74f6e04559abc2cd3e7acf03345b99ce131d618f38048363f031764f9f4ce8aa

Analysis

max time kernel
661s
max time network
1054s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2023, 05:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

virustotal.txt
Size

110B
MD5

225d070db1e15ce65b128edfa60ec81e
SHA1

65f728a51b9da2bcc290a75dd106d5fe07314ffa
SHA256

74f6e04559abc2cd3e7acf03345b99ce131d618f38048363f031764f9f4ce8aa
SHA512

d000b6535064598bbb09bf43bf898da49852b763ca87b9dff42c856329a0c612a47e6ba342aad2c218b1d9007a07b9b5a77b0139f5a8966c88b8c15a1aeb3f67

Score

10^/10

evasion themida trojan

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5396 created 3144	5396	Updat.exe	50

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	A5QtxkSZgFZ.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Updat.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Updat.exe

Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	A5QtxkSZgFZ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	A5QtxkSZgFZ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Updat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Updat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Updat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Updat.exe

Executes dropped EXE 15 IoCs

pid	Process
5768	winrar-x64-622.exe
5736	jidLbB90c.bin
4252	A5QtxkSZgFZ.exe
4320	jidLbB90c.bin
4688	A5QtxkSZgFZ.exe
3292	CefSharp.BrowserSubprocess.exe
2360	CefSharp.BrowserSubprocess.exe
4772	ZLauncher.exe
1176	ZLauncher.exe
5152	Version.exe
5744	Version.exe
2344	ZLauncher.exe
5756	Version.exe
5396	Updat.exe
3524	Updat.exe

Loads dropped DLL 25 IoCs

pid	Process
4252	A5QtxkSZgFZ.exe
4252	A5QtxkSZgFZ.exe
4252	A5QtxkSZgFZ.exe
4252	A5QtxkSZgFZ.exe
4252	A5QtxkSZgFZ.exe
4252	A5QtxkSZgFZ.exe
4252	A5QtxkSZgFZ.exe
4252	A5QtxkSZgFZ.exe
4252	A5QtxkSZgFZ.exe
4252	A5QtxkSZgFZ.exe
3292	CefSharp.BrowserSubprocess.exe
3292	CefSharp.BrowserSubprocess.exe
3292	CefSharp.BrowserSubprocess.exe
3292	CefSharp.BrowserSubprocess.exe
3292	CefSharp.BrowserSubprocess.exe
3292	CefSharp.BrowserSubprocess.exe
3292	CefSharp.BrowserSubprocess.exe
3292	CefSharp.BrowserSubprocess.exe
2360	CefSharp.BrowserSubprocess.exe
2360	CefSharp.BrowserSubprocess.exe
2360	CefSharp.BrowserSubprocess.exe
2360	CefSharp.BrowserSubprocess.exe
2360	CefSharp.BrowserSubprocess.exe
2360	CefSharp.BrowserSubprocess.exe
2360	CefSharp.BrowserSubprocess.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x0007000000023449-5571.dat	themida

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Updat.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Updat.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	A5QtxkSZgFZ.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
666	ip-api.com
773	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5396	Updat.exe
3524	Updat.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5152 set thread context of 1328	5152	Version.exe	196
PID 5744 set thread context of 976	5744	Version.exe	197
PID 5756 set thread context of 5304	5756	Version.exe	203

Launches sc.exe 20 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1324	sc.exe
5320	sc.exe
708	sc.exe
1068	sc.exe
4360	sc.exe
1348	sc.exe
5436	sc.exe
5736	sc.exe
2636	sc.exe
5568	sc.exe
2168	sc.exe
1408	sc.exe
5468	sc.exe
2544	sc.exe
4680	sc.exe
5552	sc.exe
6004	sc.exe
1364	sc.exe
4100	sc.exe
4036	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
556	1328	WerFault.exe	196
2896	3324	WerFault.exe	87
2308	1660	WerFault.exe	249

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	A5QtxkSZgFZ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	A5QtxkSZgFZ.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	InstallUtil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	InstallUtil.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	A5QtxkSZgFZ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	A5QtxkSZgFZ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	A5QtxkSZgFZ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	A5QtxkSZgFZ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	A5QtxkSZgFZ.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 338807.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
3472	NOTEPAD.EXE
2868	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3936	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
636	msedge.exe
636	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2636	identity_helper.exe
2636	identity_helper.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4284	msedge.exe
4284	msedge.exe
3244	msedge.exe
3244	msedge.exe
5608	msedge.exe
5608	msedge.exe
5424	msedge.exe
5424	msedge.exe
1184	Synapse Launcher.exe
1184	Synapse Launcher.exe
5736	jidLbB90c.bin
5736	jidLbB90c.bin
4252	A5QtxkSZgFZ.exe
4252	A5QtxkSZgFZ.exe
5432	Synapse Launcher.exe
5432	Synapse Launcher.exe
4320	jidLbB90c.bin
4320	jidLbB90c.bin
4688	A5QtxkSZgFZ.exe
4688	A5QtxkSZgFZ.exe
4252	A5QtxkSZgFZ.exe
3292	CefSharp.BrowserSubprocess.exe
3292	CefSharp.BrowserSubprocess.exe
3292	CefSharp.BrowserSubprocess.exe
3292	CefSharp.BrowserSubprocess.exe
2360	CefSharp.BrowserSubprocess.exe
2360	CefSharp.BrowserSubprocess.exe
2360	CefSharp.BrowserSubprocess.exe
2360	CefSharp.BrowserSubprocess.exe
1328	InstallUtil.exe
1328	InstallUtil.exe
1328	InstallUtil.exe
1328	InstallUtil.exe
1328	InstallUtil.exe
1328	InstallUtil.exe
1328	InstallUtil.exe
1328	InstallUtil.exe
1328	InstallUtil.exe
1328	InstallUtil.exe
1328	InstallUtil.exe
1328	InstallUtil.exe
1328	InstallUtil.exe
1328	InstallUtil.exe
1328	InstallUtil.exe
1328	InstallUtil.exe
1328	InstallUtil.exe
1328	InstallUtil.exe
1328	InstallUtil.exe
1328	InstallUtil.exe
1328	InstallUtil.exe
1328	InstallUtil.exe
1328	InstallUtil.exe
1328	InstallUtil.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3936	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 44 IoCs

pid	Process
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: 33	5400	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5400	AUDIODG.EXE
Token: SeDebugPrivilege	1184	Synapse Launcher.exe
Token: SeDebugPrivilege	5736	jidLbB90c.bin
Token: SeDebugPrivilege	4252	A5QtxkSZgFZ.exe
Token: SeDebugPrivilege	5432	Synapse Launcher.exe
Token: SeDebugPrivilege	4320	jidLbB90c.bin
Token: SeDebugPrivilege	4688	A5QtxkSZgFZ.exe
Token: SeRestorePrivilege	3968	7zG.exe
Token: 35	3968	7zG.exe
Token: SeSecurityPrivilege	3968	7zG.exe
Token: SeSecurityPrivilege	3968	7zG.exe
Token: SeDebugPrivilege	3292	CefSharp.BrowserSubprocess.exe
Token: SeDebugPrivilege	2360	CefSharp.BrowserSubprocess.exe
Token: SeRestorePrivilege	3040	7zG.exe
Token: 35	3040	7zG.exe
Token: SeSecurityPrivilege	3040	7zG.exe
Token: SeSecurityPrivilege	3040	7zG.exe
Token: SeDebugPrivilege	1328	InstallUtil.exe
Token: SeDebugPrivilege	976	InstallUtil.exe
Token: SeDebugPrivilege	5304	InstallUtil.exe
Token: SeRestorePrivilege	5156	7zG.exe
Token: 35	5156	7zG.exe
Token: SeSecurityPrivilege	5156	7zG.exe
Token: SeSecurityPrivilege	5156	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
3936	vlc.exe
3936	vlc.exe
3936	vlc.exe
3936	vlc.exe
3936	vlc.exe
3936	vlc.exe
3936	vlc.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
4208	OpenWith.exe
4208	OpenWith.exe
4208	OpenWith.exe
4696	OpenWith.exe
4696	OpenWith.exe
4696	OpenWith.exe
4696	OpenWith.exe
4696	OpenWith.exe
5768	winrar-x64-622.exe
5768	winrar-x64-622.exe
3936	vlc.exe
4772	ZLauncher.exe
1176	ZLauncher.exe
5152	Version.exe
5744	Version.exe
1328	InstallUtil.exe
976	InstallUtil.exe
2344	ZLauncher.exe
5756	Version.exe
5304	InstallUtil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 3324	2136	msedge.exe	87
PID 2136 wrote to memory of 3324	2136	msedge.exe	87
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 3188	2136	msedge.exe	90
PID 2136 wrote to memory of 636	2136	msedge.exe	91
PID 2136 wrote to memory of 636	2136	msedge.exe	91
PID 2136 wrote to memory of 1612	2136	msedge.exe	92
PID 2136 wrote to memory of 1612	2136	msedge.exe	92
PID 2136 wrote to memory of 1612	2136	msedge.exe	92
PID 2136 wrote to memory of 1612	2136	msedge.exe	92
PID 2136 wrote to memory of 1612	2136	msedge.exe	92
PID 2136 wrote to memory of 1612	2136	msedge.exe	92
PID 2136 wrote to memory of 1612	2136	msedge.exe	92
PID 2136 wrote to memory of 1612	2136	msedge.exe	92
PID 2136 wrote to memory of 1612	2136	msedge.exe	92
PID 2136 wrote to memory of 1612	2136	msedge.exe	92
PID 2136 wrote to memory of 1612	2136	msedge.exe	92
PID 2136 wrote to memory of 1612	2136	msedge.exe	92
PID 2136 wrote to memory of 1612	2136	msedge.exe	92
PID 2136 wrote to memory of 1612	2136	msedge.exe	92
PID 2136 wrote to memory of 1612	2136	msedge.exe	92
PID 2136 wrote to memory of 1612	2136	msedge.exe	92
PID 2136 wrote to memory of 1612	2136	msedge.exe	92
PID 2136 wrote to memory of 1612	2136	msedge.exe	92
PID 2136 wrote to memory of 1612	2136	msedge.exe	92
PID 2136 wrote to memory of 1612	2136	msedge.exe	92

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\virustotal.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3472

