384 MEMZ-Destructive.exe 384 MEMZ-Destructive.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4128 wrote to memory of 2764 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 2764 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4140 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4588 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 4588 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 1408 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 1408 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 1408 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 1408 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 1408 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 1408 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 1408 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 1408 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 1408 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 1408 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 1408 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 1408 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 1408 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 1408 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 1408 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 1408 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 1408 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 1408 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 1408 4128 msedge.exe msedge.exe PID 4128 wrote to memory of 1408 4128 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CairoSetup_64bit.exe"C:\Users\Admin\AppData\Local\Temp\CairoSetup_64bit.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" "C:\Program Files\Cairo Shell\CairoDesktop.exe"2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultba56d4ceh0c02h48b3ha7a8h6c0b61567cab1⤵
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffe00c46f8,0x7fffe00c4708,0x7fffe00c47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,17301829810229905453,143037847607264986,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,17301829810229905453,143037847607264986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2488 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,17301829810229905453,143037847607264986,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:82⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Program Files\Cairo Shell\CairoDesktop.exe"C:\Program Files\Cairo Shell\CairoDesktop.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Cairo Shell\CairoDesktop.exe"C:\Program Files\Cairo Shell\CairoDesktop.exe" /restart=true3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4668 -s 30003⤵
- Program crash
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 432 -p 4668 -ip 46681⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffe00c46f8,0x7fffe00c4708,0x7fffe00c47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1380 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1076 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5800 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3396 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1836 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6556 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2688 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11335284269630485568,3665164109211573813,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6876 /prefetch:12⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\osk.exe"C:\Windows\system32\osk.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\osk.exe"C:\Windows\system32\osk.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x450 0x2ec1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe" /main2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+buy+weed3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fffe00c46f8,0x7fffe00c4708,0x7fffe00c47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,343830506628319877,3918865766014959514,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,343830506628319877,3918865766014959514,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:34⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,343830506628319877,3918865766014959514,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,343830506628319877,3918865766014959514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,343830506628319877,3918865766014959514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,343830506628319877,3918865766014959514,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:14⤵
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+create+your+own+ransomware3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffe00c46f8,0x7fffe00c4708,0x7fffe00c47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,13050646211793525307,930400198432430992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:34⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,13050646211793525307,930400198432430992,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,13050646211793525307,930400198432430992,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13050646211793525307,930400198432430992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13050646211793525307,930400198432430992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+code+a+virus+in+visual+basic3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7fffe00c46f8,0x7fffe00c4708,0x7fffe00c47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,1918073876972405174,17318387823302553238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:34⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,1918073876972405174,17318387823302553238,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,1918073876972405174,17318387823302553238,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2984 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1918073876972405174,17318387823302553238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1918073876972405174,17318387823302553238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1918073876972405174,17318387823302553238,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:14⤵
-
C:\Windows\SysWOW64\mmc.exe"C:\Windows\System32\mmc.exe"3⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe"4⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+code+a+virus+in+visual+basic3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7fffe00c46f8,0x7fffe00c4708,0x7fffe00c47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,11561065629199640103,4100774085531033517,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:34⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,11561065629199640103,4100774085531033517,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2992 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,11561065629199640103,4100774085531033517,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11561065629199640103,4100774085531033517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11561065629199640103,4100774085531033517,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffe00c46f8,0x7fffe00c4708,0x7fffe00c47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,8284444147028654413,9574123867337738300,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,8284444147028654413,9574123867337738300,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:34⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,8284444147028654413,9574123867337738300,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8284444147028654413,9574123867337738300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8284444147028654413,9574123867337738300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,8284444147028654413,9574123867337738300,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4864 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8284444147028654413,9574123867337738300,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,8284444147028654413,9574123867337738300,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,8284444147028654413,9574123867337738300,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8284444147028654413,9574123867337738300,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=batch+virus+download3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffe00c46f8,0x7fffe00c4708,0x7fffe00c47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,16361982466513631203,14722054806295181024,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,16361982466513631203,14722054806295181024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:34⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,16361982466513631203,14722054806295181024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3000 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16361982466513631203,14722054806295181024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16361982466513631203,14722054806295181024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16361982466513631203,14722054806295181024,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16361982466513631203,14722054806295181024,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16361982466513631203,14722054806295181024,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16361982466513631203,14722054806295181024,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16361982466513631203,14722054806295181024,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16361982466513631203,14722054806295181024,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,16361982466513631203,14722054806295181024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,16361982466513631203,14722054806295181024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+20163⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffe00c46f8,0x7fffe00c4708,0x7fffe00c47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+download+memz3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffe00c46f8,0x7fffe00c4708,0x7fffe00c47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,11656454958334927121,8821664197183642750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:34⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,11656454958334927121,8821664197183642750,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,11656454958334927121,8821664197183642750,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11656454958334927121,8821664197183642750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11656454958334927121,8821664197183642750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11656454958334927121,8821664197183642750,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:14⤵
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe"3⤵
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+remove+memz+trojan+virus3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffe00c46f8,0x7fffe00c4708,0x7fffe00c47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,3786248310898667193,17849841037621358415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:34⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,3786248310898667193,17849841037621358415,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,3786248310898667193,17849841037621358415,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,3786248310898667193,17849841037621358415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,3786248310898667193,17849841037621358415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,3786248310898667193,17849841037621358415,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,3786248310898667193,17849841037621358415,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,3786248310898667193,17849841037621358415,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,3786248310898667193,17849841037621358415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4000 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,3786248310898667193,17849841037621358415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4000 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,3786248310898667193,17849841037621358415,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,3786248310898667193,17849841037621358415,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,3786248310898667193,17849841037621358415,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,3786248310898667193,17849841037621358415,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1872 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,3786248310898667193,17849841037621358415,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,3786248310898667193,17849841037621358415,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:14⤵
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe"3⤵
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=internet+explorer+is+the+best+browser3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffe00c46f8,0x7fffe00c4708,0x7fffe00c47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://motherboard.vice.com/read/watch-this-malware-turn-a-computer-into-a-digital-hellscape3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffe00c46f8,0x7fffe00c4708,0x7fffe00c47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/memz-malwarevirus-trojan-completely-destroying/268bc1c2-39f4-42f8-90c2-597a673b6b453⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffe00c46f8,0x7fffe00c4708,0x7fffe00c47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=the+memz+are+real3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffe00c46f8,0x7fffe00c4708,0x7fffe00c47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,5326098559392611755,13486236231283659811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:34⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,5326098559392611755,13486236231283659811,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,5326098559392611755,13486236231283659811,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5326098559392611755,13486236231283659811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5326098559392611755,13486236231283659811,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2952 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5326098559392611755,13486236231283659811,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5326098559392611755,13486236231283659811,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5326098559392611755,13486236231283659811,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,5326098559392611755,13486236231283659811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,5326098559392611755,13486236231283659811,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5326098559392611755,13486236231283659811,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5326098559392611755,13486236231283659811,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5326098559392611755,13486236231283659811,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2156,5326098559392611755,13486236231283659811,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2696 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=minecraft+hax+download+no+virus3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffe00c46f8,0x7fffe00c4708,0x7fffe00c47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=bonzi+buddy+download+free3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffe00c46f8,0x7fffe00c4708,0x7fffe00c47184⤵
-
C:\Windows\SysWOW64\mmc.exe"C:\Windows\System32\mmc.exe"3⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe"4⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\These.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\760b1fad6f524c26aa4e9ecb3124d90e /t 3112 /p 44241⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x450 0x2ec1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3eb8055 /state1:0x41c64e6d1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Cairo Shell\CairoDesktop.AppGrabber.dllFilesize
88KB
MD5c58805c39cc8e3f9ea6f102172e14a77
SHA14d0712f7ce24dc759198ed1c76243a99d22e706d
SHA25605f704fed2c0c5673557ff6c1143e599a2189f38b5098f9e30597356f67a7d4d
SHA512441c53a2ace26e06b0895064e4d1f21aa5af9ceb683c7a3cce4f294561c262a2179ab2e2ffb662c5fc54b564097299a4740ebfeee86cdabc960d29c0d07229d4
-
C:\Program Files\Cairo Shell\CairoDesktop.AppGrabber.dllFilesize
88KB
MD5c58805c39cc8e3f9ea6f102172e14a77
SHA14d0712f7ce24dc759198ed1c76243a99d22e706d
SHA25605f704fed2c0c5673557ff6c1143e599a2189f38b5098f9e30597356f67a7d4d
SHA512441c53a2ace26e06b0895064e4d1f21aa5af9ceb683c7a3cce4f294561c262a2179ab2e2ffb662c5fc54b564097299a4740ebfeee86cdabc960d29c0d07229d4
-
C:\Program Files\Cairo Shell\CairoDesktop.AppGrabber.dllFilesize
88KB
MD5c58805c39cc8e3f9ea6f102172e14a77
SHA14d0712f7ce24dc759198ed1c76243a99d22e706d
SHA25605f704fed2c0c5673557ff6c1143e599a2189f38b5098f9e30597356f67a7d4d
SHA512441c53a2ace26e06b0895064e4d1f21aa5af9ceb683c7a3cce4f294561c262a2179ab2e2ffb662c5fc54b564097299a4740ebfeee86cdabc960d29c0d07229d4
-
C:\Program Files\Cairo Shell\CairoDesktop.Application.dllFilesize
6KB
MD50d6fecc43dbb8ee3910c985730c2a1e1
SHA14936dca8457501d61a7571f2da54f3ac1e195f6e
SHA25662f9ee880ce6134449fc8a8071ba0cdc574941eec148537412770b2368113901
SHA512533fa5b6ccdbd78bdbc09f0f593417f48e229ae5d06705f8ce4f38122b28e82f3143314af851f05b3b8026eb1f88c0b085d486a6bb7c09ba856ac73079ce3f10
-
C:\Program Files\Cairo Shell\CairoDesktop.Application.dllFilesize
6KB
MD50d6fecc43dbb8ee3910c985730c2a1e1
SHA14936dca8457501d61a7571f2da54f3ac1e195f6e
SHA25662f9ee880ce6134449fc8a8071ba0cdc574941eec148537412770b2368113901
SHA512533fa5b6ccdbd78bdbc09f0f593417f48e229ae5d06705f8ce4f38122b28e82f3143314af851f05b3b8026eb1f88c0b085d486a6bb7c09ba856ac73079ce3f10
-
C:\Program Files\Cairo Shell\CairoDesktop.Application.dllFilesize
6KB
MD50d6fecc43dbb8ee3910c985730c2a1e1
SHA14936dca8457501d61a7571f2da54f3ac1e195f6e
SHA25662f9ee880ce6134449fc8a8071ba0cdc574941eec148537412770b2368113901
SHA512533fa5b6ccdbd78bdbc09f0f593417f48e229ae5d06705f8ce4f38122b28e82f3143314af851f05b3b8026eb1f88c0b085d486a6bb7c09ba856ac73079ce3f10
-
C:\Program Files\Cairo Shell\CairoDesktop.Common.dllFilesize
76KB
MD551be70923da08565c91428fbcb181bc8
SHA1b1293b4fcfc8491392ed521a5838602d0abb97c9
SHA256d6f8fcd3e58b1abdded17d1ab316663d32a9e5fb718963236877ffdb65fd9c44
SHA5127769527efa9a4ee76ef70c9f2a158643327d5167062146ea2ca0640b1f356c4d9d45d7390d649304d417137ce7605e2b7475648e3f2d3197b7de3beab029886f
-
C:\Program Files\Cairo Shell\CairoDesktop.Common.dllFilesize
76KB
MD551be70923da08565c91428fbcb181bc8
SHA1b1293b4fcfc8491392ed521a5838602d0abb97c9
SHA256d6f8fcd3e58b1abdded17d1ab316663d32a9e5fb718963236877ffdb65fd9c44
SHA5127769527efa9a4ee76ef70c9f2a158643327d5167062146ea2ca0640b1f356c4d9d45d7390d649304d417137ce7605e2b7475648e3f2d3197b7de3beab029886f
-
C:\Program Files\Cairo Shell\CairoDesktop.Common.dllFilesize
76KB
MD551be70923da08565c91428fbcb181bc8
SHA1b1293b4fcfc8491392ed521a5838602d0abb97c9
SHA256d6f8fcd3e58b1abdded17d1ab316663d32a9e5fb718963236877ffdb65fd9c44
SHA5127769527efa9a4ee76ef70c9f2a158643327d5167062146ea2ca0640b1f356c4d9d45d7390d649304d417137ce7605e2b7475648e3f2d3197b7de3beab029886f
-
C:\Program Files\Cairo Shell\CairoDesktop.Configuration.dllFilesize
28KB
MD54586c3525b5c52cfd7aa479556f57c41
SHA13c3f429cf242ac21f50e940759b774d3caa1f1fb
SHA256e457df504e1c9c04b13570d181214826fbb748bcc5204cae47f0e9248265ab87
SHA512ccdef6dfc4cdd2ab7d7e89b807e93bf557a00a3dede8e515e52d58e722824ab2f88069493c53ca80adf224e703de0575dd7645257c1d8c59e44f2f06de4655bd
-
C:\Program Files\Cairo Shell\CairoDesktop.Configuration.dllFilesize
28KB
MD54586c3525b5c52cfd7aa479556f57c41
SHA13c3f429cf242ac21f50e940759b774d3caa1f1fb
SHA256e457df504e1c9c04b13570d181214826fbb748bcc5204cae47f0e9248265ab87
SHA512ccdef6dfc4cdd2ab7d7e89b807e93bf557a00a3dede8e515e52d58e722824ab2f88069493c53ca80adf224e703de0575dd7645257c1d8c59e44f2f06de4655bd
-
C:\Program Files\Cairo Shell\CairoDesktop.Configuration.dllFilesize
28KB
MD54586c3525b5c52cfd7aa479556f57c41
SHA13c3f429cf242ac21f50e940759b774d3caa1f1fb
SHA256e457df504e1c9c04b13570d181214826fbb748bcc5204cae47f0e9248265ab87
SHA512ccdef6dfc4cdd2ab7d7e89b807e93bf557a00a3dede8e515e52d58e722824ab2f88069493c53ca80adf224e703de0575dd7645257c1d8c59e44f2f06de4655bd
-
C:\Program Files\Cairo Shell\CairoDesktop.Infrastructure.dllFilesize
16KB
MD5486017ba593a0adca22dd1455bd2a2b8
SHA139fb6f22047ed86f9e38f19d869f3920b36c6df5
SHA256460f8016bb8357783af8829cc4ed1d4c06a21f65d1d4bd40ad3e317cc8341b55
SHA5120681024994d7395b82d48eecd4825f969d0d2845579b8fcdba4e5210727840617acdfc2665e3a8bfd10a50cf368e17bda199df4716b816a052a8c586b853d72e
-
C:\Program Files\Cairo Shell\CairoDesktop.Infrastructure.dllFilesize
16KB
MD5486017ba593a0adca22dd1455bd2a2b8
SHA139fb6f22047ed86f9e38f19d869f3920b36c6df5
SHA256460f8016bb8357783af8829cc4ed1d4c06a21f65d1d4bd40ad3e317cc8341b55
SHA5120681024994d7395b82d48eecd4825f969d0d2845579b8fcdba4e5210727840617acdfc2665e3a8bfd10a50cf368e17bda199df4716b816a052a8c586b853d72e
-
C:\Program Files\Cairo Shell\CairoDesktop.Infrastructure.dllFilesize
16KB
MD5486017ba593a0adca22dd1455bd2a2b8
SHA139fb6f22047ed86f9e38f19d869f3920b36c6df5
SHA256460f8016bb8357783af8829cc4ed1d4c06a21f65d1d4bd40ad3e317cc8341b55
SHA5120681024994d7395b82d48eecd4825f969d0d2845579b8fcdba4e5210727840617acdfc2665e3a8bfd10a50cf368e17bda199df4716b816a052a8c586b853d72e
-
C:\Program Files\Cairo Shell\CairoDesktop.Interop.WinSparkle.dllFilesize
6KB
MD5be36b7d0fd6e33e0629bcc4f66d9ac89
SHA116a79cd6c16f8d18051c61040751abd44e894c02
SHA2565541424725b1c01c022454e4213727985edc59a6e5bcef8249457fcef1bec4bb
SHA512af76e7802d57434f0b0c1f9ce05812d67835fdd18a58835caa91fab67b899f507da5ef7dbe7b4d8013c16d9937321e1c9614e9f02dd066710e287094452d7dd7
-
C:\Program Files\Cairo Shell\CairoDesktop.Interop.WinSparkle.dllFilesize
6KB
MD5be36b7d0fd6e33e0629bcc4f66d9ac89
SHA116a79cd6c16f8d18051c61040751abd44e894c02
SHA2565541424725b1c01c022454e4213727985edc59a6e5bcef8249457fcef1bec4bb
SHA512af76e7802d57434f0b0c1f9ce05812d67835fdd18a58835caa91fab67b899f507da5ef7dbe7b4d8013c16d9937321e1c9614e9f02dd066710e287094452d7dd7