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff0d9646f8,0x7fff0d964708,0x7fff0d964718
    3⤵
    PID:3324
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3324 -s 1276
      4⤵
      Program crash
      PID:2896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:3188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
    3⤵
    PID:1612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
    3⤵
    PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
    3⤵
    PID:1216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
    3⤵
    PID:1656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
    3⤵
    PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
    3⤵
    PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3720 /prefetch:1
    3⤵
    PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
    3⤵
    PID:4912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
    3⤵
    PID:3480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
    3⤵
    PID:1040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
    3⤵
    PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
    3⤵
    PID:4012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3804 /prefetch:1
    3⤵
    PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
    3⤵
    PID:5424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
    3⤵
    PID:5560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
    3⤵
    PID:5656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
    3⤵
    PID:5704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
    3⤵
    PID:6028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5584 /prefetch:8
    3⤵
    PID:5336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
    3⤵
    PID:5408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6924 /prefetch:1
    3⤵
    PID:5316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7100 /prefetch:1
    3⤵
    PID:3816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
    3⤵
    PID:5624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7340 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1776 /prefetch:1
    3⤵
    PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6404 /prefetch:8
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7384 /prefetch:1
    3⤵
    PID:5964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7764 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5484 /prefetch:8
    3⤵
    PID:5836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7516 /prefetch:1
    3⤵
    PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7800 /prefetch:1
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7276 /prefetch:1
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8336 /prefetch:1
    3⤵
    PID:4240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7456 /prefetch:1
    3⤵
    PID:2284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8948 /prefetch:1
    3⤵
    PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8340 /prefetch:1
    3⤵
    PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9312 /prefetch:1
    3⤵
    PID:5500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9692 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9580 /prefetch:1
    3⤵
    PID:1580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9560 /prefetch:1
    3⤵
    PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7316 /prefetch:1
    3⤵
    PID:2844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
    3⤵
    PID:4220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
    3⤵
    PID:2856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7228 /prefetch:1
    3⤵
    PID:2792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7128 /prefetch:8
    3⤵
    PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10188 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5608
- - C:\Users\Admin\Downloads\winrar-x64-622.exe
    "C:\Users\Admin\Downloads\winrar-x64-622.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7568 /prefetch:1
    3⤵
    PID:1004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
    3⤵
    PID:388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1956 /prefetch:1
    3⤵
    PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4084 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9004 /prefetch:1
    3⤵
    PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9020 /prefetch:1
    3⤵
    PID:224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
    3⤵
    PID:3580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2828408797466359091,15636266011766727015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8300 /prefetch:1
    3⤵
    PID:2372
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\README.txt
  2⤵
  PID:4656
- C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\Synapse Launcher.exe
  "C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\Synapse Launcher.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1184
- - C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\bin\jidLbB90c.bin
    "bin\jidLbB90c.bin"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5736
  - - C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\bin\A5QtxkSZgFZ.exe
      "bin\A5QtxkSZgFZ.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4252
    - - C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\bin\CefSharp.BrowserSubprocess.exe
        
        "C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\bin\CefSharp.BrowserSubprocess.exe" --type=gpu-process --field-trial-handle=3760,6777972425766955372,7322103989770565011,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --no-sandbox --log-file="C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\bin\debug.log" --lang=en-US --cefsharpexitsub --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --log-file="C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\bin\debug.log" --mojo-platform-channel-handle=3824 /prefetch:2 --host-process-id=4252
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3292
    - - C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\bin\CefSharp.BrowserSubprocess.exe
        
        "C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\bin\CefSharp.BrowserSubprocess.exe" --type=utility --field-trial-handle=3760,6777972425766955372,7322103989770565011,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\bin\debug.log" --lang=en-US --cefsharpexitsub --log-file="C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\bin\debug.log" --mojo-platform-channel-handle=3988 /prefetch:8 --host-process-id=4252
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2360
- C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\Synapse Launcher.exe
  "C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\Synapse Launcher.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5432
- - C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\bin\jidLbB90c.bin
    "bin\jidLbB90c.bin"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4320
  - - C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\bin\A5QtxkSZgFZ.exe
      "bin\A5QtxkSZgFZ.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4688
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\ConfirmNew.wma"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3936
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap13543:80:7zEvent28605
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3968
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\ZLauncher\" -ad -an -ai#7zMap1471:80:7zEvent20677
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\ZLauncher\ZLauncher\Readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2868
- C:\Users\Admin\Downloads\ZLauncher\ZLauncher\ZLauncher.exe
  "C:\Users\Admin\Downloads\ZLauncher\ZLauncher\ZLauncher.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4772
- - C:\Users\Admin\AppData\Roaming\Version.exe
    C:\Users\Admin\AppData\Roaming\Version.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    PID:5152
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1328
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 1208
        5⤵
        Program crash
        
        PID:556
- - C:\Users\Admin\AppData\Roaming\Updat.exe
    C:\Users\Admin\AppData\Roaming\Updat.exe
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:5396
- C:\Users\Admin\Downloads\ZLauncher\ZLauncher\ZLauncher.exe
  "C:\Users\Admin\Downloads\ZLauncher\ZLauncher\ZLauncher.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1176
- - C:\Users\Admin\AppData\Roaming\Version.exe
    C:\Users\Admin\AppData\Roaming\Version.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    PID:5744
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:976
- C:\Users\Admin\Downloads\ZLauncher\ZLauncher\ZLauncher.exe
  "C:\Users\Admin\Downloads\ZLauncher\ZLauncher\ZLauncher.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2344
- - C:\Users\Admin\AppData\Roaming\Version.exe
    C:\Users\Admin\AppData\Roaming\Version.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    PID:5756
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:5304
- - C:\Users\Admin\AppData\Roaming\Updat.exe
    C:\Users\Admin\AppData\Roaming\Updat.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3524
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Archive\" -ad -an -ai#7zMap21788:76:7zEvent9142
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  PID:5648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  PID:6136
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:1588
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1324
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2544
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:5320
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:4680
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:708
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:6112
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:5568
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2168
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:5552
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:1068
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:4360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#fhhcv#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'AppData' /tr '''C:\Program Files\WindowsAps\MicrosoftXboxGamingOverlay\uTorrent.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\WindowsAps\MicrosoftXboxGamingOverlay\uTorrent.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'AppData' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  PID:1360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#fhhcv#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'AppData' /tr '''C:\Program Files\WindowsAps\MicrosoftXboxGamingOverlay\uTorrent.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\WindowsAps\MicrosoftXboxGamingOverlay\uTorrent.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'AppData' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  PID:5796
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "AppData"
  2⤵
  PID:1276
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "AppData"
  2⤵
  PID:5148
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Updat.exe"
  2⤵
  PID:5188
- - C:\Windows\System32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:3256
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Updat.exe"
  2⤵
  PID:1080
- - C:\Windows\System32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:5488
- C:\Users\Admin\Downloads\ZLauncher\ZLauncher\ZLauncher.exe
  "C:\Users\Admin\Downloads\ZLauncher\ZLauncher\ZLauncher.exe"
  2⤵
  PID:5152
- - C:\Users\Admin\AppData\Roaming\Version.exe
    C:\Users\Admin\AppData\Roaming\Version.exe
    3⤵
    PID:3324
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:884
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:1660
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 2360
        5⤵
        Program crash
        
        PID:2308
- - C:\Users\Admin\AppData\Roaming\Updat.exe
    C:\Users\Admin\AppData\Roaming\Updat.exe
    3⤵
    PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
  2⤵
  PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7fff0d9646f8,0x7fff0d964708,0x7fff0d964718
    3⤵
    PID:3840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
    3⤵
    PID:2376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:3
    3⤵
    PID:3120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
    3⤵
    PID:1076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:3920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4320 /prefetch:1
    3⤵
    PID:864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
    3⤵
    PID:1436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:1
    3⤵
    PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
    3⤵
    PID:5912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
    3⤵
    PID:5292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
    3⤵
    PID:552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
    3⤵
    PID:2188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
    3⤵
    PID:556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
    3⤵
    PID:2080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6236 /prefetch:8
    3⤵
    PID:5312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6500 /prefetch:8
    3⤵
    PID:5564
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 /prefetch:8
    3⤵
    PID:1468
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 /prefetch:8
    3⤵
    PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
    3⤵
    PID:5264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:5592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
    3⤵
    PID:364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1
    3⤵
    PID:996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5136 /prefetch:8
    3⤵
    PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7020 /prefetch:1
    3⤵
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=8108 /prefetch:2
    3⤵
    PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
    3⤵
    PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2864 /prefetch:1
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6124 /prefetch:8
    3⤵
    PID:4296
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\Your File Is Ready To Download.msi"
    3⤵
    PID:5020
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\Your File Is Ready To Download.msi"
    3⤵
    PID:1732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2424 /prefetch:1
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
    3⤵
    PID:6740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7032 /prefetch:1
    3⤵
    PID:6996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3636069060966650351,2357687684548900277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:1
    3⤵
    PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
  2⤵
  PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0d9646f8,0x7fff0d964708,0x7fff0d964718
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,711233246329330293,7050469314592619873,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
    3⤵
    PID:1288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,711233246329330293,7050469314592619873,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
    3⤵
    PID:5044
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:3868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    PID:1980
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1980.0.1555518605\372173861" -parentBuildID 20221007134813 -prefsHandle 1896 -prefMapHandle 1892 -prefsLen 20860 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {93e123e1-b51a-4d39-86ff-5d96c70eb4d0} 1980 "\\.\pipe\gecko-crash-server-pipe.1980" 1972 2743a7f5958 gpu
      4⤵
      PID:2832
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1980.1.1075844682\1398459212" -parentBuildID 20221007134813 -prefsHandle 2352 -prefMapHandle 2348 -prefsLen 20896 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65787e08-27a7-45c5-b1e4-93ccc7bd410c} 1980 "\\.\pipe\gecko-crash-server-pipe.1980" 2364 2742dc75b58 socket
      4⤵
      PID:2500
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1980.2.1752396320\1470410779" -childID 1 -isForBrowser -prefsHandle 3240 -prefMapHandle 2900 -prefsLen 20999 -prefMapSize 232645 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {87a53f21-41b9-450b-97ad-c61f814e9026} 1980 "\\.\pipe\gecko-crash-server-pipe.1980" 3228 2743e0e8b58 tab
      4⤵
      PID:5924
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1980.3.434831982\937963764" -childID 2 -isForBrowser -prefsHandle 3464 -prefMapHandle 3460 -prefsLen 21040 -prefMapSize 232645 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a6ecbd1-8eca-483f-a0c8-3703471a3912} 1980 "\\.\pipe\gecko-crash-server-pipe.1980" 3476 2743eb04158 tab
      4⤵
      PID:4496
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1980.4.1463466174\762168855" -childID 3 -isForBrowser -prefsHandle 3612 -prefMapHandle 3616 -prefsLen 21040 -prefMapSize 232645 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3c466d9-6285-4af9-a45b-900aa0577b49} 1980 "\\.\pipe\gecko-crash-server-pipe.1980" 3600 2743eb06b58 tab
      4⤵
      PID:6068
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1980.5.1740902246\41034941" -childID 4 -isForBrowser -prefsHandle 3824 -prefMapHandle 3828 -prefsLen 21040 -prefMapSize 232645 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {66a1c1e9-7e09-4d2b-8940-61f4bdb69c3f} 1980 "\\.\pipe\gecko-crash-server-pipe.1980" 3812 2743eb05058 tab
      4⤵
      PID:5488
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1980.6.1760055378\163790770" -childID 5 -isForBrowser -prefsHandle 4576 -prefMapHandle 4572 -prefsLen 26769 -prefMapSize 232645 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b2183c5a-5c7a-4c08-8514-d8ff0e51bcc3} 1980 "\\.\pipe\gecko-crash-server-pipe.1980" 4592 2743f1c2e58 tab
      4⤵
      PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
  2⤵
  PID:3488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0d9646f8,0x7fff0d964708,0x7fff0d964718
    3⤵
    PID:5772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  PID:408
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:4852
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1348
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:5436
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1408
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:6004
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:5468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#fhhcv#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'AppData' /tr '''C:\Program Files\WindowsAps\MicrosoftXboxGamingOverlay\uTorrent.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\WindowsAps\MicrosoftXboxGamingOverlay\uTorrent.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'AppData' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  PID:4640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  PID:5484
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Updat.exe"
  2⤵
  PID:5160
- - C:\Windows\System32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:5420
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "AppData"
  2⤵
  PID:5692
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:3364
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1364
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:4100
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4036
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:5736
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:2636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#fhhcv#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'AppData' /tr '''C:\Program Files\WindowsAps\MicrosoftXboxGamingOverlay\uTorrent.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\WindowsAps\MicrosoftXboxGamingOverlay\uTorrent.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'AppData' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  PID:4952
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:1076
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:5364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5920