-
C:\Program Files\Cairo Shell\CairoDesktop.Interop.WinSparkle.dllFilesize
6KB
MD5be36b7d0fd6e33e0629bcc4f66d9ac89
SHA116a79cd6c16f8d18051c61040751abd44e894c02
SHA2565541424725b1c01c022454e4213727985edc59a6e5bcef8249457fcef1bec4bb
SHA512af76e7802d57434f0b0c1f9ce05812d67835fdd18a58835caa91fab67b899f507da5ef7dbe7b4d8013c16d9937321e1c9614e9f02dd066710e287094452d7dd7
-
C:\Program Files\Cairo Shell\CairoDesktop.Localization.dllFilesize
348KB
MD5aba84c69921d9d6ea7207a9544e63438
SHA1a4e4ec290e7156e36fe70574a22271c792d17975
SHA2566fa91bcc6da45641a6e681bef6eac6f1a43a0a661692ce55ad578894a3a69020
SHA512372431b33df55bb61caab8c85f980af2a2a29bc64bf578f7e5bdadc8d2b1e579e7dbc638764302e876e976f7d36ff80947c431e8a2637410770798c5ae8d85b4
-
C:\Program Files\Cairo Shell\CairoDesktop.MenuBarExtensions.dllFilesize
50KB
MD5c815ba5f42fdebe9063d839db87ea046
SHA179d8ef2ee4ef87d8b7b7bd49ae5a1e2739763847
SHA256d26b9bc8d5524c945ed5951852b4e8efd3af3b660a53eb3d9dc4157e0a19ab11
SHA512c8bfaf66b9085615265bcd2d41eb5a281343a24233e837d26a1a4a3833d39813b6d09fffeef764b1604e1e73e782761648a1e2bf22898a192ffdb07058e31123
-
C:\Program Files\Cairo Shell\CairoDesktop.MenuBarExtensions.dllFilesize
50KB
MD5c815ba5f42fdebe9063d839db87ea046
SHA179d8ef2ee4ef87d8b7b7bd49ae5a1e2739763847
SHA256d26b9bc8d5524c945ed5951852b4e8efd3af3b660a53eb3d9dc4157e0a19ab11
SHA512c8bfaf66b9085615265bcd2d41eb5a281343a24233e837d26a1a4a3833d39813b6d09fffeef764b1604e1e73e782761648a1e2bf22898a192ffdb07058e31123
-
C:\Program Files\Cairo Shell\CairoDesktop.MenuBarExtensions.dllFilesize
50KB
MD5c815ba5f42fdebe9063d839db87ea046
SHA179d8ef2ee4ef87d8b7b7bd49ae5a1e2739763847
SHA256d26b9bc8d5524c945ed5951852b4e8efd3af3b660a53eb3d9dc4157e0a19ab11
SHA512c8bfaf66b9085615265bcd2d41eb5a281343a24233e837d26a1a4a3833d39813b6d09fffeef764b1604e1e73e782761648a1e2bf22898a192ffdb07058e31123
-
C:\Program Files\Cairo Shell\CairoDesktop.exeFilesize
1.6MB
MD54f8e875f1d5490cc55fcbe00c609e8c3
SHA1479d84322f6bba49a68a0c9aff891576fd759ead
SHA25641590054262e4d027e86b4e2b53613d4eea2f0d69de1f29438a9c1734e726edb
SHA5124069eeff9e292a187e4abe570ac30e6e7e0910ce05e4fb3edb235d4dad88747cd2da04560ef5d6c7ef63b79162499c389189fcc9cc80c633016d9a7f78391a4d
-
C:\Program Files\Cairo Shell\CairoDesktop.exeFilesize
1.6MB
MD54f8e875f1d5490cc55fcbe00c609e8c3
SHA1479d84322f6bba49a68a0c9aff891576fd759ead
SHA25641590054262e4d027e86b4e2b53613d4eea2f0d69de1f29438a9c1734e726edb
SHA5124069eeff9e292a187e4abe570ac30e6e7e0910ce05e4fb3edb235d4dad88747cd2da04560ef5d6c7ef63b79162499c389189fcc9cc80c633016d9a7f78391a4d
-
C:\Program Files\Cairo Shell\CairoDesktop.exe.configFilesize
1KB
MD5b27921af3506979223cd8da75e81a5c4
SHA1a1647cabb3929dfed8fe76739202e4d8625251cb
SHA256fc12b53263b0d169f7a2325c16c96172967ee8ecb5dd4b123a8053c178d1785b
SHA512975fc9be10397ad69e07aa9030377a8adbee083411b964ebada0fd6b149093dd9d601a6e83e4d7d04d57b3ce94b8317ef398eb1f75ff6cf6bc4b663660aa55b9
-
C:\Program Files\Cairo Shell\ManagedShell.AppBar.dllFilesize
25KB
MD51a95f15149e90ebb30d7d284ddbaddae
SHA108ae72c235cda2b5b3497b08f070dd390a2dadcc
SHA2569ff2be79076b70fd596350df8034284f7aaa8bbee54ca9ccf1b4131a7b928b3d
SHA51207f273b3ac46e63c68205554828430b615f3854779cc73855ba890d0bdf899c56f6160feb506cd2d9d369392917d378e799fe177419e71b3c77ff5c3f4b77957
-
C:\Program Files\Cairo Shell\ManagedShell.Common.dllFilesize
63KB
MD52e686e234c0c639b4a025ff569a1dbb1
SHA12ba6e6db7198c9f90c2d61fdd8c75146227c23b6
SHA256ec6ad6e49c8f9d828f059416a4f55e273c4a20f5423f8c7078537c633a5fbfe9
SHA5129af4247d669d3960e6893d41cfc83f52bac23315591a5dc95517d52a7654c9711129b7bd54a95b1ab7cdf47452144b94bbd94c7ac8851306df2441f2eeae980f
-
C:\Program Files\Cairo Shell\ManagedShell.Interop.dllFilesize
55KB
MD5a8ec6456bc656d2501185b60cb42460b
SHA1a7f6d3f3932221bbb232ae1c6507bce05bd36d61
SHA2561ab482781fd46cc440c412e28e9592fbab442e19294d0110e100014bb86ec4d6
SHA51256c9464357239b0ec2a16b5ee593cac1061e82315a9761d1777305ba9e136c9b173cb00e56effe6959d2a1ef226c7cd0d338b38bce1cc6be87028ada25dbee1a
-
C:\Program Files\Cairo Shell\ManagedShell.ShellFolders.dllFilesize
43KB
MD53d4da04bb9c02add14f49894cd095f9a
SHA1eee616e2bd25673ff9d050284724005644abbeac
SHA2568320eb9c8fa163e1422a96abfd98b1ca6173db7beb78d1952e335efcfc97eded
SHA5129f6b03ec83a1ca04d03b1c94cc9366400120eb9dfe6e3888a145e846918c01b5c401692dae416249e26e19589e3ba3eb5ec022c462dae425f3938d1d1e50e492
-
C:\Program Files\Cairo Shell\ManagedShell.WindowsTasks.dllFilesize
31KB
MD5572e3db2965b658a1869a5e5ab20da54
SHA1bdebd5aa2b3238f4f2ec65761e632a3c380f50aa
SHA256b3905b1aac03585361c04d021ba8ef71ca57030f778497d86fd8764c50f5f3b6
SHA5121c620212f31e828724c69bb7ede1809bc8dfe6f7f666d763b1b04b1ab828214fc41357d5c2e402fc3e17401c6a0fe3c42b90fb9b023b9c983dfc51b107979aa1
-
C:\Program Files\Cairo Shell\ManagedShell.WindowsTray.dllFilesize
36KB
MD553247a5aa6c2897d57414926ab2812d0
SHA17c18bb73095a054019ca616c16fec859971a2afe
SHA2567a8b285d93ebf68fc901a6ce9a8080887834f2e89bc8bbc7be31d2c187ddc282
SHA512bcbb3d794398feefdb9b7dcb60145a6572c468d49b0e2541a886e7a047ac2d58b40975e35844b9adb27687af15c8d8e744c0bf2626f7d283db61c7181b01d1ac
-
C:\Program Files\Cairo Shell\ManagedShell.dllFilesize
7KB
MD5ff24391856b3b3c1f920f36af40429f7
SHA126c19bff8c81535fb212df90cfd4fc80e283e040
SHA256667c5ff319ef13b89af1ba5660a4c2ebfc09b63dc272ae55453e331f4ba49d4a
SHA5122aeb7d847652b4a741614343d0fae8723c460153b914ffca0f8e90a3ae854369ccad325912de75a0f702c2a3a135f5879d11e12ed93025def71aa5072653aacf
-
C:\Program Files\Cairo Shell\Microsoft.Bcl.AsyncInterfaces.dllFilesize
21KB
MD548efe61d6ca3054309907b532d576d2a
SHA1f36403aabb16540c93fb35245ec0b4e435628aae
SHA256295af2142d9214f3fd84eafe4778dca119be7e0229f14b6ba8d5269c2f1e2e78
SHA512778e7c4675d8fde9e083230213d2efa19aa6924fe892ed74fa1ea2ec16743bb14b99b51856e75eaef632d57be7f36dd1bc7ce39a7c2b0435b2f3211bb19836a3
-
C:\Program Files\Cairo Shell\Microsoft.Extensions.Configuration.Abstractions.dllFilesize
24KB
MD5700a883d56bb05b55ae1a7e80f4187a5
SHA14957c67dcddc2a143d5fc9717516594d0d71d7c8
SHA2564891b08c0157568e97b003936391841fb08684e96339c9ab6e9b060c0b2cc46c
SHA512b61e0287c56b976a0cb0e1b354bded2dec15de05fdde89a63105ac59c04327d6f31403858e519a83014cd451b03cd6f1504a714c9f69f25c6b591cb362f395c6
-
C:\Program Files\Cairo Shell\Microsoft.Extensions.Configuration.Binder.dllFilesize
33KB
MD5244a31f1347f473a666e9029bd2cd8cd
SHA1c5581b7ee7b4aecc2dbe5c93df01613c2e95d765
SHA256ae8a3884e65a8a036b30f9fee071271090de347b9fe18f592716199194033480
SHA512fe8d7541a5235fd4be2073b54c32fc8b57ea417941a0e556da696efa4c0f63dd1ff99577ff1089fa677f1b741903f7db3a272506b4fe92ef36c5c719650ff798
-
C:\Program Files\Cairo Shell\Microsoft.Extensions.Configuration.CommandLine.dllFilesize
22KB
MD57bac24b985beb7db445e2c0f9ec408be
SHA1ebf47f78b19ea48972442661ed3dde438ca0ad59
SHA256f6c70d449e1f64f2f67ceefa9504b11fd3bbe11e3c302938a34e3d4e0a64ffe3
SHA5120f10da43c5d891fd1e5bbc8b1a8f2a1e489f817a8a55c9f43b7b394665ea2e2c591236951db5d094948354f64c7865ac06ee020367881e3ad28ff7e6642d0f76
-
C:\Program Files\Cairo Shell\Microsoft.Extensions.Configuration.FileExtensions.dllFilesize
25KB
MD5b8ddf2be0d46bef2ff86b5ce53e60e3e
SHA1d418af94ee80ac1615152d83d282582ffa86ba15
SHA256f8c75555c27ea00ab4e5827f8e5266031e5ac541df5a66f5e154ded253a5c000
SHA512d946e04cb989ccc8ba5544d4bae0370e36d2b1fce0186cc1f35ecdbb1934e48d8e19d1091e950e3fc2b2324870405aa19e198fadd2e7c99fff84b1a9c52adbb6
-
C:\Program Files\Cairo Shell\Microsoft.Extensions.Configuration.dllFilesize
35KB
MD520bcb7b7ff500617f7d6f83e24da4bf1
SHA1e0ebeef17de306248258f36b7c9c5ebc9039c47a
SHA25628c12f7523feae61f93b9a799bd9b1b6e7c0a41dacbad658e13b08098440c762
SHA512be63dd374c96181170d083321d9606eb34bd3c15677d8bdaa9fbf1a199f39487478a4a3f9cebf36a67332903c845940f97822bfc24194936b2b3057a11a59c12
-
C:\Program Files\Cairo Shell\Microsoft.Extensions.DependencyInjection.Abstractions.dllFilesize
46KB
MD5405bf969e7e50ef47422e54fa33605c8
SHA14f3c5c8803212719ee74c60813b9ae08604684b3
SHA25695a7c66abd60ba45a2020ac3d42702fd9823f7b6db2ceec6a37c9e9b0602fed1
SHA512d04978227453e3341fbdc6a8730da193f1c5e19a2635e02cb5d6eb6fef7c3ea53cf7df5df16230c12693cdaaccc90add812c5ad0a6ed0749e8de75c03602502a
-
C:\Program Files\Cairo Shell\Microsoft.Extensions.DependencyInjection.dllFilesize
82KB
MD5f2a9c263e730b94057d26d8e6562e342
SHA1e36e4c8100585db5c7dbd07ff66f4adad8ccd37f
SHA256d6de20035b25367a82da6180c45511d9077374c5f96f6cc5fedd2107d61efb9c
SHA512976fff499e641484a176801ca904221270220d07a1ffe14c03a9b3f32372a264ebe25e704dc63ec18f1bc2a430afa6a098847c327d695a3d19359422a300d4e9
-
C:\Program Files\Cairo Shell\Microsoft.Extensions.FileProviders.Abstractions.dllFilesize
20KB
MD569881b0560e8413fc8bbce8a1c3d2139
SHA1a7869818d674286d0edc59ed3badbec3ffa9fde0
SHA256090b71568672cc7a268618d5150cb237962a45a258d34e18088e0f7984317cca
SHA512fdc3e0fd52c19d2edd96fa3745c70c348e792f0ff17be05872aff4c89484e36de387d726eda6b4ee726bc21d6b8ab8bd653b0928016fd81e885bdea156204416
-
C:\Program Files\Cairo Shell\Microsoft.Extensions.FileProviders.Physical.dllFilesize
41KB
MD5336c05a49cd80d9b84f6279d50cb36c5
SHA197fc65b3320cd2f85042e8b680a76fd02b3dacb3
SHA256b00b024aed951ae739d0a32bdcc9fbb0a2c00063a21b74ea7cf8037db713ebd3
SHA5124f2edce62c926c951d72fc3ce970c949c7ea122edb37da6ccfd156b107551dc9fe198bf690e19b3e53df0e8b05b2bb5cba26a56dcbc0bc58cc977e3a93a68a93
-
C:\Program Files\Cairo Shell\Microsoft.Extensions.Hosting.Abstractions.dllFilesize
27KB
MD5dccc304c4c6f2c29a20bb9f41490cb8e
SHA19d0ca24bb87f3982272d49931aa53b8cdcf52ea7
SHA256a24b4efe56966c3376a14875454e43fcf735519a98b98efc6ff23b6f3ce81ac5
SHA512fe0f947e2d8346cba0723eabb2d66bcb4b98f86a1099549720cc2eb23b30f609c6445b1bc042e8b5d291493588826ed555b5da8ca813e0c693d594cfe4b482b9
-
C:\Program Files\Cairo Shell\Microsoft.Extensions.Hosting.dllFilesize
56KB
MD597df252d85fb10b05bd7accf8f12b2a7
SHA1df1a20467b56dbba7b36b2b0990fe6440397e64a
SHA2568e596ee436a9378811b68469843d16650e0e2e1436d12e71bbd80d08158e16f2
SHA51240d70f04527ebac2a8619c310af2d049f2815f4bb1d14e2ccf9dca201d2c681c2fc37ee628f131e221c30143bcb0c53dad82fa83bd11f677de9dc63c47cdd580
-
C:\Program Files\Cairo Shell\Microsoft.Extensions.Logging.Abstractions.dllFilesize
62KB
MD5fe77ef146f8474bfb1e5b6561ec0d1b6
SHA1555339e73b09ff9ed242c2dfd160aaeaa7324f6e
SHA2561c7331fa649f821e9384a3fc06fc07651d78c30e6809ffd34549628c6408a930
SHA5124b96dbf8e1f56d8136f346399ca40c3a8ceb6962d01d254d64c4cd598994cabcf90ca631d73a3713d699db1333e16547190ba5d0d1dc3dbdc126d2bf32a277cf
-
C:\Program Files\Cairo Shell\Microsoft.Extensions.Logging.dllFilesize
43KB
MD5d3cfeaa9d2058d998d07c43d7d06d05d
SHA1dcbe5d91b1926c9a48bf858011ada234754bc32f
SHA2564d1ca57435ba7d3193a1657cbda1c66ad39cf4f449a069332544f73ee2e779e4
SHA512dce2d7d816c3d9b1283c1e3b77e6397f1b6abf5791acfab1b329f8e5fd7150b4783ca9c5614581fa56e355443dee6332da40cbe0fab9cbe884b0cba0e781f3dc
-
C:\Program Files\Cairo Shell\Microsoft.Extensions.Options.ConfigurationExtensions.dllFilesize
22KB
MD5ce56feb81612037814a712844725a9bb
SHA14bfb7289451ecfe756738922af3a3ca18683e1ac
SHA25643f4bf9114f6bbbc70fb3399c2ee343d2e85a55963d18e2fc3f25a1a7ea1aed3
SHA512f4a59f2c0bed402f064fdace90757634245956dc105a236e1b0046e969f42a9c02cdc733de24398bf6e8605acd996a9968ae2942ad4d8a6483411ec6c8d967d0