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500 0x510
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5400

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4208

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3592

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1328 -ip 1328
1⤵
PID:3056

C:\Program Files\WindowsAps\MicrosoftXboxGamingOverlay\uTorrent.exe
"C:\Program Files\WindowsAps\MicrosoftXboxGamingOverlay\uTorrent.exe"
1⤵
PID:6128

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\eda4f3dec456490e9441b6378ae1146b /t 4544 /p 2136
1⤵
PID:2096

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\53bb5ce154864f9591239d2c3e802b07 /t 4544 /p 2136
1⤵
PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1660 -ip 1660
1⤵
PID:3768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5172

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500 0x510
1⤵
PID:2076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4892

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:5356
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0D578FC5F0B0C13A5C5FD6897FEA3D18 C
  2⤵
  PID:5228
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9E3AF6E28DDEE71FC5EF377DAB384A18 C
  2⤵
  PID:540
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:6264

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:6004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Synapse Launcher.exe.log

Filesize
1KB

MD5
96a530fc8267c0b81f305e29b59abd11

SHA1
0b352ae803f8fabd17e1c0a58b864e84a3f26798

SHA256
a45c28f2204c97b7d5f9cb4fe8e827ba943aed11e7582941a50938208e1d5d33

SHA512
862672c177856a208e9fdd23099f9a2e15810f7562f5579aff9f9870e1acddee9ce1b2314a33fde0e388003d62e99db0d94d1dfd55b8943a30761a68aa3c3240

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8411007bafe7b1182af1ad3a1809b4f8

SHA1
4a78ee0762aadd53accae8bb211b8b18dc602070

SHA256
1f274d0d144942d00e43fb94f9c27fc91c68dce50cd374ac6be4472b08215ca3

SHA512
909e2e33b7614cb8bbd14e0dfff1b7f98f4abbf735f88292546ce3bfa665e4cb5ee4418561004e56afc5dd30d21483b05f6358dad5624c0dc3ab1ba9a3be18eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d5f13a4ab28b2da0cad6b5231175eb0

SHA1
732126b763c4a401d54dc1f50c34371ea3685010

SHA256
4e1e9b0a1466280aa812deff945f23a158d85af12fc74352271f14cf862d34b2

SHA512
2542e4162a717d10576a08e9a626b8016441e6efcc5c667d21f27eac82b0f125c4df5c406fa368d7302f302fd69792b6bfa620cfb4bdea6e8cd478a07e3d18f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
de9c7574e38c26633caccb4d11e4f9cc

SHA1
f0503cd2ba65c8ebe1629bdd7ae3b0158a38505c

SHA256
8c161171d3ce5b39dd81d4b4443a6d5009473a4b17acea70923193047f26991a

SHA512
a86c74d67019382eda1bcd7f6621d3e38cd938c7dd45a9106f8f8ffa75ee61de44d7171c1be1e2a85a1ea09275b545c80e93e048ef37790bd872c9c867a39d56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5e3dfe6d-ceef-46a7-a4a7-57c83b904092.tmp

Filesize
5KB

MD5
84f61de8ae7cb20ba3024afdaef93336

SHA1
ffc345624483ecffadd899c11f3020ccf0c1619f

SHA256
3f557954aacf95354f5f1ac394bc134cf7bfcf937ac20634c9756be63b4a08d4

SHA512
07b60690e7aa3337a8aef89f78c5785c319a873d106686c244fd374a79754246160656ada836c8f50dc163635d8c6fa9bcf21c32e9aeae36de1aa2762821c565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
21KB

MD5
f0d11cde238eb54a334858a3b0432a3f

SHA1
7c764fe6f00cab8058caeba38eb7482088a378f4

SHA256
579adf148a5905868140df9075b90a2ff33c9070dfd35b3ab869a2d9aacd9a96

SHA512
b3e590c88b462004b29ced18027f640addd1ea6ce9ae584820054ca508ce7d626acb3bd729e3693b50ccdc5e4694b1aa400cb33a315a475de47f5b25ed964d02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
69KB

MD5
a90d7c369b2a589d9034e9a201efe567

SHA1
7afe40e9e4002a2254885901d66451e2ab0994c0

SHA256
7cc054981e642ae7bcbdbc78152eccb11b31a6d922ea1dfe61e749f8985e498d

SHA512
befddc83828674c9993b8912ea83486dcb04389e0d7b45a4e6c19b6bb5e6e0ed2b16d9247c2e633870658697131c094864d3cdd9a2a4c0fb17bb503ad2915b21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
16KB

MD5
2da973fd622297cc786120db2c239d47

SHA1
e074daf2a90461583ff13eae788097fe92837b9d

SHA256
a057554231304c33cef72b03a7f1b4ebc176d7c2f5db7af40c240334a42cf60d

SHA512
76194c87dc13df0a5a1bca4711208209d184bd152c754cb776f5c6bc2344f933aaee468dd5edf2f7a0392e389f2a94dd190c17f7d1b7b8fb8a3300317a5d1fe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
88KB

MD5
0243d388e8b9f0f12f7d2b67e719cf73

SHA1
39bd292a8a602c774ce189103b51cbdbee85c14e

SHA256
f7a8bf314a7a54ef1a2ce6d2ed661c6ed9c41dcf756783254739cf72416c0c73

SHA512
c5dbfb863e46ecb046727f23444f1748b24085618e423d00a936ce6870a00a670c9fad389d5b95a1527713c987a73432b43973a30439c59b4f137388b544acde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
85KB

MD5
45a177b92bc3dac4f6955a68b5b21745

SHA1
eac969dc4f81a857fdd380b3e9c0963d8d5b87d1

SHA256
2db3b6356f027b2185f1ca4bc6b53e64e428201e70e94d1977f8aab9b24afaeb

SHA512
f6a599340db91e2a4f48babd5f5939f87b907a66a82609347f53381e8712069c3002596156de79650511c644a287cbd8c607be0f877a918ae1392456d76b90ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
1.0MB

MD5
2f072ea87570547fc3004165b030b153

SHA1
b853aa1f958048654be2511223df8e33e8d64ffa

SHA256
23d567b48c4c60d2e4e107d9ad1224e95bb3b3fa8af53107ed0c54e937258928

SHA512
52c834b42ba1cf23342fa8525fb9735b853d1f3e2f818758a04fbb3b160890961bea1e9f980e132429237ef260c04de65f92445cc38a5542246bca37f2ec55f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
49KB

MD5
3922331e0e997f6dcf0aee10ba3a1a46

SHA1
b2ba099048e9b6e0665698a5b465136ca33ac328

SHA256
6bdd1bdb4c2b92d4ec090c2bfae289e2b4bc4a7c579900e1415a6c0558a0a58b

SHA512
63f35b0218e0dff9f21b61ac9da730bee4aeaba3469a5bcf528e5d641eefc818c4f0bae3b17824a60c4852c83f7abf6b3f7657a90b56b4e8f39d8bfa0b70128a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
22KB

MD5
5f6e01473e3b909294f52137544b161b

SHA1
90a019fe71c15c7168ab4001e1a98b3a06f9d046

SHA256
dd8e88419667c95f8f1557e9fe3b1351444bb535fee99e5401deb43fc06060e2

SHA512
0b66da407c60ffcabbc5ea1e37113b48e31c6fc5e3bfe3fd50ccb9a1da83ae4c808d79d7a9b768cd17cbd2bff0eade1c49df8a9b49cfb76a710a3c00f6722ba3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
55KB

MD5
fba312478200b967723bf53e7f3defd6

SHA1
9ca9337ef4ead1686095143032f5fc6de54f207a

SHA256
28aa216fa4a1167ddaabd4cf981c541cfd3873cef069ed59a63f54b333af9769

SHA512
6e16c58cfa6381c30e26fbf17e61b64861c166280f0bfa2edbb85488e8cfe5ed56d34472be9fba10628a143eb9bc720db7d33f83e84a492bea9c8af3be4d5fce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
45KB

MD5
c2cbb38ef5d99970f0f57a980c56c52d

SHA1
96cff3fd944c87a9abfd54fa36c43a6d48dac9cc

SHA256
85369a1cf6e7ff57fe2587323c440ed24488b5ed26d82ba0cd52c86c42eec4a7

SHA512
50371320c29f0a682b9ae3703ef16c08f5c036e84d5056e658f5d9be7607e852adf72c13bf2d0b63fc492f5c26d330bdeb2ba38bfd8b0d4567f0cc6b0c0f7bd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
18KB

MD5
a11683f8a357e6209a75a8b370a64d0e

SHA1
e604d87484993764c8355c7c41f0f2958c66b5d4

SHA256
a12464c93e9fa5a774b30b54a10472c109e07fd924d1f5caa0512aade93968a5

SHA512
a57e75969b1f99bf1ea7d711af37320e52076eaaf6424eed252142c3b93e0224cccf6a28364323e1525d737ec6333093b3df33d8d35d7807e2c3d007fea33085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000064

Filesize
171KB

MD5
92f0bb21de86c6c660bb835f40365184

SHA1
ee7dfcc9328ad0560e1d9fd6a035b8efdae3d7be

SHA256
3eaea657e2d8557cc8e98102697e4fb358abfe10b4d95f8dd5cafd1585a2df82

SHA512
f52731ff5972853ab4cf84edb84e18373656f77a3ca1054de48ffffbf452f77e930e5d15e1c6ed0268ffc6bc5651a5c754d237c86f73e40e4848b0f57c91d1c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000073

Filesize
18KB

MD5
30b61cbf3e68bf8a1cb6458f3afc6268

SHA1
e64cb4aab324147557e66bad98ceb22143e9f7f8

SHA256
43231751cbac7c6da987588155e7c8651ba49d58176b89fb7006a68dbde85047

SHA512
057735b564ea9f173692b2b6420effcaeb2ff9e7292768a7518c7882d9b1f0ba566bfe9eb7a9f2f857257443a8c63fe7a4a49a907489a89f187198ba21346497

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000b8

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000102

Filesize
83KB

MD5
d5c4f334a1c398859b364648df4e7ba3

SHA1
991fdcc820cfa39be4f0a5432b9f5e8f297208d9

SHA256
c823515fbc357bb8a2e5f97f056ed0128cf503627776de7f52f6c6439878e128

SHA512
b4d3f3a21e8ca291ff6afe9a98d5e88f87b5aa9bad6aad00e0325df567c0b0d11b1e6f0eb8fe6cc64e9038b1d4a34613486671093259f057eeed73391bba9d5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000113

Filesize
76KB

MD5
53d0883fcdb958d4360b85251b310970

SHA1
4084772bf8da1f0fa45d621d5d12ff0ddde62ad1

SHA256
3bfecfa4e1de3fd70691dc338eef707547739788c2f4e6e62a1a1c0c0f7d281f

SHA512
73c0949d2099120aec33e41c5bad79a3784590b563a344fb12b72f66da9817a88d8bcf564ca822c3554040d3a28ff1d827e6c19a817024c71738a7ed7c8f02bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000115

Filesize
39KB

MD5
faa3a154338e980726fffcb28c948727

SHA1
50d31abf59b099012eed636660d7ad5af04d8a13

SHA256
7d6352d3942114b1f2abfb9daa2d9fe28c6eab5f058b3ae7237ec539aa00004f

SHA512
19307753ac862590c298230e4584d05b57eeeb921b427b434fbf183d5bf43960d749e1a762dc1bd7656090f846d4878a359cd8785920f2c68930d8ab48d031d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
13ab306aba30663b8edcd502be171ebd

SHA1
dc770ddaccaa6468bf7ed4c930769a362d779575

SHA256
f25d19afd6e63ebf5c4e0752cbb6277065221cf06d6937dbaa434ff14efc54df

SHA512
194627f9af5afc1b7a8a0b11cef05d07b65651e7fc69cab171a587da04e3da7dddbb4aa593747c38fd19975d6c049ef35fd48157dc5753499bf629261fe958a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
03669fa22dc64f3a6ee4d4b86af8c1c4

SHA1
6e8f49719157e2deb809405b904bbec98ad3ab45

SHA256
b0d1f99db1038b5a61d7f610e8e727516fecc655948aa40122ed5112ab541962

SHA512
42911ef97533388b2c9ef4e8eed909482841552fdaa4753174fc09ae48f59bfaf55282364b4bb0f7df5207a5be16af56dce83d898a069a79b3bd06c5f87f02a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
cb74a3609582263a0ab09b0dea097cbd

SHA1
cd22b3919f768e5368c779a4d87062304a290fc8

SHA256
1acf682d40b15b08dc3edf0a0203bb2b30760787c52e8dfdfdf20cfaab669a6e

SHA512
ed84f1660e948c6b5fa06928d350b9509946c102d2ee51273b769ac5dd90f8f393ecd190ce948480b7dd1432dee8f142379328298ef79c2d994f41d40dc2ea9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
56b14d9e96994c1364b74ae2139b0f2f

SHA1
f8fdef9be95a1dd6fc7493a9cab1acf4759c543c

SHA256
4b37bdf452843872982480a763cc1298051dea20003fecc01ccba3c6956293f8

SHA512
9ccd36b4ffead3c789f5a0031930326c529fa17cb6f6030d28874b9a4acebff3d8df196d8519c3446bc03de6a71aa622a583d2e2ac32efe714b867f08daa7b97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
78279a27473989c93cac5a06f83aeed6

SHA1
e45d12a4a369621d9b17271dc2e87c00be852cc1

SHA256
5af2852a1852720e75d622c049e1dd6afb1fc60a0af11cdb62e0f7db9ea73a39

SHA512
fc08c5e0115ff04b6e600b67abddfa2f77aeded99311bb45d4048c130cd783fc6f9cbd220b13e320583adbc4099fcd2f47528263f7811a2a9d315079de590d41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
46d90d7ee19854ffb53b187081f94825

SHA1
8b455684a0327a52613df4b0be5bd368203c0fbe

SHA256
1edc26cfd48cfde196e861344737230946e3ebf18ee2eddc7e3e4e0e424e99b1

SHA512
9c53ba4e7639ed1638740849e402389bc2ba7f67bd8e61e3eaf87b02ba5fee340849d8583400b883ebf84cfa41d6cb5fc3e5007cf6e62f81bb41af9cc52d9838

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe659863.TMP

Filesize
5KB

MD5
198c96ccfc82d1460f1e1fe7e3b343bf

SHA1
1dfb8eebce0dab7b8405a884a11fec8826851922

SHA256
8ad8034ec9e99a243a96de4cdd471316ce4d23bc3009db05ab012058cbc078e1

SHA512
e3bde5687b3e6544f1e14cf5902afedbcafd461bf30e6384647070507c9411c8a10824157eb3725f55705a9ff8dba6812dc7eb22f242d17fe5cbd52452314b64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_googleads.g.doubleclick.net_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
a36237bc682f8c7246904c31022a9777

SHA1
beb7b920d1112768b433562e74db8a24466745c3

SHA256
e51f10615db726621964c1bf99c446cf6cf8a1da0ea547baf04feca47dea51ca

SHA512
b2fb680d427d19bc5d5335064fbca607c0ac37d9d04dce48a17049c0261f15d6c5c162cbb3ed6ba3e8f4851d4aa0ca788ee030699fd1ac98351c32affe526851

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
16KB

MD5
4de15557d1caf18241eb31823a4f8285

SHA1
2ae2d1884d0de2c91c38038c86ef4a4b27211939

SHA256
77f41b1e3d7a5d89505e4063f7b50072f6b34df4885652592f6f442df071c866

SHA512
c889e95be9a9308c66b9ffff8ff26b2b2e4f13acef0156c1fe794432b75feb22bbf274eff2cb8772c5caa16e28631f4086f40f64112701f1a1b36225981da689

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
21KB

MD5
525847eb3cca3f259f4659873f9eb16c

SHA1
fad137b7a760acbd5fccd4b0fa77b4868ec4ea09

SHA256
0f16d91811bc48fef347649436ce662eed8d1da799691d96a659d81f6c80ccb0

SHA512
125f8d4976c07e2f98ee1aa0e17573dbf28869f73ed0dd8d5418ffcbcc0179db5342eb771bf2bb572c700f93e8a715617e9bf43dab18624c88ba682cb0583635

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
22KB

MD5
bb0138350bf34b533a4ba6d95f8294c7

SHA1
aa4f99301d7f446284867702101fe02f1b288ff8

SHA256
2e8ea7a9bfb2c797132cdf185a4e82c1264e53682d2a50968c56731dd7fd1f5f

SHA512
63993fc9d38755ab259aa9a902ee2724f895b4d1f3e4f62ba834e7a8fc2ddca530fc1de84d8bbedf9c2240bf91a71d36d85a1afb2c8e8288920f73f1aceccae2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
15KB

MD5
d5d33490f05075a771f0cbb2708c8478

SHA1
55adf37b299d45897fe8dbe1c9e6be914db022bd

SHA256
821b843387936e09f0a49b729557143ccacf10c86a5398f7b2bbcada69461c72

SHA512
d642db00c09e0775eebfc4ca01c35190a837aada7c7dea10b2673b612b57d696b8b568093788486c53aac0c716cc05aa4f42b5f9af126625576704ddb6a24e45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
15KB

MD5
d82e7bad24d77c24befc0a28bcb1309f

SHA1
543969aa80b494439b58ee71cb2f0443f14aaf22

SHA256
fa757455f94ac864cbe42ba9e55c50412d45171a84c914eae9a4f72899924af2

SHA512
c643603a9a5477e70fea2ee95296376389d9fd4db2266160049040d6151bde6f6c0239731f28fbcdc363e728cd5cd13e3c1a75c574a6132750377a5cf166de3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
20KB

MD5
d4bfb922f230bf67e392680b1ab17fcc

SHA1
8a6368c51621b5aebb7332c4fe46f70e037c4326

SHA256
ae865353d15c0849e834755326f8b9c29a660a847fc20b99313f1e799503ce85

SHA512
3edb4bd9368fab6cc4b254d01e89047145887b5c6bac3899aadc26f8c804e6fc3c6e29054606167a0e85ba115a4975feb3f5651068509b95f0b9fb764c40a600

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
ae8a203e42099d28cc53f9a5d9e10532

SHA1
2a6114e5f70bfd58149be44a5dd527c25c7b7d8b

SHA256
6c04a8ab35c0a49a04d52f9f2f2965498f722d55e30e862ed32fc2015bb898dc

SHA512
511275e85ac2de26868fe8c3aec6f7d38ce0ef92176b5759a4c53986a1becb5066ee30bdd0de643032b32e9b9acc0de57aa0b1f6085d822531e4f770020a6bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
ce32d55a2bfaa95d371ebed875326bb8

SHA1
193a8cf0ee1556e89958a976944b28c7d90cb4d5

SHA256
fd3d13282a6ac2bb2de0c806292e5738b1cbfbbb89753f694b68f15efcca218c

SHA512
f0dc6f12a3f5be9f52907a3119e504dc25360bd15af8192048b4da3f84151f73ecca51f74f6f46ce50d73c21d461f8ddc78c9ee1a3cafa5159d04b54525315e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1ed99f6b242a87c783f31a6d06f82857

SHA1
fea7cb4853ac51b7c227db008837a89bcd4b9fab

SHA256
226eca038b97916b340dc14ba60b743be230c97321fd14d45194384bff7f223e

SHA512
4cdb6af1305c5a8ff1bb62fa0a703e088bd75ec9346d608728779ec35db85f6d8a30d840666c92e2a693a9df633214f9775664eff1495c4a9087aeb13f057f47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b9aeec71635b929da4800c2097115817

SHA1
d702b4ad6bc0f8fca9ef8de60950cd6e4657ac47

SHA256
3e4269c7a2f549cb04e4c22ec1ff01ee5847fc309738b683685068961fb4804c

SHA512
3ce92e06a12abca03e8bbef787e6737c6286d513f17ec68e11fe1539085f03d5a239575d5f2a72212bc995f1535b63999aeae87832b63ff975f6f15fc24d1f0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
06a2dff218aff0b210d09e0e20447bb2