-
C:\Program Files\Cairo Shell\Microsoft.Extensions.Options.dllFilesize
57KB
MD55049528911a59a6092392a28697af351
SHA1ac4eca8d761cb23fd716629a8e5c26020cf532e2
SHA256ac83168b7316e7b9f8e0806d3cce8030d2f41ad08caa085bfd4e877f5ae65827
SHA512c6073879dafcf98d39ea4b56a94e66aa9cd9492d81670904c1ffbfe8d709207d27e4c890f8ba379f65690060aaa99cdb65c6d4f1344dfb56045ffdb4abee1f87
-
C:\Program Files\Cairo Shell\Microsoft.Extensions.Primitives.dllFilesize
42KB
MD54360e5ddde76b62461762f72f85b1d79
SHA126f641b14e70ed7fc51e32590b65623ed2cdef6f
SHA25660df37bef5b47e822c02cf8547de3b2a836973e517efbaf090f14086d5155c9b
SHA5125b2b345f1468094f050d8ace375a13ef1c44f3c3e5a1644c7395a9518bed9e965b4b511d650299b1ff844d9062e342998245c7de308b5252b5c875b3ea4e97be
-
C:\Program Files\Cairo Shell\System.Buffers.dllFilesize
20KB
MD5ecdfe8ede869d2ccc6bf99981ea96400
SHA12f410a0396bc148ed533ad49b6415fb58dd4d641
SHA256accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
SHA5125fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
-
C:\Program Files\Cairo Shell\System.Diagnostics.DiagnosticSource.dllFilesize
162KB
MD55feb12f4d71c2edeedc693e876fef299
SHA1adedf5042aeae3a0482125c01ee4334b04c5e585
SHA25681e664880042e451495a1be22624ab4ab5e8a06803eeda5bdda7c69df2439815
SHA51206dbd0a560739f6b445b97ff2db77e12864709a025c556f07e762b1c4ea34554f09daf1caadd3bdf1b76ac30a44e532ca3bbbcad234eecec50a598d0803b6ed7
-
C:\Program Files\Cairo Shell\System.Memory.dllFilesize
137KB
MD56fb95a357a3f7e88ade5c1629e2801f8
SHA119bf79600b716523b5317b9a7b68760ae5d55741
SHA2568e76318e8b06692abf7dab1169d27d15557f7f0a34d36af6463eff0fe21213c7
SHA512293d8c709bc68d2c980a0df423741ce06d05ff757077e63986d34cb6459f9623a024d12ef35a280f50d3d516d98abe193213b9ca71bfde2a9fe8753b1a6de2f0
-
C:\Program Files\Cairo Shell\System.Runtime.CompilerServices.Unsafe.dllFilesize
17KB
MD5c610e828b54001574d86dd2ed730e392
SHA1180a7baafbc820a838bbaca434032d9d33cceebe
SHA25637768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
SHA512441610d2b9f841d25494d7c82222d07e1d443b0da07f0cf735c25ec82f6cce99a3f3236872aec38cc4df779e615d22469666066ccefed7fe75982eefada46396
-
C:\Program Files\Cairo Shell\System.Threading.Tasks.Extensions.dllFilesize
25KB
MD5e1e9d7d46e5cd9525c5927dc98d9ecc7
SHA12242627282f9e07e37b274ea36fac2d3cd9c9110
SHA2564f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
SHA512da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11
-
C:\Program Files\Cairo Shell\WinSparkle.dllFilesize
2.2MB
MD59b21b3de80d5934fa648e981f57bf6f8
SHA178f7d30eaf10af802398c48f2c62bcd8e8583946
SHA256d51cc319cbd735a5a21636e1b0f9dc9545435cd1e4ab360fce5dac2e34c38b63
SHA512436f9316cbf2cb081e97e12bfc4b78e60ec594a6a4f5b4ed8593ab228b54ba8d7595ebf8497d78494022425141ac67c71ce88c01c7f03ad0b1b4fbf11b80a695
-
C:\Program Files\Cairo Shell\WinSparkle.dllFilesize
2.2MB
MD59b21b3de80d5934fa648e981f57bf6f8
SHA178f7d30eaf10af802398c48f2c62bcd8e8583946
SHA256d51cc319cbd735a5a21636e1b0f9dc9545435cd1e4ab360fce5dac2e34c38b63
SHA512436f9316cbf2cb081e97e12bfc4b78e60ec594a6a4f5b4ed8593ab228b54ba8d7595ebf8497d78494022425141ac67c71ce88c01c7f03ad0b1b4fbf11b80a695
-
C:\Users\Admin\AppData\Local\Cairo_Development_Team\CairoDesktop.exe_Url_1xk1diablde0yx3u1m2ylt1tezc2aobn\0.4.245.61259\dv0ftwlk.newcfgFilesize
1KB
MD56c99b52a93c4a05f30ec2b426ebbe8a0
SHA13d1192fab7ea7499b1a4e5fa4688a028190856e0
SHA256c926e92546cd42a8c068b6ac65052e07d603f4dce80ba727b7ed79887c399142
SHA512d27d5666e2b2ef6de0e6c8e279adf5796157a89c99ed9d565ce75b443f531440d756c1a1cedfe61a519e9c9c54f3a7589d25e8465d23e3a35dea68b0ddc8e79a
-
C:\Users\Admin\AppData\Local\Cairo_Development_Team\CairoDesktop.exe_Url_1xk1diablde0yx3u1m2ylt1tezc2aobn\0.4.245.61259\jle1hvpf.newcfgFilesize
1006B
MD5cce999da65e5aa8bac629d072b2e04e6
SHA172823f7c7b885ca3ca32db02cdc83de7c66875fe
SHA256199ab7e6bf57ff5436e7a1d8fe04b71b3ce905677f012038cbc9362ac473164a
SHA512942a03655fa63557f1cdbe4f95c65ad712ebe012d03a32406e8f240028a0da0d82226dda9cc1a2f547c872378c4a455d55a7c951caa97db18e212396b5a8608b
-
C:\Users\Admin\AppData\Local\Cairo_Development_Team\CairoDesktop.exe_Url_1xk1diablde0yx3u1m2ylt1tezc2aobn\0.4.245.61259\user.configFilesize
884B
MD529b4d256ae1225e34597fc6c2c7ee915
SHA1ffc3bf706c1aa5e833f19dbc494a0eee9cb39854
SHA25681aa3a7e7e26e5e63f9b66495918b79c37766af1ad43a74facf076c444bfb2d9
SHA5120f9424cae30d9615109dbbc171d6f71797a9abe00478c70d621198d41d3bc00bef036882617d35813add89c7b141c31559a42982e3e824351415da113be9d654
-
C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfmFilesize
16KB
MD52264de3f23fdabf507253b37d708558e
SHA1c380a379ba6e05647f361d199d417a978e7b4869
SHA256872202c2c45c2084ffaa4fc6846192e3770adb6b1078c12cea4bee35d7bbbe29
SHA512fa67138b6932d6d9c5507590f3d94ca9c73188403200899320e5a2e5940d417ddc254109e3aee636038051b665e4c08067ea94681fd0adca83011b097d89ce01
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0342a269-4c10-4a67-ba26-e35c5f5545e3.tmpFilesize
13KB
MD5a5d2d188a3dddbb05f823d2293bb3cf7
SHA17e9346dea04a973db147376f363d50728a36eca3
SHA25661b8c78a005beda3d58f75684a4e8d35d647d30739e8442bebc8e4190ee6c92c
SHA51281c6844037a63be42e6713659ba155af2d56c071c118b927beace427b65d99cdcb232fefab96bf94db28f48fe5be7874bbc56371b87b4540fcb1d594594aaab4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\422fa12e-252c-4b62-aae0-74e621d0c539.tmpFilesize
13KB
MD5f7935d91dac91412e7f9164d46fdd2af
SHA1e894472cdf71234d0a7622d3a100056045888f4f
SHA256b82728a27cbe03fdafc72fe8ba477980fdb56378c87eb09f435de6d47af35e83
SHA5129dcb8bf557c70f3413ca2381c5e9d95d5fe61598f0c645025e2ce7438c95dd9fc7d355ff8846f78cb911e5b6bc53873a40de567cf1e179f7b789bab88d361f4f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5425e83cc5a7b1f8edfbec7d986058b01
SHA1432a90a25e714c618ff30631d9fdbe3606b0d0df
SHA256060a2e5f65b8f3b79a8d4a0c54b877cfe032f558beb0888d6f810aaeef8579bd
SHA5124bf074de60e7849ade26119ef778fe67ea47691efff45f3d5e0b25de2d06fcc6f95a2cfcdbed85759a5c078bb371fe57de725babda2f44290b4dc42d7b6001af
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5dbbd4facee0ebb8ffef2e15c3d828955
SHA10243d808ccb1a903ae5b9d33ec22ed171605506d
SHA256285ddb385f00a7922dba445d623b9defc5b7e7f4b3558e86e2f8c1889f776bf8
SHA51290b75e4203d0167a4dbc93eebc253e96c77f00503adfa683ed93e902c3516688ee4654cc0f23c45ebc2f8562d728e71022ea8d09389a1a788a1199fc3688cca5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD539e045d1f1234fce7446d74ca1a45ce0
SHA19a64d20ae49284c5e96f68505d31785c4acb8582
SHA2565ba3d650ae1450c84f31b821f87da7e20d1cf5a2472d47536ce2b7a3b8fe8579
SHA512a56799c21e93a89b71ca056646cd1c5640d043d3bdd570a8dd4223b01b9818668616c366932db4c6d4de4d9c4739c92f5c32387a0bd30c7caff62c7bb7641b67
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD581d5461a25d614f0f5de382e8327eb61
SHA16ef2dd64a5384668d1765ef045679ea2e5012e26
SHA256768643bdc9f9d365d908b8d319f180395ea13e926f0885bb08db38a6ecf3a238
SHA5122a156d3fd812e463c4dc40a16cb4e8ca97f732684415a15e92e38289f54cbe18ad95bf56b78732aca5507ef20dfbae498ea8ed0196095f0ee3ab4325d825f294
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD59ad9f0f25d03e7fa26b24705a551bfde
SHA1098f47475c72c7e1abe243a2c793ee1e905d4c56
SHA2567adc2051ac03ab0108714db2a39c7e128fef97d8a00772a898b5351f2cb1eee0
SHA512e954f4afbec95964266b2265197616dfe68d57065e6843b4d1a1de27ba442f9b0d96ea06e790228ef1e2ba84738e0ec2b53cf1e0e7b60fe800dc13328715fadf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5fea0a0814bc43891edce267eb2581328
SHA1f8589df7ef4d9a1ebbce1acc67fd9d2dc7f55275
SHA256d4e18bff8bb6a28672753fc11f9df590e26fba6991171af75c2e392c6bae6b95
SHA512dcf7581ca2a9e72bcae6ad563788dd7f1e89698c9516921b7005df994b16c2046ddba4c1634e767ebec59dbe74890838d1cf3d27bce5b815ae711d69e68b57af
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD541ed41f5fefc320c7c07a7d145fbcf73
SHA17ccfbbe194d17af79facabd4e9780b9d87d9916f
SHA256f2747afd33052487fe7cea058dd60c44f6ff0f75c9ca7d617b73c4c2b0a4264b
SHA512e78382aab0cc3c0668d4ab06c3891f685fcad35ce6557b437d9a992564b21c1b53fbae20a0a8237c5d02f8a6e980e14940f2bf80559697b5a908bd22cfebf4b6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5299f57b2926c23407c1b5bd2e005b781
SHA1cceca2ad1d36021f6cb4609fa90225a7ad8d9325
SHA25654ed2ba3f7cbcbc9f2f2c1885eb6b9a12b2c51961a5d56834049ad5963ff577c
SHA512cd9d0c533f720a7fcca40ebfebd1e48b906f30f04b382cd098cbdf5057b58e0f34f8ec30b139841776d99fa5e2460fda9de7ed4093b74554b8dc75b5d065f3de
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5df474d767485075530b5d1802b95d79d
SHA17d0db24dafb77c0383d043b5308cec0c5bf63932
SHA2568b7c7e7e0f5f1c6b2bf17d4fcaee4a487610732567ab377c53fd3bf047076b42
SHA512ed642a555b00b650b3c8ffeff68ba1724e50719c12c2875bc6c543dae633d0aef74babe91ea9d8334844e51148121fe8e980f0e3ae987e0a98c42c748dfe2b2e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD512f31de0f5c389977de14cc3047c9f5e
SHA1ec0148fdb2785ad2466c668c70e632745ce42088
SHA256b3beb6c071c49ccf365eff329be46df84e0b9aaa97dc001697eaf8a5413afc03
SHA51237b045fa64e5f190ab9cc9843566c911a06c3dfad01b4ca1c08fdcff2c7c090f82bd81e97c801461a5e3796e3a257e5498784f8957f18e59bebe7458e8e2c363
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5464ab787cbf2fe06c39ec435d71c92a2
SHA1f0b18c9fd8d7c694af48296cf3e463dd7aa71a05
SHA2562b52fcdfbe0a9761fdef310d09160fd1254b74e5c1f4abbd9d6c2f53f193b364
SHA512b2b693a41d7e3b9b21467228ac953de66f2a79655e4c1b84d98bd6e8bc4ac13c4782fb66e3d4661564e48feb94ae652df4f51ae0d9aee32e4657c44848e2a1a6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD50820611471c1bb55fa7be7430c7c6329
SHA15ce7a9712722684223aced2522764c1e3a43fbb9
SHA256f00d04749a374843bd118b41f669f8b0a20d76526c34b554c3ccac5ebd2f4f75
SHA51277ea022b4265f3962f5e07a0a790f428c885da0cc11be0975285ce0eee4a2eec0a7cda9ea8f366dc2a946679b5dd927c5f94b527de6515856b68b8d08e435148
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54235e5927eedad27bd03b88e045d2e7a
SHA1a56f5b92639a9c3088bb53d787330dde81f4676f
SHA25624427b0b84b2771ee9a0a43a4a3c8b08d93335d5759971a4e5df877a218d2715
SHA5126fa023972e01312297fa8fdf6ab9f810a39ba4e9b13d2dae948fb75617ecfc4e3a0db23c2f175df8608bcb46526c5db3af56d8789ec36c3bb782d5bbb347a60b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3ba71e71-8fdf-4703-b78d-4675a59e66df.tmpFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\531adf5c-1b83-4b2c-b685-3a82d762e2f5.tmpFilesize
11KB
MD524ccced8030077cd988e33b68693463f
SHA1a66a819762b8dc71db63d03bc6f2e7a46c8c9d69
SHA25639ca62590835d0cba1152ffca21bae017739e012796c4239d6a9a41677834433
SHA5127370a9e4c05706c5b77dba6ae1597bab01dd0c3477b4645ac541d2a6b5565f972dbbb57c56d83fd584078e2f0568b1643f62662508ceca1af633a5356badbd17
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9cb1af48-8bac-427d-aad9-9cc30fec0b36.tmpFilesize
9KB
MD5ad4a42920feff93b06b0fc52070e282b
SHA1ccf55905b4eb68fec9f55fa4cd3a3327851a2ad8
SHA256771c71e5e5ae651fe726c2491ede93a8f399ada9f81d2e13816dc5cf2b4773fb
SHA5125400b135b7d9fb45a3dfc5b01a6b0f7bb821fa785b4eeb03a83476ec93d4d5eb40e1389ead82eb347f7588ff38c327ec517b33b8200ae43e7cddee01a224ed16
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003eFilesize
23KB
MD531a9096920f752e69039437c0d357344
SHA1eefcff8ff003997c860a067570cef402c7791ff6