SHA1
9995897d92fa5693e9cf9372d75faae393800ba2

SHA256
317d983d722824d3d89f0a280811fecefd45bfd7b9f0111f3a4cad567668853e

SHA512
1730243bb8e19fe4bc9575eb5875f5e77612321ec8025bf263d0a6a8a8a507d2b5a22661839ba23bb10008529ba796ad4419783780d7ac3736d882dc45cd1905

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
47cd697c92826ca2b391d771ef6fa823

SHA1
7cac30bffafe9b6a347b5ce6e179130a3bc2e819

SHA256
becf6d33a6a799dadfd3659e8479d03ac8d2773a6276b725dc7379a21bc31e94

SHA512
d7662ed460ec7c53fa1f2344d4a81f8572f78af22632e565318cea255c2e5f919d4c4c99994c7afcd855eaa7f7985be05311da3e4f5a06d751f55bd92024aa30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e3cad44257f363e779655b9cc0e02607

SHA1
407b262a753bd35b5131715424f02687412da99d

SHA256
75dfb06df4d62cca4cdbe81cf648753c6d2c79c221a7a124601e652977b99ecf

SHA512
8972dd48e920661c46e32e48ff54900f9e61f6342a61bab791c0c483f13b74bcffb28748da9a9606e1624dca5daaa4bc2b781bb80d232a58f745934d38870f9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ba8f8c4c4ab9c70f4307d15dc433802d

SHA1
b70cde67558cf38cd5ca45fcc67952e90e7a4ad6

SHA256
58b86aa969ed5a66d1f84769085785a78cd94f1ed40a5f5fa0dac340268c9f97

SHA512
0a6d4ac96744e0adc78eeb9c29d74c674b2c9911fc4d2d64e20422f23123dee5e2cd1a2e8a9b53ace6b2271ffe3adce55bbb25bd7f4a10850699fe14da13ee36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f5f524c1d3bfa0b168e983782ad9e763

SHA1
58d2a49b45801c195177045a24910969f00b1f7e

SHA256
f45eb9ffd9822bc5a13080b6ddf96d6c020fd53c65e5d8dfa73d28f1c6ee7382

SHA512
054cf27c1833dea4d06c1fb9be3984cdfe44d3d3d80b7ac5a033fc6cf610e41ae8248fc357cf74e4d955c47468b92905b6d38fec08af339147a2785616023f85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
0116789fef1f367b81ff1e07e319b094

SHA1
e74067f465a779b2342ee08d7635ddb6aafb89a7

SHA256
8036824d09b3cc15ee9ade691eb30f5e9edecd966ee4d5ddd96f46d33512b2fc

SHA512
098499718d81a5e9ca4f9bb2795353bf5adf545abb690aafac40175ada60a9ce2c151bbf47a8639c0d250f53351111c1dbf2aecd7c217319d75efe188e13e7e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
d018546e6831142213f0bfaa3123ae36

SHA1
23bc10ba5da6e7dc914da1030dc8c709ac403c3a

SHA256
d72577ec3ea2345114223de5ee860e0e673240b66480d042963153b89e1940b6

SHA512
59c35fc6aa636b0e579048cd03e91008447db5b797e75a7f77a40d03a5982f293f1709855222b3d24d20e0560731f873df401cc20ad084496de7662cfd93f179

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
53c3159117593266cebcd7be6f28041d

SHA1
26542f0fee019a428bd5848681de7f702eb6b7f6

SHA256
d375112eee26add19df10655953a0319dca01f7bebcdf9080bb25a7694daeef8

SHA512
23aa40fd2f3574d3923a42d504c77e23f3dffc61e0ba7c435d662a81c8d0f4bfeb8eba78b2057b9ace30e70e858ba8324e6e445813dc906b42232c19016db7ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
3be2540828afbf7b7c6f34ba51aa1a16

SHA1
b7e985466c11a87469ddb911c2c052089c196f3c

SHA256
a76fccaf529927b590601cea47fc025ba42f3af84d4e33e9f0dcb49125829ed8

SHA512
03d420aef0f21bcdaec919b5ae825eaf78569fc92d68df80f16890e2afa33124035ac9859b4b4ad67daa23ea5dcc4260231daf7e9fc25228ce3e338eec452307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
56f578a60d04d2f5f98aa22a49c5414b

SHA1
2a7b658cd828a38815fb1e92ff85a3915ba032ae

SHA256
d1650e495549b751646f22623749a5cfb5999961ae42cb8b28e3fdd2aa337b54

SHA512
5b2371e63316f8c29d59b13e25a0bcac48af7ecd3d86b0eb43dfd71329eb813d1f3a723969ebd2cbd79f21c5998c4f2b4bcb13cedd29a3e335a375cf9a8a8a18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
dc86edc3a2a1aca2d202f9fc399b70d6

SHA1
eb123d134c27a9b1c39a641004875a9deb5bb0d4

SHA256
63a4a5fdb15ce637416c94fcbe0b96725e7cdb6cb58ba1e0ab5691bdaa87db92

SHA512
5578d75d259d6f9d0ba43a0ebdc23eb6eb987226e837cfa33f9ae04292a8c100d86551da87081ebb67d7133533a64279d449dfdd4a4927e6a1c058d89ce697cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
6ef35c9ae85b5fb32aff8b243cf998f9

SHA1
1c5b90a6093016f6319c79a98347301f8311e0da

SHA256
d8494aa472976f033ba53cb8b959ce4d237e3e4ae4e94246b13d856bce39a39a

SHA512
c6ae9f9884c13b33d7e90074ee8ddad8b7043fc9c4a529c520196c0577754af16722e7a42d42f1c299c4a16c421ae4d4e1738f69bdcc1c88aaaf1298bd027b7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
9e95bd5dae88c66773cc2a9114ea3cec

SHA1
96e02a311ff8033cd8fc33af1f87404ef2ab0e44

SHA256
98cf10000e1273853ee0af46730e4b0515ca9aede81f682db456338ff5ff9481

SHA512
19a181801ab89bd8e4f45062bbd1cdff441ddbd2b8765d3207ab6aff16c7ae59c57d90e5a474e2c5bf1cebe9b867beef4a985e14b750e13ad172e9f3eec70aa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
0a7ee89caed0c74a6416dffbd3f9c640

SHA1
9892a6a8dc72d33e36e8eb303b4192896d2e2320

SHA256
a8dc35e900e574f3c95dc6f3279cef3a8de94b86d4bdf531010491d0f50c99c7

SHA512
5b452a9ec222954d6c754511ddbe8d8d6c5655ee64ccfc5e8fa8f103cffcd0938988a4f51fbe11e30a1fee370287684c1e19368c26af25da6dbb334c33726cb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
7586fdbf0620ad4ea3785cd3f0978fa2

SHA1
7f14d7eb2a6471b1cc55c4212509e3672ea20bff

SHA256
55d340b4b53d0e09bbf307450d9ec17a7887f5347acb7728fc2097724ff12801

SHA512
ea9fce4a301e6ade18e9535ce5401ea6bc6d2a6d8d306505401cffce2a1e9327e0df9f0dc7c5b9f3424e9797e5231480b52856d73a97762828af8f49554053f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
7a65f9e781d188fd5b161c06458fe82b

SHA1
3486322f7d0effe794922b745cee23e62a98d94f

SHA256
d9de8583a9fed33862ec1939d0b579dfcdb36c7c4e6e3964d4232ac93b802a1b

SHA512
4d4c3ef19368beb03b995405ea5b991f6978a10157c83434ee329fb62aafaf3ac83737b9ff5e4e2673bb53476174f1448bbdd63ca21c007f8fbbbcb7b0ebc243

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
1b323303b79b848fbe54cc3b95bf558e

SHA1
7706f4c979f951ca2f6dd2513b593c4f64d8e595

SHA256
309a21b3987f4452d83de38e03c06a2195ce5b796b687036369696055108e5e4

SHA512
31b9269bf5702ea95065e58f51bc838d0d515caab2e2d3c2f509e0f6a73548bb12ddd022944cb49994b1fb40c4a0243c68efa5e4c7bdf5a2d2ae2adda710a54c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
baf1ae0831287a9347165dcf0549d231

SHA1
dcc578d8ba3e2738f810f8ec06e3caf6cc2ff31f

SHA256
80416524b447561c540a5470c5de1ef3e25bb39683b7dbbbc5a83245997c2544

SHA512
a6acb5b38fe28d84609e9e896d46bacab2787e02f407f18a317cc80a04917624a700ce93f2641e876566c4c4d08dd408399e8bb571e8eb26233f9aeffd592773

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
ba13a67193d33e7c98364ce96262c483

SHA1
5f68bf757db01c292af272276b7029d1abd61030

SHA256
91adeba02731b47df4e5df7a7b7436cb6d8868e67bb84bc471d50fcb52329bce

SHA512
cd494e86df5ba3562380fea308a23bdcef7f8f3cb7500c7afa9593a8d00eb344386beb96b299abfb7ef477bc085b700eacc274c5c93bca302d97ff6234a3cb55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
02970814e3f6502c369d5d1457939974

SHA1
6cf97b7a33bdf600ddd3ed90b7c07dfd6127e205

SHA256
95dbc244a49ae0870849c1cb67daf0e7f56bf0338b498b19c8c4ce225ae0a360

SHA512
64fcba9c7dff5682aa7f5bfe376cad5e424c525c49a73071db1788598bf7934c486f38833f132955eae347b409e00ba967dfb61c23fdd5726c63bd7f869dbc9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
a121290ade03fdff600bb487f5952878

SHA1
4d7ec74e3383986362044f336183ef76db68e392

SHA256
70917eded2644e57979137493e723e728b905431384f11361c2e5cc99fcd7fef

SHA512
8ae47cc5c48d4cd772bd327b8d1bc3034008532159f20867fcea865b3f5acfe10135553ec68fa295e3912c7407a2fa38e69381b83744aec0c176007ac06832bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
6e119253495b7fe36e5cf3f39cdf14ca

SHA1
008a34f1de7f4d8ac345f3faa5a0699e6da5201e

SHA256
b704dc450ae9d714924868bcc21f5e9a9a78ae4f48c65f6cf9722886ef3d2ff8

SHA512
7ab4110915580968b0fdd11202e898aa6177b8685ba10614beb454c42e43866ed813e5c127b4d223bb7560658fd16e3db2e2314a1a232fd2efc959e28ec6a898

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
aca0ab9b6f403945bc64b37a7233695c

SHA1
28ae070b758b9be89a657f91f8f97fb116bcfdb8

SHA256
a35bb8938038bd7dc4c553950489b00128c494c74ff39439fd77b02462a98783

SHA512
868ff5b5f1ce61f37a11b1f235bd29053821ec2cd1bc830678b8f8d12bb9e3f7862c6cae2c7a6ca7ea3a6c75faf87fd8fd1b2e06467ff5d3a13e1139ba5b0087

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
55e86ce736ac1f5126420677d178a456

SHA1
c5182b0c609f5f414b0aacbd4db6c73ab67c88a9

SHA256
a7943849a4c47844df091fd381d0596af10636503b1452529c4534a3deaaeb86

SHA512
bcadc2ceda0ebc6d08e543b55acb165f44af1b8572035aaba77b8215ae89c2a7f8f0c94696153759b946bd9632935701955dcc5ef8569c445ae3bd0ee27b1b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
341171c8fb215fb40874b3770d0b565a

SHA1
c129f9193f5e46d9d69a5d8eaee40f95ad4cc637

SHA256
ef2cda57a3371eeb4f28ed41a00978ea46a7dc2421ca00eadc0a5dfb4132d788

SHA512
7e53001b11b0abf6a3c98679bbcb6e359c37bbb63f5c7b9adc85e06e5780b3dfab4a341b28f0959545d5f98d22dc16e577ba583c39a354e8b508a9be5fb872c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
109ec39a2fda32f88e2ba81c192b442d

SHA1
e07b7481791e1a6724e8a0d77737f26ce57252d3

SHA256
5befdb329df08bc4175355b8d0aa773460d8814496b189be7e2a4ebafde7b2b2

SHA512
a1838f12ec0805c90223855f52b7ed50551e774d0abffda9dfcce42b37f1c0956acf878ab06cbae091ff07cc065aa618d44e2332104245224bb4efc4251b0507

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
62feb07ca3a232ea06c3a7f3248142ab

SHA1
c39ef517e2522a8f4f6c0d821f7b6a7121d11d5b

SHA256
eba6d027939bc07751f6d534a4c3ea6a82273422b07f6424883f51d6b8edce26

SHA512
cbd30fcfd90cad3f3fdebc1ff30a23abb753dee987699aa78f8c15e8087f3e3e2d44c194652eb093c606ff069fda1a1d6d4add1aea41093890491dac21289f3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
8caf4d73cc5a7d5e3fb3f9f1a9d4a0cc

SHA1
83f8586805286b716c70ddd14a2b7ec6a4d9d0fe

SHA256
0e0c905b688340512e84db6cf8af6dbdfe29195fefde15bd02e4917a2c5fda8c

SHA512
084ef25ea21ee1083735c61b758281ba84b607e42d0186c35c3700b24a176ada47bf2e76ed7dadd3846f2b458c977e83835ced01cda47cdd7ab2d00e5a1a294e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\205adaa3-88ea-494b-8fe1-30b21346b75a\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\259d715a-d6c9-4f71-8bce-ab039122b46d\c724db351fbc8cfd_0

Filesize
2KB

MD5
e03c210215837669a9118b6a38f9b411

SHA1
41ee986ea59acc875d8964081806bb21b8c29ab4

SHA256
35bca6ced71413c00d0810dfba8a95d4e67b640583c79b231506698ab18ca276

SHA512
4a03657b424b1748da92bf89ee8ef4b64191bf6217ff43b04f30727fa23138441892bf29a3b224468c5fc81d81dce7d970682c205db3ef79dee57de5dd2e74b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\259d715a-d6c9-4f71-8bce-ab039122b46d\index-dir\the-real-index

Filesize
624B

MD5
ab028cab94eb7bc2f23b2771047d5b09

SHA1
a431229026f77fbbf0bf69dc91bc41bcdda50e89

SHA256
7c14dec55b225a92f756b053755e436a13c5feac7e075f66cfbe781815ed92fd

SHA512
b489dd508bd33bb42bcaca0f6eff517d5056fe8eb8b5ccf45f264d3e6003b0fc7d43bcc65837b86947e51dd1e40834bc19d3f96a8776b934ec16b86c25dea2b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\259d715a-d6c9-4f71-8bce-ab039122b46d\index-dir\the-real-index~RFe58ebc2.TMP

Filesize
48B

MD5
7b13a4411121b1b0eaeafffb5b8358a2

SHA1
90f9520af47a78edb30b3658072acbbe86d47ebe

SHA256
99545d9a4010fb7a894b13f30b8869f60af8dec782dd81930977922695892e8f

SHA512
cf7134670800b2a7c8fa195a25303af9116849b8a71c865f93f88621140adfc56956aee3d679224754e5f5103ac68b17511f0bf50698735b08c79149eecc085d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a7fb78a0-fec1-47d0-8187-4a8d175fa070\index-dir\the-real-index

Filesize
2KB

MD5
a11214eb8320ac35c5e099dc43112669

SHA1
e441660c27246d18abf4d62690a86153d0395e1c

SHA256
c65422695864cb406a784e268e1d7772bca04c5bde1faed75d2045f96a0de4af

SHA512
5a3967a5561f932bf00ebada995a9b007fc7daa4be7abc30bdd25b4f85fa55e17848dccd9ae45c7507dd5625869b84331b8665a40e8a7c627fa061379cc8ee0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a7fb78a0-fec1-47d0-8187-4a8d175fa070\index-dir\the-real-index

Filesize
2KB

MD5
2f8b46fb08a3ecb0c951ce1c715515b2

SHA1
7bb923284c1533749a94bd4d3509de3e3182b33d

SHA256
eb75215756b007f2fd80a361e50d62a8c45386245f0aa8f8195d1d7268d019a8

SHA512
2fc75aace6d355862c6fa0bd7e9cdb422ca01137fb0f5835cd64c18bb48c4d8c79b92000d906bb9ce7e58c8764455267510cd2a4fe28fdea9c32b60cbab70487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a7fb78a0-fec1-47d0-8187-4a8d175fa070\index-dir\the-real-index

Filesize
2KB

MD5
aba0ed9a2737dec2f951d10ac4b1ca05

SHA1
1d3e6a6dbba82836c299cbb40c3fbb961496bc84

SHA256
5cdd60da7f8e42fc38709b12b4a679cd2260b3734d81baab6f2d92280c555de2

SHA512
a662e7a4be69ae83cf5fd2d36339ca2a1aae3b654429f597774c3ad371e298ac321a356dcdd388379a3f28efdd502cfab55b09f4e1dfd6cfbb8b217a8404a9d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a7fb78a0-fec1-47d0-8187-4a8d175fa070\index-dir\the-real-index~RFe59482b.TMP

Filesize
48B

MD5
ed58e3094961d3ee17fc2873302e730e

SHA1
afba09295fd49891afe7f5b8cef4d365bcc630d4

SHA256
85c1c086ac302a2807aa651be2a43e2afe9097e1d25f978cd71e7fa6a0feeae9

SHA512
5f4eb4c8f83dc1d4cc4ddd61d324966d2bb348ce0fd33fa5b6f9e436cb866e98d1da272ec39f02393412ea4ad0bd126b4c7fd09f996de6cd5748ba9552b68d7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
90aab2fc38b720777cb6edf9611ce3d2

SHA1
f373764c24ec2876921b1c2328f6f446cc3fcec2

SHA256
8939afdcc022e98ee093aa2c78154099d203e89f33c6ad3c4931023cd61aab9a

SHA512
b05f27e3bd17b7bcf7332861718abe23221dc9eabc94d3718ac2f9d6c14ec8acf9e4b66df260667c6416ea2f9e766350dc1dc20310b83533289571bc0e00bb84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
155B

MD5
c7a8e5587ee67ee6d6e996adc77a1567

SHA1
16badb8dbcddd27f3a4200faeb139c1aed889916

SHA256
20f79b59234ca9154933e3c81101fa5bfc511b01af7a6e0aed03bdf12448d914

SHA512
a7470768fe42584847f950699ec34858ba3b636b0424bfac1fd1176912688e0cb7221b93b171e4f071c7677ad5ded84c0f9de6db01dedf97def60d74561a419c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
f0ced026ac76b0739fa934a1d638fd1f

SHA1
8db0cb0f4d513d6a39a1bdb8b487f1e924073bd4

SHA256
ebcc1e25e948c6f8cbe129b062aae82e354a84da9aeef45d577dfbf95ca87a1a

SHA512
d7da5a64f3e9d0eeeaf7d2fad7e107817026faa66a5c3b4e38c8588566a61e4c76f1be76c624fe7a266731db99a6b24b58a4be78825fa7cd7e80536809de1690

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
f14bab72e1a2709e3f9e5e14e62c9b0b

SHA1
ef41821cc493f82798ab72753124c89917aad3fe

SHA256
e51487926bb48b18580baff64dfcf0d51b468c09d4f54a0ac08b87aede64c584

SHA512
9a2f355aef1469a947d7d4bff7c468d9cc8e40775cb584cd1438d2d55770f0e43db2619cadcf8a67c825ef38d40d2355327ed9de535d61993fa4d703a38510af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
217B

MD5
636a723d6339be93d1d341e54303a5b2

SHA1
709e734b901fc46fc5a6c85fc8784aca7a6c722f

SHA256
bb44df5153f27500c0042ce5f5cdf37c12adb35df1edbb5dd896141c655b9fdc

SHA512
1899bfba2cdfbd04d11a152ebeb9696c14713c5f63097263c9b5681f938efce319efc3234fa588ea655f78cd767855f266d84a6ea4a5b50c79aed2ffd9824a0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
741bb1589597d146ecaea1360854d060

SHA1
ab47cf086844feeadeb4c433ccb3eb0f8b9565d9

SHA256
4e99a29844080eabb519787931b245c73aeb4660e5699a6a5c99f13eeed82b6f

SHA512
c18a6667aa4c94cf3eb925f1694254d81ae77ea3a2f4f76423bc096314f51c36956b9431234a5614470e837dc0360bf3d1fd645d53e4a5bc607aeae125fab71a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
028386f86519f47ddb0baadbf793799f

SHA1
9dc5e999c246ef520896c93d81c69f710e7ca292

SHA256
42d0eff60efbc4cf939c7990a623c1f4689be448e432b6d66cd58afc14f900df

SHA512
347a39e4c795d395b1ad163487de9a74ba606dcb693c4898a635c5ef43883bdc6ab7d8c355047adb25bce738bcd6334c22cb686a2e3bee6a7838de77ad371a4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe58773e.TMP

Filesize
89B

MD5
77bfe9e583f336631efbdfd979a10a93

SHA1
cbd058e5198af7e570d75ba2b6e032f2b80325b2

SHA256
fbfab361b3974114e36d038de805eb180cd1a5c77ff69726415f6e984638aa8b

SHA512
1912201a644524da013242e8b602ef7ee73615cf29f19468b0f94ba95718c41119dd507d496748d64e73c7f0f9785cbae5497f0902ef72a973a478afa82dda05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
6085afb4d8a92c01647d5d811e5dd5e4