SHA25619c59baec229ba73378652688780cfe5f3afe258e05ab2a2d86b79158aa3e2f3
SHA5126af42591d25ddf7ec74b860d8739a725e88ee77ca02bb6cb5eb10e35804d726dafc7d1830f433d11c8fa39840f2cebbd8c06d994b019e122fa6ffbaa30016566
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000052Filesize
35KB
MD5b77b1e7c741f969a23c142cadb7016fa
SHA173032453e733ce5c1f0a4e21ae91e98b54f87eda
SHA256b0cf7ba3192b84c2d73004064ca3083817ed582946342e45dfb87be633377d7f
SHA512970c3bcdcd713fb45a3b6499faf8656e3173e0162ec7ec592a6702415cc1bd39bb99bc8fa757fb14e828e306bff37f2ad351d94f8281c3cd9875581b22763306
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000068Filesize
76KB
MD5c262cb2ba5deffdd0b93302d0445ed83
SHA1cc9815a13140df89437cd03fa765bf7c9fe15f96
SHA256b3410e9771bf8f07083c8d8dd0ae060d796f3160a5ac40ec9fc7b56f2a544229
SHA5122d9891544e06eaa8f37dd2a699cdd9898958484077bd5af879843598045b8f6048f35773c4cdb2fc9b29d07bcb7371d055343ce97e780d31bcf4980e27d231ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006aFilesize
84KB
MD5dd2659958f8be1dbc8384c391b80bf64
SHA124d3ac2c45a80feac5dacf2ffc57a76de59f90ab
SHA25659e513efab1bf2626824ec2ac6272fb1bf99c42cb25cfc175c223c90ac343072
SHA51239546a0781b78c55600bfbfb08f57893950a10c44d27ab7c8b351afefbb3d79ae8dc6ca0fd0e13e408436b454bb5a6acea05f541f52a7785f427a5a2b9abc00a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006bFilesize
49KB
MD5b4a6d80b0d836f8880099b8801456cfb
SHA1a4c61212f48a6878a893fcc37dfecef4e201ed75
SHA256257ebd488db44f1350ab53c132e0a7457ad4bdf16617b2cbd3b5e8e8d471c739
SHA512b8db6344123eeb1eef28d51af2678fc9391ed15576730b9ce06fe6cba5a20bf1c575d36003a4f2080e193c60f64e2e7a2cda613ffa23ae31269fdd2b18f0f63c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006cFilesize
276KB
MD5892fca137c9ec908331e95c3294e8b53
SHA1d77b42b27326fef34b4da9c25a71e7b4a2cb95de
SHA2561b61280d268bd90b04c320f6fbc38d6981b8db37a320e24e230c2a073bba18a2
SHA51258bc3607adc40041386694ecaff1f51694b58e25da7bd5ec04a73f10c4fcb701cc236c57bd40a0f1dd90af357784d949f7483696bd8281f5283a071cae322e56
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006dFilesize
27KB
MD53ceba565d70fdd9d53470d803ff2afce
SHA1ea846ef303b6e045a1e1e16ebc7522ec94ef1015
SHA2568322713ea6cdd32805aac9d42002770e48277993d3d7ca523ca783cda9d2bab0
SHA512cc301f1f9b4caa173380f8090c17540d8db03618be00436b4bf3a8a5975e77a8a25db15366b24a61f7997dcd43357c0cacfab78319da7e7c76da32961420f8be
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000070Filesize
23KB
MD54a6b3ec6f1f98149cbeb6acbb693a371
SHA13a17cecde55c2d42480d977a7116e399fc1bb025
SHA256155ff3d778cceee8eb0059fce58d453b3fdeb9c7cafaddaf3f86c18df4e44ed4
SHA5124c5de05aa888c487dbca81448b09b1a9d0049088166e83ec0d2fd0020b2c33c119529e638728d9afb2bad7037378effbd9d4c13fcd7b09b81eca7982e48f1a22
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000079Filesize
19KB
MD547dd8db4bf13bcc9b815683ef518f975
SHA1656a7bbdd7a4c452fc6258f78215418cf5031335
SHA256732cc8291392ce2ee1554687a7fa01dff8de2a9104808dc8db3654fc6c43a1f4
SHA51280ddb326abc7b1cd174ea29a7c2bcde4e3694eed882c45a34a53583efbb93984ac19a6fb1046830d5c40b0605bf9c3d2860d788aeaffc0b19a80e06621cd682e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000b9Filesize
334KB
MD51abe2677a7987993b82e5647a227d41f
SHA10ca187449a75002e7407fa37f222d0571b3f4a96
SHA256b014066129d5b743092411ec86cf68a4c1bcb04f733783e0a57326516dd83fa9
SHA512c1e783214b2e68895b42660dd79c22731a82475577c925fefbc27769a69ec095ae9eafe46096826d325ef3aabd9f2529a7bedd9d9c7065427e8b5bd188466278
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
48B
MD5bb2f179a1177949bc87f682058162a2f
SHA1222bcafd77e298a621677692ed8e0f15f8727d83
SHA2569cefb999722bb9ee06d94a660ac0120c452d1d6d6b369fcaac91f2cc4b20d3dd
SHA5129ae86a2762aa888d4cb0f290b2a0fde8c5af0a3dc6b1f98d6e10095154e18142aeca790b44165d0ee1b44d094619739ead757cf1f98b4dc5a436fee0dfa2e7e7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1KB
MD509bc5583d806487e384992157860b7b6
SHA1737275fba13721ce61260725d3c2dbe5480be73b
SHA2561abe2f1ed92eb86212893db276d6c72d0dd2c74b00074f5c43246b3fa23271f6
SHA512852d26ae736d034d4cd3dcfe2eb05b66d518bd89779197310fbb2df6d8bdeed3f904663c5cbb00e8133a883cccdc707002170929d1ce54adb1f21a9de613d9e6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
2KB
MD5a6d07be81fea302efc2f6469fde8abcc
SHA103ba8b775fa1c1002a96f74aca0a001de1f8f568
SHA2569b2f4ccdc75b7bef0778c96830c292e860ac3f798096ad3eeb3ff457b48ed473
SHA5121e2d4405160ce402bccfd4833273f18822736d4cde455ce9e2483a6c7734907b2c6ce28191c6fd5c9841cebbf95ce218f37927091ce881c691e6e697093eb3ab
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
2KB
MD588993a5939eb7c9be35eae1d4dc5ecc0
SHA1f721fbaeb1c0639039fcc6c4d778697547dfc116
SHA2567cedfd4404ac45be8c195eb56442eef65f90e36f608501f6333e97e0735deda2
SHA512595deb696f94e91729547040afcf49575962f7615211380ff5b5ce6e95a48d3ef3438a2614d3ce72932a25078f886a5af099dba56728399206499e9e6bccbd6c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
2KB
MD552cfd8691cc7e60a767df8b5f04b7f54
SHA1c3ff526f01233ee4eacb04515b1b0b4916e23d86
SHA256c2415b4195ab59dcbcf25e0f3e95a457a1ed66b7cf9e48618a85549c177b0eb1
SHA5121918f7d32a473ad26e3a03fd9ffa8351b058ff1020ab0c61f9ce828def2b3d3293e7aecb85d176245aa16e1acfa7acfc0c91d65959b158aaab76d35d0a817f8a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
2KB
MD501876cd1af81a88f1dc1d5fe8b28e09f
SHA1b300904d809e428bc99df6f8a3513531071b3408
SHA25622bfc5a8e8de32c7ac95fdc70701a011bfb83c05df6ef9fc5aa6b216e8fc07dd
SHA512c85494222c7476e3c30e35d2d269baf0a4cb936d1f123a5ebf0b442b68827151ca9a07ff15a11a95f2b1d55c1d3509b48e686d94677f56412dc699c2e7fe5b8a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
2KB
MD56017bcbb63f3f6f5c5e3a1f8f542c6e6
SHA104846ce17d9e6042c80136d5e0886203e33b10ed
SHA256b94dde14525f984cfe4044267ada55643dd5d12dde3c6fa9ad78d1d701dad738
SHA51240107cbca0c83aa6c501a798e1867140c31beeaa3b45ce1ee165e0c3ec1b0065366d927f88aa829650ce990d253920b9de05ff95f575d07310531fa339824da6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
2KB
MD5397d8f44817ca3a839a71c60c173a38d
SHA1ab3cdc9117732aecfce6c39253cfc59414e160d8
SHA256d4af1b8374eb0bd59fcad316ee95c32e91df4169e88ec47f33bb35e610933524
SHA51226f58d9c397c25eaebd888c4fcb96d4fb5942b682b2fb39526d6a3a70cd443d81d4d4dbbfae9b0aecea9dddcfcbebd04b1174804b8c14bab65dbf65e87a549a5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
2KB
MD59e6a39ffa9b61696fe7100150c529bd1
SHA1c26c1edb6b9d0b3ec26e4d3234038f4037d7f243
SHA256ad500a83e89917642fe254fbe954628c9eb2b416d852ae621acb52e9f546b5dc
SHA5127ac644a0d082f0e0cc4bfcf094945a90a2f41eb01adf274b5b1024f6b7e44e45359a75902c7d46508f30af0cb570510eb392b9c0042aae4dc2e419320d60328d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.icoFilesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnkFilesize
2KB
MD533aa189a434fc5d0a3fc43293dfe5caa
SHA15be81a42ad59781861b54bee015598ed98dd892f
SHA2560abeb24d6b1a004cc1dac1a2287d2e08da0700febbca3dcff449cedc77908210
SHA51211a1ca42f78f087fc62376a9e147b7b89c2ca65a45db0035f0286e5da4d970a63109cda0c7cb8bc85516d61c1d20f00cdc78fd505cf9df7975f1d383fd664007
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
2KB
MD5dc45f8d212a257dc4d6b37e914b7d9cb
SHA109b6b6ea618fd79f7d54cb94b178bdbd2e764c1c
SHA2568e328f0da96f35d3566c66f8044bd705cb525b4afc7419243eed9fa83a566785
SHA512d8ac6801496f5d47d29321789aaea8924cabeb1c4157b066db445d231ea44da0ddbd3823b359f650007b454d9bb7a8594f70b15f0fb09e66112663fef1394308
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
4KB
MD56a63bd4bb4e62b865a62ea3057707108
SHA1807c697e195e8e5d123d5145bb375dbfc8eecf2b
SHA256a1356c968c27ced1198c385c2bc1313183014ddd4080802cf534cc5d6e3b4e01
SHA512b6ee34a79ed5d5e50a8f34ac0af4b45781faec232aa79fe168d1b5aea9cc8f4872efa9fb059590153d2c79266e49e665ea8f99ac5bfb7d77f61764682a47bb23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
5KB
MD588517322021895c4699bdfa6157c1bbf
SHA1486a5b8185e779bd69ed367d051586bb5af02291
SHA25641f34907629346ea000d1f63f0b87a3f71563526e41c245dbf9b3cc2c3df57c3
SHA5124cb4affdce8f09c9e2dcf04f303ced62eaacde4338690f51a443aaf73b76bc19b3b50300a326b819df626fd9378d71e7772b2815d258b99f143560a0e7918560
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
180B
MD500a455d9d155394bfb4b52258c97c5e5
SHA12761d0c955353e1982a588a3df78f2744cfaa9df
SHA25645a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed
SHA5129553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
2KB
MD5f556dcf0773dc70953b5db202cd40dd6
SHA1f56bc6999ab80951c4d722a44dc5f9a8598724dd
SHA256579228b33ed2d8c8fffdc847de155e78d258864a99987faa5e8bdca1e579f7e2
SHA5122ac4a11a30206f89d342905cf8316b663762a68bf31fbba50dec1508ef4447cf5e2a5224477c705564d0e09fe8d50c50f06b988cf96b0033a76beb1a99d8c079
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
5KB
MD56229656e0694ab4d1ad460905bf7be99
SHA11a70fedc43f36fe9807060cc8dd9c2bcb839f4e6
SHA256e4dd93d65718f5b739e335a801d2c9b9cd074e0642b52879ddf2d462ccf998a2
SHA5125a8244c35c90dc9737e83b042e2eadd5990f9a45b85ba24ac8551204bdd8dc6102e8e74dc651255d41816f895e44a45b019d077c2024221c9d96c8a98c633288
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
3KB
MD559421f55f7f6fb4fd442f518c397b26a
SHA12de755d8d5c686e225cfe3ca64c402db9598dace
SHA25605e24a8faae423df37952daec54df2d64f5954aef287762fe9cb6efa0a71793d
SHA5124bb3ca3de8cd57ed0ff32004ab957780ffd9559dbdc120741354474c58632f7e8d45c908f70f30382e5d5dcbef7e572ab47a3df837c8c740c25d41c1febd9117
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD593c52b2f3e03d969761e9321fc3b0019
SHA10ba73083c2ae3b8e9826eb5537c8138ac638713b
SHA256a08f01053e6dc964f6a9780f6a5049082dbaa259ece57013e7e5e957c84dff2c
SHA512e1ddeb377a69ed23de82116e4636188d48f524b9c5bc48d8da6df3c4340fc0b6531811f0723fb1ffbed0f2cca1879ca0571f7adde9913debe7165fc756c4f3fb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
4KB
MD5bd17beb729446ac2f2186a708d89d909
SHA15c712ab8a88baba9a8d7deb6e620f2ff625906f4
SHA256eb6b3d36fbe83145038e02dc996a93459bffe99aa423a802a095df44e3c4a5e0
SHA512012d229daa2f8569441716a92f44b852255a03a68adf81274dc05d74fd7cb2578caead9db66c571349944126225f17d22b9ea41a96e1fa0a6f09727a91fe5915
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5abd7da7e25b23407c6f3741298517f4a
SHA17443ca169c2d6a2ca56a6b35a31927b93d89b181
SHA25686802758d472384d1a4370f9c4699d9cb10c63e712ec9c0a75deac3ae1bdae1b
SHA512df36a950827f9a1b0ee1fd421e7f3730c6157c4a470a65b68df837e71f9dacd8bbb2eb975e339b0916607c028779e18c74649e33ac5cacdc58e5375573519dd4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5c6c2eca32c2bf1da9a79d182812e7dfe
SHA1f3eb6ba5f1845d6c561bb7d2c86e1d985c60ea22
SHA25616de03c1d23a2215f4a79d63c622a2ddb79b8dac558c0d53ad722086b4c5bb8b
SHA512025558c0614b8b4de0887cd6aeee4ad62af27a2518d1808e0172ffe51f507b7ef9cc41f4671f4708ceafec5b2751c5831e58577381e86a9004e8833b358b18f6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD53d46655987a1360c3329d37ce710beb3
SHA1f48280dc0344780d53777aec528d17eb05c37072
SHA256c7adcc129e10ef4dac1ca5cdbbc95dfb652bcccb5784d410061ed7f979db9d2f
SHA512212b330ea852afaeeed4fec2a95c8759b7197d4707878d4f4eed03296b6a44f8a2bf7a3574ac13838c5ba406e04f13a37400342a195b6c323875e3109b1ff2b8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5853d698c14e56b36f6d00b8ea329b464
SHA1d957ecb4c1ff966be2efebc37f900997183af54c