SHA1
759c35c64f4b39f431e9683ad02f643848e4efe8

SHA256
529b4fb154d2eee3cb90b078538b386c0bee5703a321b9a9cce752cb23d45659

SHA512
0ef960c2e97f08a08e84fca848107f1b6d7cd92b5b24411d5f3c5cccf326aa111c38fc9435dd720d9907a724f8be718e7e0b4c29508e5252a5ec0bc1029e33c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
20d41575180cd1c2a675a5d648e05f4d

SHA1
e2423be7f23fd0d8f60c4d322d28c3a9471f8d39

SHA256
825740152934ef992932e51df4db3ccdef0ae2e2da20a422799ea8b84c2d7fde

SHA512
90044bd93baec89c1c1a85432d3fa0388004dec8dfa1e28bb07d4741c8d90829d1c6f7cfa0cf7dfa91109106e303fe6db8dcabb4b07cfe986f23c13e872ad442

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58cea5.TMP

Filesize
48B

MD5
8e26100d2a27354196caea08752a6c27

SHA1
cd19452ba71659fad3e8b431b4d60bf22bea8c7b

SHA256
a9098c030f2c72ad65a6d7a3d82a85d4730a435f6d14debd9424c7985a57c0ec

SHA512
1919d70c23ac23b7c754f0b2904b7d207a7a455afa451eef86703f647441ff87b6a5ec8cdb878693495d52a1eab32fcd4778c5b1f41cfdb9539c7a690b72efa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7e26e82023fef5a653796ec6ea2746bc

SHA1
a2abf2b466b0780cc9eeeee6b769b9684525697e

SHA256
afbfcf6983b48ab1be18be1a4fa9179db1dc7f0b51d20f0aefa871e3b05901bc

SHA512
c5fee46d330a2ac410981a582ea20a26e09d6202045ea2105cf77a98d67172da0d05b474a8e6ebec4125cfc0baa76e37eeecd274d52a29c47620af72952b3f01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
142f6587ef4cbacb3a239dc000116197

SHA1
7b6b0b533d9d6853caa6755de46f832c95b229e7

SHA256
05d99da0f93cc8eee80b18b2aa05a909132973c23198930286cbe1f38e9fc939

SHA512
5a39cb2119f8b310816486a7532e2519953545d62bc6712fc7ef91b628717ed2da5d7487ebfe25d3112b518af0cce2e23ddb459aacca2ed44b33d8db6aed8e1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
6979f83853bfe34d69b1cd72d499cc92

SHA1
b8b111666708d5483c69736d9ce09db3123630f1

SHA256
4b8cfa916fb5fb41d154c211dc487b9d69fe77ae74f21e2a85e0258fcf84a8bb

SHA512
029bc00cddd57c7e448ed68da449e6c9f8e0053036e2523ebe037adabdfdbbbb37470ae62ae609024c07fc10e7f623247fa65b9b1b07664076c9000cea86b022

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
d059f7cb7c691205012f1f73fb7910e8

SHA1
7bb2e4dbb52d60aea338428b0a1842c2844d1028

SHA256
758dd3f6d13515007214faac096a3471deca07ecf99dff76b76330dee58c3e1c

SHA512
5ffb599498151915aee975870860a72a307407d708081edf83b8048cc7e9710b1aa9d4ec0ff986ee24c362a0bcb08edc64d37eac8d07b5ed7a4b03ba3540fc1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
82a94ff1ecc24de848fa8bdeeaa7f316

SHA1
17ad54a99442217dcc900728ba423ea4329e75d8

SHA256
1b2401845f07313d78f39925fdb2fa869b2cb3eed7590188526b5bafceb89872

SHA512
b51723260537d89134a75c463df45e4a3c6e023dae1ac1a833a5f145bb0127ebcd994e6d58bcafe8356775fce534a35e0cafb3ab41bfc63d526fd82f8c5a1a9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
9227fceb1618679891ebca4a263427e4

SHA1
8eba7405e0043ac3120e0385543afba61e7a77fa

SHA256
65e26ca750e69489873211f87cd3f56ed7ee160473cdf73d9245f01aa9f4e9c2

SHA512
838acbd3cece0c5e33521fff53cbaf7a474521bab443ea45ce9b5b8ef3b4c9a3f26750ca69cd4ed89da488e5722ce601d172e0d024ec4f412114343efabda9cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
32a4ba4872bad3c7c9e9d79410da0b8c

SHA1
2b4212f2b38448562d979405d5cc6dd6359a7891

SHA256
9d865f847fdcd54b4da27a33f963dfae7ee99acc00d1e9aa554a1e4a29c1bee5

SHA512
4bb2a917db1196e79e54cce2b8df8b7dabf95f8c0265c82cfca606651159d10bbd0ae1cb9ad6484b26b3cadda24370729e7cbeeef974d49d5ff087de95924066

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
027c6a33e9ef40c939d7f6edd0c7c9f4

SHA1
38f32dc64d9e40f0f73053e82cd8477434c901c6

SHA256
aaa1f50847d79001e9f53f6ff9daffbbe84c09d1ee94f5c95b2ba62a3161c066

SHA512
24b2986386d20f35b169aba74d0e4e80d7fdabda07504a3f62233abac9836afbf4773bf214d698409114120528ff17c4c314fcf6d7f717cbb37b766626640ace

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
12c0a56158a6474bcf3738a89216bec6

SHA1
1f24da911ef128e269ecc5e31633f3a32aed030b

SHA256
9fca869f65d4b076e46a0a2b6c94e5c3c2e6e57c237dce66a745f1f57dc7c711

SHA512
c5e3f611f2c7e4aed503751e37ef8a0d33b7c1ed5efd02fd39e62f38ae7603711aaf5f0f30c22692f893d6dd1700e1fa48e7f198a689c79e7ba58041c643e471

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
f73b1301c6760ad570b5179a11f5e9f2

SHA1
dca84ec378cdd384d8739af1928c14c95ffc33ef

SHA256
9bbcc17e677001e70d7c4b1988354010818882e30f59cfdb85e5f43432a2186e

SHA512
ccdc3017b12c0245a3068b5bc4cad4e53f2481220f1b1a812ac9225af0338510b5da4429153a0489582b2d5ae3da13d6bcf1e68b97c3efc98b753894f3cd03e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a03e56abe89fe842ecf9fdf54a69c4cc

SHA1
f413ddc26ae7f48697711eac779febf8e319eee0

SHA256
1900c530c8d5917f3bde35b6fa0456513240ba3fed8d96aa35895d2920b0e683

SHA512
8257444571e9741fbb70cfa5867e94b5537af1640bb6d53a248059ffa96493e4410302ec3fa7246c1c4f4c39bb8ce7ffaf73f17e3256e3d4e69d359f785278a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ad459b9c92e5778903d534d13d4504d4

SHA1
41e5f63e12c795e26017752040c204b2505cd358

SHA256
3649f82c81168fef8c7076c7ae4588878358f4c56b8b02b1ec9bf260413f22d7

SHA512
a773994a3b65ff7a7e0ad3f20e260a4dd95098ad2df7a7f205c32a4dc5edc451e0ce878cb6529e44faafd343f52450720a3061ce5c988abdf28f14b46e1dcfa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c7b57186b8f4e97dc2d30a6b3a5ad4bd

SHA1
69faf1f1f24b194e747504e5272c14f3b86574a1

SHA256
9deb21e757fc33de479a2bd54b910548f36eb3a9939143da1304e1dc90257469

SHA512
86586bc1bd8f6b526fd800f1364689a697dc9bec8ed1c3c188d60529bd8f9210859349429ba2182c992efc7146e4c4e44630f392796369298f227ba68ef8b57e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a804920c06c66215f731c7db445c2f60

SHA1
751ba7c5743af29ac3bdc4fbdefc2c285893ba64

SHA256
00ca49eeeeb907f992f77cfd2506441b23d35db82c11cc88fabc5cb10d75b960

SHA512
8e69f5b6202f70f37157f3f323cebb55e950c0474aa5a2fe3c830c9f3469cee488b94d8a6f30bdf177ec4418c22fbf6d18522b6bbb902f5f9bbfbd8491b56f52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
cf259d53b271097de0c25a2674e0c481

SHA1
4da0575e3da551b85a5b33ce73a5ab989f96d281

SHA256
58ae134b18bf66856a726bb80c45f29402989528f4db321dfd489b1a537ac95c

SHA512
adb24d70c2f8a0b0e99c9b7875992e734da6b7757fa249ebd1a4c805f0c0f555da92b5632357222717b796e3718c3f734e1827abce180cae9998f687e046d248

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
e2cf8e9e6f52c8607cd530abebd8f7f4

SHA1
62678d13ac9da16538dc83f758e1876f51b8dfa1

SHA256
86f72e1afe75b7b965bc1895149461223a6364583d245d396b5ee20c27b83c47

SHA512
f5ca0b2773c43d55a34c07d0868ebd72d28499a400e9816b973e9fdb68f19b1f15107d57ed653253d98363ed93876fb08fa9faa3cc5ab1a4df63ca0cdf6d16b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
657be032983266ec03ae84d06a307130

SHA1
c01ec4925bc656af99ddb69357e8a3f74c35d1dd

SHA256
e7b86cf4589dad48848fea11d27a24a149a436fd03b52a8f04f4f7ca089580ee

SHA512
c97f5ae72f733aa47f2c8c5babf295bd9b64b92d602642b71f895290b3eeac3fbe0c99c7cf828ff26ab9139d3551b0f8101484876c99f69ed4e8391aa589268a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
4c7d8657191b502df2d4927ec51e70e2

SHA1
8c3aad21438f96424724e482fff924720aefb2d8

SHA256
219802eb17d8160cf7051f9c9a3e5efd7aa54d1a7a3ea8f32ec008f1afd89fb6

SHA512
947537cce24d58ae1833c7e1cd4c5af7c95ed2aefff8b837ad883c193f7992ba5b64fda3ff349a8d7c1858ec0a14580df06246015d647054b59f4a54f06c5ff0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
c1a578a46fc32f1df77fdaba9966eb7d

SHA1
d3954e5999ab21d2bfb6fe73638a2c07e0ce350a

SHA256
e6f6bcc7c8cd1c3d00d1ef0027ffc9085b8bc11f7e3db434e64bd4248515bfa7

SHA512
7d9583b495731848571ef26e3398fd20c1345ef67d3210d267c79d1a1c568a12c9fbd010f180f77ae3a15c84e6a21dac9e60a2410f0c36da03de9f8609c4afb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
3795146b76e40ebed1049bc7ebf28729

SHA1
b7b6de87bad86f3cb7268c0006f2a0214c9e4703

SHA256
ab5d5bc86a6a227f16215f833c63ac22d2b3294b86ca8fc91e9914cd0c3a2b37

SHA512
8b9caa687419680d6bd0b803735b79b0bf2ad6425f022960b14e0afa035d516855d1bfc59c0d57efa2230a53ca7d8803a9123cad8a14ddbb8c865ac14e6a3e82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
53864905fa26dbe59cb1b2a1a46268ec