SHA25635464f8f204a068805adf4f48534e53a3bbf9c8810ca9ce804818727be543170
SHA5126fed86f8b47b6ee80f787ef9671ac02e8bef8de8cc009e5d35f05644fdf329c7e7a01230be9c9a5060199efa45067a639aab2cb6b888b521654850ba0e4b4c0f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD553c79c50aa413a9a45549815fb0a7d2e
SHA1e30dcc9736641208f768889854cbe268260091c4
SHA2566a32b1d4ca34a27d461d4651cdbf25c4c9881bab55e405ffb728eb5a16433861
SHA5127c013811dbf72f5a016809377db589711e93f4a0666460811e06f02c496d70526d7c52475ba1f43b994e2370c30570345036234d766b34bdf6f6027b2d2774f9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5f6ee746f33e521b9f836b04ee4758da2
SHA1f69e8b9b48d2d9ea89c670247320fc0acd8091e5
SHA256cad9dddba6f390a14d9f70b0068d6f59963e5b1d82c4aae7f84e6c125384bf7d
SHA512d2780927d241d0784f0e984e2d73cee34aa851c27f2fe479bdfdd18b10a69d6af0cbca57d67a4c74e30ff97b30c0dc7e0d207c67f359e6f6b7028146d3fb18bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD594687f66595abeb391164a5bdff5a6c2
SHA1d8d943a142eb7671e289b48f67ffcb960e8ee76d
SHA2568ac978637c957a0642c1acc6d13095c162ff8751fcd928688feda77d819923b6
SHA5120a732adaabc6f0773dfe2d8526793a81b87dffbcfcf73dcb33868a412ad93802553de6fb7570dc8e86fdd38f1feb8260bac2354ca9ce4f8e64b3224a468d4469
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
8KB
MD5c12d5975e00339867f771eb818faada2
SHA1669f4a04c8b21c4cdaa30dad38325560c88c1f59
SHA25680580c0e5c8c57ce45b193038a83a965c0e7c8d496d78c6d115a736831419bfe
SHA512d51ff9b8ec7449f003812130c24b1e0d7d64d0c02f60e6f2e0f25985307aa916eb8411a7b97ecc05ecd982a5dc629aeb2ca62a65c2c4066900aaf586936f4cf9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
9KB
MD5328aac58963bdc3e018f3378c67a50a9
SHA166ac3b13a3e5fb6bea7f24f553fec4ef1ae718b8
SHA2568669fa6e804aef5de94a306363e0e24cb3a24918dd6a67039d4b0ef4977b3b90
SHA5121e4337f002737c44d9510243b8fd1c8e215afa4ea26d98c79bab286e1cd60b7d366b8bf3ed03c0b9b32c0a7ea6d6c41e9e6e977b313b01c676ecfe81851e89e8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
9KB
MD59185a69d2d917ed46055495e0d047956
SHA1fcec6e69f9c11539ea9f96dffcc3e3b585f45275
SHA25661a73d6a4b150ddcb8430dd9e9e2972db7b2fa346255650837a73a375414caa8
SHA51231e6c441cdea21ded2a485a6d07453c47b80e84b7634d1c893eb7ff7866fb6003da01d8d3049da6b656360b78b323292411dd7f635ed2b9d95a3520eb380fca9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
11KB
MD5c9653edaf8315c4fa57577920a28acb4
SHA1bb691342c77828f3f1fb3b38bfa6ffd947c3d3d0
SHA256e0cfc993f914c094caaf4c68d4a12819420f3356af3ed6da73199af43409315c
SHA5122e6e1fc3b81ce64cc9f22ad9e2c7d0b56ea7a7978cb13b7d961c771a2065bb54178684d174fe7356000fad990d7d074c2eb5c0e8c54b9646a8eb62fcde21b939
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
11KB
MD5757ceacfd00b8a3ddeb96e55b81ffcfa
SHA188715f1b9a75c56205c8852c9aba26907059972e
SHA2561c2bcd3ebb546cc592f31ac06d88d6255ffcfa1cfd58aeecc240e29aa3c54a7d
SHA512507f1a269c112538004840976b098384ddf309f889e7e9aac895f8daaa497cd87e7dbba05de5d5addd55ff80381e5c89cf76719fd1ff63f5bef83b15797f0da8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
11KB
MD58f5270a444e914a932fa4a9fd0a79559
SHA1e3542f7306d4ce2846bb3e52d9ebad6e56bd8e72
SHA2565e0e45265c09029ce309e5652767f057aba66b5fa9f6dceeb70da6c8c97fd4e4
SHA512b7dcf5c68170177dca5c790736f1465148668748069972bcd4378640c75464809691fdbe2eded15fcf5c82b0c2fbd115f573bc37a88d048aa56a3e3f524a363e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
11KB
MD599bac9af007acc2ccbb3e83f439d3fff
SHA129f4a2fb53aae447a01e3c81834056929d982627
SHA256df3988e56f7a1535a0850bc764c8e5011fc118699ed01ae9bdcfa97aa6939828
SHA51237e5c22004009183c227d4fa1e527a483897288b255f4a92f10d439d7c798c9aebe48bea854262a10d2d90a048d252c41419c211fd176c00b83831a13a9e54c9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD500bedeb82b4dc29e4201d34b5161ab98
SHA1388b1fc3ddcde1265510759843b508287842f060
SHA256a2775ce0803825c0b0c3f95bc3430a8df19ceff0fe64753986a0da535401b992
SHA512bbe0baa0440bc0c23c5c144e7dae3dccd135f7a10ee6aca39c451a81f9488dd9b68ae41ffb52ffd318a793e9728470c59eb75b2f9d1241e5ec1e57a1c235bbda
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD52141b9330280e6ef12e2b505b0886574
SHA188375beb9bebb7a33472ab73819ac6b8172f45e8
SHA256de399235528bf5be49a35d9a42fa51c2cfb77e1c96b2c65146fd26e53b6f50f2
SHA5123bc605c4009c1b805affc3aa6f1a825ffa1b666abd8ca3a0c5d34b3cad5874f108d1b41540efa9d40bfadf58fa38481c7142292cb364f1e815771b1f2fcefbcd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
9KB
MD56578603a7c152e4f51dd1317525ae062
SHA106772d1aa1fb93fd9c105fd7d80b03e5ade0b01e
SHA2560bcaa145915345e96013075aacba0e323ee65311e795a7027e3102d02983182f
SHA5128260ef7aba3c5fef11aae07499108e37db9ccf8d07567b15c1376b2f69da6838b24d2c3016891db805c4151599156a05f1e28f13977101623d00f8bd5b3fd972
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
9KB
MD5c0b02237f7279d64d3313bfad8a27ef0
SHA1648c01983edf5c83450477a97ebc4982df50ab65
SHA256a5bc6755eb1e8ea1b59f15e645391e19b573b9b62fca07ad4e71837a3a43fd1f
SHA5120e5688717c5918ad3fc33dbfa12272ec87132bd29130691881c7969c413cb4f33c112c999c3f9869ca328172aa0c388fbf154e1f0ab787bda6a72a013ce21030
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
9KB
MD5723cb2d43257ebc20371a597d2ec7b32
SHA128243f42a95b99472008658194aa96aa0b473254
SHA256b5e13afd198a3640284b29efaccc877f051d9d5035dca405e300bd80ed600d96
SHA512c2bfedb10d458ce26419970e5356bb93712991b74bfcc80a9924142ac952279c30fdc22fafddf8b79c69cb7d6b04c469990c4365adf798e1e65b6692afd43f08
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
11KB
MD5f3d8055f447f17a809576d6228d6936e
SHA10830d65754b787a936e291789b1751052cb282ec
SHA25680723429b3efb8838471fee5acb4b591b5273c65ef94fbebca9a769f9f1af6a4
SHA512bd4c8a7090228183e9879cb97ce679b74591a271005604433ff03630eefc1a6e1da7a9699fdb636dc2a95d774335f1b639cf51c35d9d5c47a9fd6cd032dedb29
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
11KB
MD5e53b05d5dd8f761a4f7fdde12c5d5f70
SHA1623a7941a033c92f506fdda63d8a75b2c349f496
SHA25607be97f28b2fffdbb6e1e1ec59fd864b6fa09232176156d1521fec50d2dd1d07
SHA512f65d7c5ae3c94839737c029b783404f0fcb9c53f859c95eb8167f7167903e20e8368a475b2757cf8216ca519c7ddd3116f2299bade36d3d6dfbea3005ab6b761
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
11KB
MD56fc806fbe39c91d57764f6288cafde28
SHA12e40222359749316bbd7bb389329f6e0d33e23f9
SHA256c92188e2505b98c085562c5322f9d2c112f5157195a059523a0776d37a78d25d
SHA51272de7cfcdd02be2ae772828468d701ecae91cb8d7b86a6d5e91438bd5c27fee14daa4a593238b14bec5010bcbc3671bd74e9016022fa6d8c32489d4759dd3b41
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
11KB
MD59b184538f903f9c7777883ddf372549b
SHA157430de8360881b7b6ae168e13fa85dd67dd19eb
SHA2560852e53d7b3c6e23e3a7ec8ca20dccf34823dc670e4d658f528f37853df94f8f
SHA512429c9179e3ce43c8365966d82a0ab584c54d6e050a37208e26c6c962072601fb53bd3b271e4cff4e1514e526ef48d913b95a057c597f89054128e36917632fad
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
9KB
MD50a1ee671a1a5d213df9822556a1736b7
SHA128ec6cd8a753c952d38d8b71c99848f59d9ca78e
SHA256c2fa84ab2a7c62992222366773289239298b92e2d8a11151a8ff809de4e083cf
SHA5124424a5962c7065473cd526a546e161d8d657f1fcb273738531ee81a46b274d4449be22072109fd59d7bedeb49c0f1740e4eee26ddf793fde6ec1b1607525adbe
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
8KB
MD55d264d1ca848be462cfd9298ff4d1487
SHA19e50096981c3561630ffd5d4ac4e4fe014bb0290
SHA256544aaf4bdf80959a4a72386e80412a05a137e740009d3e830e0fbdac41feca38
SHA512b85cde27d6107fca43e7368310ba5eb20dc9d6ba5b21dfbc06b66ec6cd267626a2d5a5e450dacf8686113505732586b5637be055b91429974f0934b42109c947
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
9KB
MD51b9d943716e4dadaef750ddb97c8a442
SHA16d5a10f216eb7d98d1e42467ff0158bd701812d8
SHA256861ee509a19dd2776e5fc3e271bdda6192aba24ba93fe429bb702f2987f8fee6
SHA512099751c6a5581d5527eea32d0ba007a6350f0938f0c595baecad26202bd90d46a581b3b71e2ecaf60264bea544d917d718dbad0bb1f9535f697f365ad31617d8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
11KB
MD524ed39731661f291ba9807b24fb91f25
SHA1c2dc2ba40d704c67fc1ed0fc7a71cc34386f200e
SHA2562f946e8a1aef1fc9d0a1198a25da813e6a6f32c304fdfe1426b88c155ea76a09
SHA5122bd6ccea1986856da91f475e297c2f499e0d0bd59e638952e85760dd75643d2bacea298291de1ad87b783209d09c69c4aa75ea18b326c54b7425c98e17a1c7cf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
11KB
MD511805b4be137ad932ef8682abd0a4064
SHA17c2717108a5ff1769143460a08af35da99391c91
SHA256c9514436807bfeefdd8a8bd2203f6b8d3b5de2aa6592967d1a12775463cac295
SHA512a2c7d8778fedadc8e099045b1e3d3fd9391df10e3f4b23ea55d03a3478fdcb9e6a5bd2626d33647c89afd67aaaab6ee95749a1240cf25cb67b1864966b2e71aa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD57742257de20fa6909e1f318836139448
SHA14c671ca8928f28d2572828ec633a7384d7de117a
SHA2565c63466277f8f50c03aa252a1b71ece05b0463da43345aed6db6def4426a869b
SHA5122ec34c87efe23d6acf70c040e42729fb722d5c4a4a109738f6839d60fd505ebeb542d8d8ad61d2e2c18ed57b371d9d7ba0919fa37ab64817274f2096ca673a5c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
11KB
MD579db691725c50a9d4dbd1b8dfd9cb07d
SHA13e3c71f8c61522942bbf50ac067fc169c7857d4b
SHA25607b2ad03190c804e6aa95befaae279f90af55a4deae2577a3f06b7670335bb21
SHA512b89494744216e71e47e760fdc4ed8eb1b90745f715075c451a35c761881cc6ca7114020fb8752508c78e4c0e677780eb687010a74e3c7ae834d6c230c500a8b8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
11KB
MD565ca836baea994c3f5ac2ea9b2d6aa62
SHA1be2a189e169c3993d45fd4ee749c3a07ff747614
SHA25679bc90015e52f92638f349c88a9b11fe82f2d52000a8267389a691f7b82dbaa2
SHA5129e53e65a8524172e44a9df6deee0b96fdba653b72550120ca2e94c5bbf0e25b1000606da093918273a0d2f764ea256703ecd7826e0081cf71d6cca63b4bc1de4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD5d53ac35ab3976e67caeed75c4d44ffc1
SHA1c139ab66d75dc06f98ada34b5baf4d5693266176
SHA256647867c7236bcb78b7d585b476d82a101a077fac43c78dc59e612253fbf69437
SHA512391355c71734ded913239a6db10a3202087e756bccc8e29411108f21b3f2460d9a9c606619aadd785285be70eddcf61ef9519441cd387cd3823c1399a6967cc2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-indexFilesize
72B
MD5419237ee7edd373d865c24b6e497f4ab
SHA1e4138207746c344c4992fc156c4eb15b6c2bcd7d
SHA25684c1dbce3e4f743202b992f07e69dc4f4f6bf5d722347d296b3c9a41864c756c
SHA512526257ab28b85d01f464c874380f43e09b755ff7cb08f700ccb071e6649910984b00c8cb06caf3ecdf06dd83ed98d90e1711e09197ebd452b72bd6672c00aff9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe668ae2.TMPFilesize
48B
MD5cbe2116ce60342a0dbe22dd92e55b08a
SHA17f99c19967d356fbfac5438b8359b79071c9a9ac
SHA2562419649ca623c80685b9761ed01253109cf6c4840cd835c9670e9255b719d709
SHA512089e9a10bdc99ad62aa07897eb2a8f2b55557eaf0defc50c4319661d27dfb13aee500bc76b84762d439781f1743befa7ccc0f11ac371dbe6d35f3a064dc272fe
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13324761215810355Filesize
17KB
MD5ecff0f0c404a86fde0d1dd14ef631d89
SHA1c5f5dcabbaa40f609a3285f9ec7650af50a2561f
SHA2560e31670836a7e33d29942116b53f1d4f7258cd2ce475c3b97c00b27c8c1e339e
SHA512a940cf78d834467974394d4ae0dcec516c0834ba460e669beebcb8840cbe2f62d7bc567b7d45b520e28c10a0b9584ea7ca43d20d28281dada9183b98f63a14e9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
869B
MD5cfab164844d82b62242989c5a4bc5310
SHA1ac1e2b091909cdebe06e136386748fa4fa01a554
SHA2562f6ba557fffd9fd11002608df7ac0038556e8f7f7f9d3cc8a3fcb47de864b161
SHA512c4f9ae585c76eb84b255449e791b66e44ba09129253de2530651d08f0828273ad9d25a4f1564965e2eb12f647be6246bb814876140efbfe7ba3521f06999b426
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD557bfb54865a512d092474fabebcb60ff
SHA13a33817cde64e8468788b0e32873bc52f1222a69
SHA25662d8bab89ef65a18f7bfd3d7488f89311b95e8765f88b9675b8706c337da5750
SHA512b98648d4f846de81da5b5b40cd7bbc7d45b850c9076a919f413cbb8cfa8c0826742167a3990e071ac8ea5500cdf06b3e192023bf355c854a69bc54215040f5c6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
3KB
MD5447c18d11462d53a9026b74290201ea4
SHA1d437b356d7eb36e9c4fe87a88fce1db5ddddfef9
SHA256e4ce9f1491c520e5cbbe56a011215be98ed63326fd12c70d5ce2b7071f4d8f19
SHA512a62f470bd7c415350896d62d484e5c777e592086155e48936d0cb2faa124cc61ad2e05d3fbd787cebac0cf2144493185807cf531be01c7a2dc123189f7533ed9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
5KB
MD5cb441cb931010443257a070974c581d3
SHA1314326ffda705e16c6156f5f256aa1cd97af7616
SHA25630f3fd48b692904a4d869686997fd3be4032e51db10a60fb600dece0111a3cac
SHA51240cd537282aaef0ad4cd6c65a978309dd0ac31dbbd79a7ac04a241d558001e68a6d302ded8aad7a122dda0a77cb950c7214a7823f5b18a0ad9b1cff809e1ca4f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD5992d9417fe1bbda4c8ffadcd575ac250
SHA1cd07c92abe81a5179888d67572870cf00c0bd49c
SHA256e0a79c6a55219982f3f4d06999b27737ab4322ca95ecc72c049c2cc387993da4
SHA512dae0aa0696f7c0ab48e1a64abea1235df93b1c00febb0ded679e85bac00f9f14f1ca39606bad5c59f780b788182516c96d03c1e5681730ce63e99f3ebdad4b7f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
5KB
MD561e6908fc1c1cff0b59a41f1c9209ea5
SHA1bf603a4917c943b3e039280fd582b8519631b4e5
SHA2560aa44f9cd782dac97bf5bca7b8dc69fd3646c07af6c9a6ebec30a50df0b9c654
SHA512aa79004f0158ea2f3a7b61f225803ceba58efa0f7a107d0af7cf4028b446cb909392e9569a760168d65f12ddf136a81aa15ed8f05a8abd5890d33ca5a9fecfff
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe6593c0.TMPFilesize
203B
MD5301d535194dcd2050b22490d6c9fd575
SHA1be419af1bce1a97175370c54f6d0defa20deaf72
SHA256f5014f66c9a425c1f82273286497df7830add91f5948c691c7abfa479ca773ff
SHA51269ae81039ad3fe29b29eb2bdfb556cef16afe12289fd91731df06a8dafc3f3af9026858da595712c5456a06effe514262ecaba9c11af4ac88584ffc4bfa77700
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c8435f96-f435-4761-af8a-5b6eee6200d1.tmpFilesize
6KB
MD56b043f50d0bb9c397b414fb0226b5501
SHA191270cfdcc6f30509199bfdcde7aeeb80cf2462f
SHA256ce50938dc0ff412bb87daea83a7153b0ee47b2d15b7f730de99ef76d7cc79c27
SHA512817efec5a849d89353c4e321fd2642d092a41d1569ac0b6f8ee8f0e45d273905ddc1d1daa53ec5a2835ffceededd7ead8022bd908f97cf9b8c21944c5e33df07
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5589c49f8a8e18ec6998a7a30b4958ebc
SHA1cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e
SHA25626d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8
SHA512e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD560e3f691077715586b918375dd23c6b0
SHA1476d3eab15649c40c6aebfb6ac2366db50283d1b
SHA256e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee
SHA512d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ded7a9a9-e9de-4c52-91de-323eeb850ef6.tmpFilesize
1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1Filesize
264KB
MD59b2a89f7a8c708ca4376d0026fe392d5
SHA11e6d65b39f5c54b635f9b69ffb81c1c0d59a10b2
SHA2569b008fa0a48cdebee9a8d624e176b4fee23a72925396edaa83ec2f41d85fba75
SHA5128fea487412040ab6ec7ae3c111b4a0f13506525023fa2e949b8373e133e01b89e03e164568e7ab19a42cc71a9c6ad473af7da3263ec6a1ae79fb638b445fd888
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last BrowserFilesize
120B
MD5a397e5983d4a1619e36143b4d804b870
SHA1aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA2569c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
SHA5124159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last VersionFilesize
11B
MD5838a7b32aefb618130392bc7d006aa2e
SHA15159e0f18c9e68f0e75e2239875aa994847b8290
SHA256ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa
SHA5129e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
3KB
MD56e0c8485a7e3640d5d49d8449ebde994
SHA13260c7feee4947c8d8028de74130ea97f5debfab
SHA2565bd2ee067b299876457be210963fc2612a91695f36808dc47eb860eff1621e48
SHA512b4ebe828f631b09973c67d6026c56b38fe43161a72910d77eed60943318556370f2f061e7be6c5dfcc40e04281bc54bade52d59baad5e580e9ba8d874913213a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
13KB
MD5be3f1f6e4c6be47bc684afade57fcf1b
SHA14d95a0cb5217a34a949a59d78301579dbc2620ed
SHA256ff8deacf67cd2cd022c57f2e13c9133f1cd95ce4a69298b3e048511a4da857ba
SHA512617cdf54baccd49d283fa90b810951c3a1c08c48c481543791003fddfe0a58d23834aa5555d562ca087c210d310b64e6aa463a86afca8b0088d97240c121e17e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
3KB
MD5ecc98c22eb3ae723e20a4a44f54ee6b1
SHA16c942f6f7e9acfba5e6ac46563048a07f42d2dbf
SHA256922c60fbe46c0a33d85dc787f7b85aa61de7d1ff62d945bb04ac21dc0d423c7c
SHA512851c4053fbe6bfcf5bb1016466257641ec3027e831524ca21d4e063cd6cd5b7b3c74792c63262c537a62568480d5ca6302297a30469e897b7724a46ca19efd65
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD56bd6434b5196f57a4ec9bf8a738b3dad
SHA1e2c564ccbebf2f338afae16bcc7d1a2364814587
SHA2563dfad5a6bdd71d936341049e8a07fabc5095fb38d1edead1a2e34a69d9d2f2d0
SHA512b7f6d6d96175b9cf035fd09704e1b37e3ce47198cae64f6be767a09da23d3d59f23f6985ff0fa6ef0270006272011b54cd09b44da067618c56127c31000743f0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD55f201ab63fb9afa502035c557669cff5
SHA19e417e509b2c095a0a5ed6701e11c02742ee20c6
SHA256af18bdbef92c018419efa39ce43c6de0360b56c29cb9823720fffc2b9bfd7e01
SHA512f98cab84c8a2b7e58fdabf12b684a540e49602365af6e2d1ec4b92d60992188996547c1a16f0790bb3990313db8d427b3962aacd1e66cef83e4b75d6093a25a1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
13KB
MD5150b24b7fee80f33748631efa871ade2
SHA1a117ed3034837ffb2fb704a407b16fe903e47c7e
SHA256fa13873e2b8036966e21da2bac4b572a32dac64946bcc1ad87cefb52a0822111
SHA512472872995b95a8b89f606513e2aa648ebe1ee640f4338dbfe0c5daca0549569991213e3ffcf3e6855edf2f38f957e97599012e9d4a75e0fc369c85e99ade2758
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
13KB
MD5f3d2760651b9c842c1d51f0b5b5e93bc
SHA196fede1492782ccf66992c5ab9069b309adcfffa
SHA256f230dcd9a1594dc95fe6e0b77a1c3a70bcdadc703d75e13290a9b5a1b36c5c62
SHA512d0f354a49eae404061d9764b439fe11d7a31c024bee0cf9b4f6893b05e46b5a1984b24c8b2c0ced7daf84e859fb94fd9c48560856ff3003882ef761823873d98
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
13KB
MD5d106ce41734df7adb4b1e984d893c8dd
SHA1e0d6a5b7993e2602be53c58bfb21a0f3240d5ee2
SHA2561ac68199693641974998d835462deba292e6673ebfe3992a7050e133ab3ac67c
SHA512ed84641459e90af930503c7b39646d9006f56993a6b7b6aca173c52cd1121ec74e166edf7d98b801143537361f2193ada8816b995cc2e85aa027ff66c6e562dd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
13KB
MD51ef311c94c0fe3bd2fce4018c306c73b
SHA16ca0318a031378b3a8dd47feda065dde1194f1ea
SHA2569dee302b9eee47f2ce4582c30814ae0f8a744d38fc72b9dee7272c1642d3ab67
SHA5124d582bc22f6aa4fa87639584b4a17e81d6c4264321122585cd1b10e402635d22d7fcb55de06045de71b23fbafc664e9707023e04f790e7030083c65cf564d1fa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
13KB
MD57d0f95800103db4fb808f1ba270e6d1e
SHA13148cf0b890508af8f8c5cb6a6b6641e5d6523f9
SHA256010e7d14e8f031defc6d4bc9e132bfd13959721db2e9a1bcc4dfad014141d9e4
SHA512ceda1297c8ea71225dd938c3c09249ccb5f0daefab2ce448fb3988188f5ec8fa689ffad31eb1b666c7b8fbcbd8e2ceb04fff870c38f903f3dd72d4895fa8f8ca
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
13KB
MD5b4d7b7597dc625e07deb352c1c556c2c
SHA16b33c65e2f20bf1f44cb87d1a0d74569d27909e6
SHA256f4cbdbd8d9e322e3b64765389e1df89a4cbeb9133a2e6a2ec5b8dd539ccba592
SHA512e3daa0019ddb6e180152056bb4bef585de53c8c8b1d043bbf1f9318908ec7e9cab5211fb29652820730b9ea6898d628e8397ad1169769e79eef04f81362e5a3d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
13KB
MD59c0c9eb37ef3d05fbc087211632d1d6f
SHA1c5321ff18de497276d76371c132aa36a6db75483
SHA256b6a918286afad5588f7a57b6089bb28d8125b7c265051170bf37092dcc9b72be
SHA51243b68189fef01b6f7ea95ecb6a1a6c4d659ea25d34a8ce7a2a6b653f729e5267f9395948fc46d219813efbbef5b1026b2d57554b3e99f04cb5ac8ddd81fd8941
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD5b466eddf1286ebd458bcdc44cfef7a29
SHA1bf4e61c0b5002ea809fb1f0b49f45f98b2da7dac
SHA256aa853c22dbcad87c97a72ff94e678e44fde8db4d5f952b3e6f66c3e4b7155b83
SHA512e771e2634e7f168952265a9f7a7c8d4a38dda1a104fb20af2d9b04b7eec13eb94769a9e3dd30ea44b262fff34fcb720ac2e3e1145d4264cacb91c4fbe1c083d6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
13KB
MD53e1faf4086174d199f8b738ee555ba05
SHA1e40c033148a4172fe4064e11fb122c7bea582890
SHA256677d59637ad4406a6bc4375bb2ea68a132eb43433760990bade91bb9b523a6c7
SHA512e76282f6c27886b391d833c8603632d41a2621afd6d3c72b5c7192a4f2006f53438de7a9482e6b133cf88145a2bd1869ad67f3c7f655e83abc061ad1e107fbfd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
13KB
MD59f8507e37f8fa90c2105dae0b75b9e24
SHA1182fa388f35da94d1b5f092a785bd36c9abe4d4e
SHA2562f88e108445fa8e5f4afebcf1df7405413bbc7201782f2791424c30a7e88f6fa
SHA51204146252d3ea6f52538809b0a5a98634902a2a06ad9ed6d8c2247ba98120b6738f496fb3076cd9049c61273b1a5f4ab6fa696e15a721762d0009abbd2980fc6f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c65aa992-49f0-47fc-bbc1-f816d4e7d4a9.tmpFilesize
13KB
MD598a06419592086e8aa6b73715a3f6e6c
SHA14edd6a65014fd6c50ecb7881af61eaf8854b5af7
SHA2561219aba37951e8eaaf545b82d2c8d8e5f6273246598a5f706e1fbb63300e5bed
SHA5129d005e9fae9ceaf0766f75ad4b02ccd2e700ae89b6b2263eb008b044c96d122b5c476fc868bf7b058651f6e4824830b4e117ade430b87e6cc957df2b127fece8
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{9053766B-1DA2-14CF-1B83-21855938BB42}Filesize
36KB
MD58aaad0f4eb7d3c65f81c6e6b496ba889
SHA1231237a501b9433c292991e4ec200b25c1589050
SHA256813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1
SHA5121a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_cleanmgr_exeFilesize
36KB
MD533cf1a9ad7e502fd7c2de69a7da48801
SHA1a71f1a144616eda1ca60886843fae98703417a0b
SHA256f160948153cf32d47d35bea85eccd51929566e662c6eca6f838515b0860704c0
SHA512edbee4a88c5e5f049ec86a4b8beadeac89f4eec81f1176ea35f2f689fb40f335ee1f85df856d02d224f5fb95e4ac1e9a85cf6d54b4c436a50e478859ec9fc517
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c57d39db-2bc1-4e2e-a0a7-843a4a0d13ad}\0.0.filtertrie.intermediate.txtFilesize
28KB
MD55607d6f2904d415029e85bfe139ed3c0
SHA1a5aadd2a5fd25c796441621acc544f1721f6809c
SHA256771cc6d5a01464e8d29d0e7563f3a66ece095c27075e4d7a9ef420182af91c86
SHA512cca58980b6ada157da8a47a3aa5f8331803684347f124898bea12484046c77a0e8a23974e834b500918aa6d808f77df4d16447c685eae8f8290425063a26a15b
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c57d39db-2bc1-4e2e-a0a7-843a4a0d13ad}\0.1.filtertrie.intermediate.txtFilesize
5B
MD534bd1dfb9f72cf4f86e6df6da0a9e49a
SHA15f96d66f33c81c0b10df2128d3860e3cb7e89563
SHA2568e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c
SHA512e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c57d39db-2bc1-4e2e-a0a7-843a4a0d13ad}\0.2.filtertrie.intermediate.txtFilesize
5B
MD5c204e9faaf8565ad333828beff2d786e
SHA17d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1
SHA256d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f
SHA512e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c57d39db-2bc1-4e2e-a0a7-843a4a0d13ad}\Apps.ftFilesize
38KB
MD5c90f678197ead85a1394a19ba56a1a2e
SHA19744aa9977e9417bb6dd0f034a85a083f2dc988b
SHA256ea813b120815181bfef9f9d3ddbdb1ff0b1e55d4d59ae4a6a9d1be6dbc40f45d
SHA512fd15ccbf62c1f5ad604d48b5477ea29268dfea8a59732ba04c38bb336bc4a0672c4c2c46c24b4ddf228ccafca89660dfae76bbf5461e58078d73f10a421218e6
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c57d39db-2bc1-4e2e-a0a7-843a4a0d13ad}\Apps.indexFilesize
1.0MB
MD566ae7e8ba6e8da050299b2e3a0bc1320
SHA1023f6a73639cc82dc4f265a0835066cba17142c7
SHA256c0a80d68ade78295d13affe59e671be342202e37b5614b583e78398e76b97e09
SHA5122d839bfaf8ea7c5fc9568e5a7f9eba2a149640c1f329a3e463e8d39859ebcfc54effd9d1220e4da2a3a13219626b009b52dfb9593a58bb0f7dca67f369bfa1d6
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133247604801751824.txtFilesize
76KB
MD5c226b1278d5bd7e6752b204ed85d9e45
SHA1c80ef37bb831551c1adeea137dbdc3d7727777d2
SHA256ccdd6742d9a8f9b068195c006a5eddc658c6f2578556749420a370310ea8b2e5
SHA51235c956a9377b03c0243d08b5dcded6e804b0fa55a6f1a723ad71491d54a6f92f2dd99ca8007a321c87ed1da1024a87e209245e2d51f14e8afcbe651ffd92a4b9
-
C:\Users\Admin\AppData\Local\Temp\nsk204A.tmp\InstallOptions.dllFilesize
15KB
MD5ece25721125d55aa26cdfe019c871476
SHA1b87685ae482553823bf95e73e790de48dc0c11ba
SHA256c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
SHA5124e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
-
C:\Users\Admin\AppData\Local\Temp\nsk204A.tmp\InstallOptions.dllFilesize
15KB
MD5ece25721125d55aa26cdfe019c871476
SHA1b87685ae482553823bf95e73e790de48dc0c11ba
SHA256c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
SHA5124e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
-
C:\Users\Admin\AppData\Local\Temp\nsk204A.tmp\InstallOptions.dllFilesize
15KB
MD5ece25721125d55aa26cdfe019c871476
SHA1b87685ae482553823bf95e73e790de48dc0c11ba
SHA256c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
SHA5124e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
-
C:\Users\Admin\AppData\Local\Temp\nsk204A.tmp\System.dllFilesize
12KB
MD5cff85c549d536f651d4fb8387f1976f2
SHA1d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA2568dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
SHA512531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
-
C:\Users\Admin\AppData\Local\Temp\nsk204A.tmp\UserInfo.dllFilesize
4KB
MD52f69afa9d17a5245ec9b5bb03d56f63c
SHA1e0a133222136b3d4783e965513a690c23826aec9
SHA256e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0
SHA512bfd4af50e41ebc56e30355c722c2a55540a5bbddb68f1522ef7aabfe4f5f2a20e87fa9677ee3cdb3c0bf5bd3988b89d1224d32c9f23342a16e46c542d8dc0926
-
C:\Users\Admin\AppData\Local\Temp\nsk204A.tmp\ioSpecial.iniFilesize
1KB
MD5b1a34aac6829000caac3eaa070878eca
SHA180d6271a9f72dc7fc55f0ea3e23873c18f4b859f
SHA256b0660426041201c2bee4e19d03be6344664fa4962fa641b8c10c1a7157d78b5b
SHA512e1ed7bdd344cc65162078506a5f1e7f84eb140db95571997f381d4bb3b4a7692646fff62649eddc231d973833c949f342f9434079a061a6efd6e93dc40ee6538
-
C:\Users\Admin\AppData\Local\Temp\nsk204A.tmp\ioSpecial.iniFilesize
1KB
MD5b44549b17b0de708660a7d1d2a9a2b7c
SHA1dc020d912ce3ab0a089b4288808ba6717a969c76
SHA25643c43bc43225c2246135f637cf45f927ce72ccd4590737924d0fd6af976d60ff
SHA512c6706e6a27a78078ee1f40d170196840cb3deb0b471d0e30dfbbc5165108a5930cd8256aa87ead5757061c1b006a80eacd096026efde65a5ccaf030645811a8b
-
C:\Users\Admin\AppData\Local\Temp\nsk204A.tmp\ioSpecial.iniFilesize
1KB
MD5659ffe09793c55deefb9ee4dd192c694
SHA133e0e3d764abdfcfaae5094a8eb7f24b574da355
SHA256d13f3304443d69d1047e50df65f5ebcda5f18ac56f7c25288bd6660caee4662d
SHA5126b9636e4879603aada02b22f45f7c51b0493b2030b0e223e5a6b7800a7a5f500183411d58c793fda1f4f684e528453d99acd54337af48fb0497dc6de6bcdcf00
-
C:\Users\Admin\AppData\Local\Temp\nsk204A.tmp\ioSpecial.iniFilesize
1KB
MD59dfcab1a98092c7857d47d7581d5d48b
SHA1817f37a8a305f8d6bb257a706341fd517aaaec2b
SHA256e12fa250da2e9afb5a365326ab472d405bbd4b70bcadae7ed900011b6971bc49
SHA512bb2cfe90236c6e10a149d2e2cc6df31154dcc35ad24f23713276e4e590e54fa211292c8172c950db408134b5a49fda040fdb39c0bafe40836878ec70da52b35f
-
C:\Users\Admin\AppData\Local\Temp\nsk204A.tmp\ioSpecial.iniFilesize
1KB
MD5b6e6d8d77963d70a76e665f0dc5a166f
SHA11f22ea77c6c6d9a4b1ebeebddb602b0a5be35ac7
SHA256d19d431b6fdea9df5b0e095feae8a28d2b0fda2d3e477bc261c2f3475167a5db
SHA5126aabe35cf8ccf10b39769d24c4408af753d8c552ee23f0d41ddb9b291ff89f4d77d76ba3f0b5e9973646c363e065ad3b33853ef5df1b631d5a8a5d866a0007dd
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnkFilesize
2KB
MD533aa189a434fc5d0a3fc43293dfe5caa
SHA15be81a42ad59781861b54bee015598ed98dd892f
SHA2560abeb24d6b1a004cc1dac1a2287d2e08da0700febbca3dcff449cedc77908210
SHA51211a1ca42f78f087fc62376a9e147b7b89c2ca65a45db0035f0286e5da4d970a63109cda0c7cb8bc85516d61c1d20f00cdc78fd505cf9df7975f1d383fd664007
-
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.datFilesize
202B
MD54566d1d70073cd75fe35acb78ff9d082
SHA1f602ecc057a3c19aa07671b34b4fdd662aa033cc
SHA256fe33f57205e2ebb981c4744d5a4ddc231f587a9a0589e6565c52e1051eadb0c0
SHA512b9584ebfdd25cc588162dd6525a399c72ac03bf0c61709b96a19feba7217d840ae2c60d7b0d3b43307a2776f497a388e79ef8a646c12ae59a7f5cc4789bbf3c8
-
C:\Users\Admin\Downloads\Unconfirmed 857483.crdownloadFilesize
17KB
MD54790677e05d72ef7429dddf35562bf4a
SHA14243d6ea53db7e8cc0c355e70d6cffb54787b90b
SHA256319bf6087040d17b87f46cd05f5ee064c291ba9ca46e1910f28d1f4c57cb3d96
SHA512a93c5f691938bc1bdd9ef20b975f0b22cf494543e7df82ec31838bf811552ead5cd855959be4e47186ee7de944be005030f52f58b9dc85e7cde719cb97b794e3
-
\??\pipe\LOCAL\crashpad_4128_MQOHBPNKKELRLODZMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/728-1472-0x000001E88AC00000-0x000001E88C52F000-memory.dmpFilesize
25.2MB
-
memory/728-512-0x000001F08D5D0000-0x000001F08D5F0000-memory.dmpFilesize
128KB
-
memory/728-1446-0x000001E88AC00000-0x000001E88C52F000-memory.dmpFilesize
25.2MB
-
memory/728-1453-0x000001E88AC00000-0x000001E88C52F000-memory.dmpFilesize
25.2MB
-
memory/728-516-0x000001F08DBE0000-0x000001F08DC00000-memory.dmpFilesize
128KB
-
memory/728-508-0x000001F08D820000-0x000001F08D840000-memory.dmpFilesize
128KB
-
memory/728-842-0x000001E88AC00000-0x000001E88C52F000-memory.dmpFilesize
25.2MB
-
memory/728-1503-0x000001E88AC00000-0x000001E88C52F000-memory.dmpFilesize
25.2MB
-
memory/728-1513-0x000001E88AC00000-0x000001E88C52F000-memory.dmpFilesize
25.2MB
-
memory/728-1539-0x000001E88AC00000-0x000001E88C52F000-memory.dmpFilesize
25.2MB
-
memory/728-1607-0x000001E88AC00000-0x000001E88C52F000-memory.dmpFilesize
25.2MB
-
memory/728-1595-0x000001E88AC00000-0x000001E88C52F000-memory.dmpFilesize
25.2MB
-
memory/2968-2400-0x00000272E7B40000-0x00000272E7B50000-memory.dmpFilesize
64KB
-
memory/4668-464-0x000001BA5D3B0000-0x000001BA5D556000-memory.dmpFilesize
1.6MB
-
memory/4668-493-0x000001BA5F0F0000-0x000001BA5F0FC000-memory.dmpFilesize
48KB
-
memory/4668-472-0x000001BA5D900000-0x000001BA5D912000-memory.dmpFilesize
72KB
-
memory/4668-749-0x000001BA78040000-0x000001BA78046000-memory.dmpFilesize
24KB
-
memory/4668-734-0x000001BA77E50000-0x000001BA77E62000-memory.dmpFilesize
72KB
-
memory/4668-732-0x000001BA77E20000-0x000001BA77E28000-memory.dmpFilesize
32KB
-
memory/4668-474-0x000001BA5D8D0000-0x000001BA5D8DA000-memory.dmpFilesize
40KB
-
memory/4668-612-0x000001BA5F2B0000-0x000001BA5F2BC000-memory.dmpFilesize
48KB
-
memory/4668-731-0x000001BA77E10000-0x000001BA77E1E000-memory.dmpFilesize
56KB
-
memory/4668-729-0x000001BA77E00000-0x000001BA77E10000-memory.dmpFilesize
64KB
-
memory/4668-476-0x000001BA5D8E0000-0x000001BA5D8EA000-memory.dmpFilesize
40KB
-
memory/4668-478-0x000001BA5F0D0000-0x000001BA5F0E0000-memory.dmpFilesize
64KB
-
memory/4668-726-0x000001BA77C10000-0x000001BA77C18000-memory.dmpFilesize
32KB
-
memory/4668-727-0x000001BA77C20000-0x000001BA77C30000-memory.dmpFilesize
64KB
-
memory/4668-480-0x000001BA5F0E0000-0x000001BA5F0EE000-memory.dmpFilesize
56KB
-
memory/4668-753-0x000001BA782F0000-0x000001BA78316000-memory.dmpFilesize
152KB
-
memory/4668-724-0x000001BA77DE0000-0x000001BA77DF4000-memory.dmpFilesize
80KB
-
memory/4668-755-0x000001BA78320000-0x000001BA78328000-memory.dmpFilesize
32KB
-
memory/4668-717-0x000001BA77C20000-0x000001BA77C30000-memory.dmpFilesize
64KB
-
memory/4668-716-0x000001BA77BC0000-0x000001BA77BC8000-memory.dmpFilesize
32KB
-
memory/4668-485-0x000001BA5F110000-0x000001BA5F128000-memory.dmpFilesize
96KB
-
memory/4668-710-0x000001BA77B60000-0x000001BA77B6A000-memory.dmpFilesize
40KB
-
memory/4668-490-0x000001BA77A90000-0x000001BA77ABC000-memory.dmpFilesize
176KB
-
memory/4668-757-0x000001BA782D0000-0x000001BA782DA000-memory.dmpFilesize
40KB
-
memory/4668-707-0x000001BA77B50000-0x000001BA77B5A000-memory.dmpFilesize
40KB
-
memory/4668-470-0x000001BA5D8B0000-0x000001BA5D8B6000-memory.dmpFilesize
24KB
-
memory/4668-705-0x000001BA77B90000-0x000001BA77BA8000-memory.dmpFilesize
96KB
-
memory/4668-495-0x000001BA5F100000-0x000001BA5F10E000-memory.dmpFilesize
56KB
-
memory/4668-498-0x000001BA5F130000-0x000001BA5F13E000-memory.dmpFilesize
56KB
-
memory/4668-765-0x000001BA77C20000-0x000001BA77C30000-memory.dmpFilesize
64KB
-
memory/4668-700-0x000001BA77C30000-0x000001BA77C7A000-memory.dmpFilesize
296KB
-
memory/4668-500-0x000001BA5F140000-0x000001BA5F14A000-memory.dmpFilesize
40KB
-
memory/4668-698-0x000001BA77B70000-0x000001BA77B86000-memory.dmpFilesize
88KB
-
memory/4668-696-0x000001BA77B10000-0x000001BA77B1C000-memory.dmpFilesize
48KB
-
memory/4668-767-0x000001BA7ADC0000-0x000001BA7AE1C000-memory.dmpFilesize
368KB
-
memory/4668-514-0x000001BA5F150000-0x000001BA5F15A000-memory.dmpFilesize
40KB
-
memory/4668-1114-0x000001BA77C20000-0x000001BA77C30000-memory.dmpFilesize
64KB
-
memory/4668-1135-0x000001BA77C20000-0x000001BA77C30000-memory.dmpFilesize
64KB
-
memory/4668-693-0x000001BA77B40000-0x000001BA77B50000-memory.dmpFilesize
64KB
-
memory/4668-1154-0x000001BA77C20000-0x000001BA77C30000-memory.dmpFilesize
64KB
-
memory/4668-526-0x000001BA5F160000-0x000001BA5F16A000-memory.dmpFilesize
40KB
-
memory/4668-684-0x000001BA77B00000-0x000001BA77B0C000-memory.dmpFilesize
48KB
-
memory/4668-529-0x000001BA77AC0000-0x000001BA77AD2000-memory.dmpFilesize
72KB
-
memory/4668-1220-0x000001BA7DBA0000-0x000001BA7DBD8000-memory.dmpFilesize
224KB
-
memory/4668-680-0x000001BA77B20000-0x000001BA77B3A000-memory.dmpFilesize
104KB
-
memory/4668-600-0x000001BA77AE0000-0x000001BA77AF4000-memory.dmpFilesize
80KB
-
memory/4668-606-0x000001BA5F170000-0x000001BA5F178000-memory.dmpFilesize
32KB
-
memory/4668-1221-0x000001BA7DB70000-0x000001BA7DB7E000-memory.dmpFilesize
56KB
-
memory/4668-1223-0x000001BA77C20000-0x000001BA77C30000-memory.dmpFilesize
64KB
-
memory/4668-608-0x000001BA5F2A0000-0x000001BA5F2AA000-memory.dmpFilesize
40KB
-
memory/4668-1225-0x000001BA77C20000-0x000001BA77C30000-memory.dmpFilesize
64KB