SHA1
575ed68598097442ae62f7d67ca290d296a8285f

SHA256
b89df5919cd9539b41d15b7058b5a3b911bd1a0bd03cb53e4c7f606b140e9cda

SHA512
a9ba46d2eec95210de38fc9d75c891ee81a76d80970b882cf59fd972e5b7e6090d196fb83427c5b49f26e90a7602bb47b8cb7f466149d3e19ccc355754d84693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
ac1d72eede558e1d52e81237aa08e329

SHA1
abb07562d71d464c6ee5dc05245d5cfb057c28e4

SHA256
fbd140563c2b80fc25f6292a0805369366e811f8cc8918250ffa767809cf54ec

SHA512
740ec7aea09c98ec4ecef6089afbc7ea5f11e22c665ed621b0de805c3647a40d4c60a078ed8f1c36c86b2394d7c98fbd47d4485cded61f91251a793b143b05fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58728b.TMP

Filesize
538B

MD5
9b0774fbadbb6c1a0b6915f37bd9e5a8

SHA1
210497b5fc39333c0232d169e3b906925d1b9f7d

SHA256
e94f44763266b9c9e51c3aa111be17d66f1cc19a5707132f7838246b2a507af1

SHA512
4b310e747c04c61406aa4c2cde981b0f12f5172445e150bc50e48b4577a730baf41bace0d0b8894f9103eb96f406cfe770413eefd5f5fa75498e957280aaa9df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000019

Filesize
17KB

MD5
aab2532f8363e63359dbf0c31981f57f

SHA1
a21523eb85636a0455977ffe525260a1a8568043

SHA256
a6abef5f074c67b1f9fbee679151a4c705b71f054c98f720dfabdc65786d5d13

SHA512
7b3c4ce6574b36bf0d4e05bba1063798b525744fdb37b28ad6fc78456ef7d704677795ae4dd0d0eda0954d15b3776395fa931abf82dd4b64583c360dd9916f64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f74be0c2fc73b74e27062e504e5c18fd

SHA1
3dbd7afb2b5e517928064faeab2dc8fdb6d1af53

SHA256
5d3792c0c808a3f5da8fbbf667f07b11435a777aeaf13444b028049afae6d17d

SHA512
b327d0ebb9370d39f239bcf0c0817d9ff0c83d05391fcbdaea88d7078ea390264cb1968e7f083c4515057c3f77a66f358a540c0444ff329fa2803368fd24c045

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
29edb5c5aed5b7992fdb7bf31dd0dd02

SHA1
ae80a8622bf11ed2822fea2f3f0a2087315be55f

SHA256
8905e36e6203f48be7f644969f89784aa51e58be5e63e22007de670f2b3324b5

SHA512
3ffe428b79e4e4a236f510f7b1438d544d04d2ce79e0c6beb5ca84a6ea255521a0a9c2c193ab0ed7b370b8b5c4321968734884b032f33e43f5b7bf1a5ba98379

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
8166cc3c4b9d731d4e760b4fdb770dbd

SHA1
c6653bc66d1acb9c538414f55d84d8d08d08d73b

SHA256
c6fcdcaafe66e6e714434a28688d468c496982320dfe09248664badd839440ac

SHA512
4c21d97e309bff2656982748432d10c413317d0538d419599ec63f1c803592eefa47fdc3357e43124d9a92af37b4065b0156e4ccf84d3e53068404b1ef76030c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
fdc13880f006faa739c8e63276ae413a

SHA1
a2f4eb4d7b93e6002a2f92c6dc356f1e34291fd4

SHA256
5d0e305ba3b6dcb682f961e4bf19eb9c607bb2f8bc8d8ae43ef73b971a0864f7

SHA512
071353f1174322bb1d58de0b12c611ac39d9837b31e6f99562b3061cd60c697ff3184250d0be25456623c59abea5fc38a0893058dd6a9e0fe952244d7e3a1226

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
b3e55606be54a1ec67e5057b8f2f2bb5

SHA1
c733cdaaa7e9af340c9981acf12f02208c27a892

SHA256
ffd637d5255484d1cb74a4bc844bcbe9f72c08c8bb972780b917817e2a74813e

SHA512
c7f508c15b116e461377026d54c189653ad74c9d910b5bc169fb44e9f08fbced02461b75d59fb05afaf734743a5eac13f28e94d0e000f840382d7e54584ead28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
13ce957be53f3c204f4a05e52de15b2d

SHA1
2a450a27450ed7f1b19908bec998489380273fba

SHA256
b553ff320bcc2db514f87127021d1ca28166e7b10c14d0cc7d2ad3a1dbc27c74

SHA512
4745d59a3871e3e866556bdb936119391b3e7eec09566bc255543d0e1b6d38d9638ec9d0e0b7b5d3d3eede4a4463266fd4e1d3ecb2c5e6dd4315caea67bfc181

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
dbb85edd4f43b277f9c184e7d0811407

SHA1
c8ab0de8d61a5626a3966311ecfc47a3e8350a4f

SHA256
5a50372b575115049606f3e327fa12fefa0f8fd173129c38083f94cd8454a0bf

SHA512
9e9f578a29e859e86f4856a6578290e61539c4896744fd8134ba3954a207b51ace58bb29f209a81cea693a0da80f42f8ea4b55907339f0a15be9610ffbd4b98d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
f89f97a5497d30a08b032689062160dd

SHA1
d12c584626a83ab439adf246cd3789ee70ca47b6

SHA256
4834a57dfe7b55c500948a825c2a8c4441a8b37d9b41519b9b8db9bd0614d101

SHA512
39eb1707e281512ab4751bd0c514c10e33080bbf3728d5dffe1a9db9a7e062e24c6ece71acf7f4477166387b80409526eabbf26e320a6fb673a642be8fe963a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
e629de7780f62697217b753cdfb60a6c

SHA1
26395c5d27402a6c696203cb9d6df20c43cac842

SHA256
6e055d184194976b93c2ff6fadaa12326c5aa3dc7ac0f58ad84b05cb39b914c2

SHA512
b1912bcf85c0809bfc33ad66a960845d7019949bf63fc2b62a602dd1ad5c25c46a3236d51486974b5c348d1dac4e3f9ac7df66aaf000d3a32cee76f71b585ea2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\46be7tph.default-release\activity-stream.discovery_stream.json.tmp

Filesize
151KB

MD5
9d949a6d68dec16eacdd20c66baabec3

SHA1
32f18fb32b3f8f50e6d3249bfb5cf27b6c956278

SHA256
df94a232ed3dcf460391222ab1d3e0e3348c2541cb1cdd9da66df946e8e63457

SHA512
2cff4f4028ea684f81971efae7291c62c094846dcac4f3eb6adf42cbd83c857bea91bb9fe3ec2ebace44b282dc2770e5c7fff263b5881f9b73f943a32936930d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\46be7tph.default-release\cache2\entries\118BB2BA245AAA64B01692DF29396B97E11FC1A0

Filesize
14KB

MD5
9564d03019cf2a3c3c089b701f5a9ed8

SHA1
91ea612da13f849c7ec798054ad1a643c2f2d62f

SHA256
d7edc3b88e536dc95f856b71998dcfa5ddb8554c8388515f08bd3c63a6bc1fa0

SHA512
4affb6d3fff27d6f77116ce662d795c912b2de3508b52ce9573160cf18d67ababb6d5f65b59ce21340c45ec485bc89dc0531eb8663f7058a7c27920cb7838da9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF133.tmp

Filesize
588KB

MD5
a9941233b9415b479d3b4f3732161eab

SHA1
cb2d99af52b3b1c712943b13e45d85c80c732e57

SHA256
ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2

SHA512
cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_faqacoe5.10u.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\f170fc6acedb1a2f9166fd8a91c8280d\Admin@[email protected]\Cookies\[Edge_Default]_Cookies.txt

Filesize
11KB

MD5
8cc8fd7c5bef8dd424a4b31b39b5ec80

SHA1
5067dfa84c2cf03eddea12193e4b630202ca986a

SHA256
cfd4aa5dea1d842a74c79df2034a77fbb5a8251ff12c679073160294bf475ddc

SHA512
b051bcb2b9d341441ae2cb05f34c495c6fa30dc434393486ac16cd1072fc38de95e1b0c9d95e02c0b47fa332391c6b13c18e73cf4b02c7b9d454f5ba44f15c18

Download Submit
C:\Users\Admin\AppData\Local\f170fc6acedb1a2f9166fd8a91c8280d\Admin@[email protected]\Processes.txt

Filesize
4KB

MD5
b323f66ad63cb711723da278c1765251

SHA1
7219d6ecae06242ea5363916950e6e1127671e36

SHA256
9d15640c7594516ed78ead58069f7398453b96c8a65adfd06cc3d9e28d3ad918

SHA512
e830b3501153ab6970900e00cb4fb7a76fd46e0514f9d3c6a27b857a3cae7da09e2fdf7d0b15fa4fca8c6afdfd2458f83031faf56b0030ee7664b571278cc728

Download Submit
C:\Users\Admin\AppData\Local\f170fc6acedb1a2f9166fd8a91c8280d\Admin@[email protected]\Software.txt

Filesize
4KB

MD5
4d469fcd07d1ee0a57b64c5ad3a80d22

SHA1
17b0b8600cbe0015c1d3792a05cd5faa69e986e2

SHA256
8a90a8506281a7c79e22c746bb5c0e1900753905d39c3b2cf075889f12566f49

SHA512
0722c29314d54ec23cee1a7e53009ac9295f54aeb5a59760181233c38c8ef96ce5e141915e20b4ae5c6f1efea13b7952698881fa5e7bed7d7ea7d77047b847a6

Download Submit
C:\Users\Admin\AppData\Local\f170fc6acedb1a2f9166fd8a91c8280d\Admin@[email protected]\Software.txt

Filesize
4KB

MD5
4d469fcd07d1ee0a57b64c5ad3a80d22

SHA1
17b0b8600cbe0015c1d3792a05cd5faa69e986e2

SHA256
8a90a8506281a7c79e22c746bb5c0e1900753905d39c3b2cf075889f12566f49

SHA512
0722c29314d54ec23cee1a7e53009ac9295f54aeb5a59760181233c38c8ef96ce5e141915e20b4ae5c6f1efea13b7952698881fa5e7bed7d7ea7d77047b847a6

Download Submit
C:\Users\Admin\AppData\Local\f170fc6acedb1a2f9166fd8a91c8280d\msgid.dat

Filesize
13B

MD5
b780c3de599b6bb7c45b9b23ba14563a

SHA1
82c1845271b87c9255e35ad8bfa069e2f981d1f3

SHA256
2f5aacc53302e47c0140f5b852d36ae0684ed022e1ffec933517fe796943e9a6

SHA512
b7e33395aa4deb5388c2d2756c4af4cab2563947a52fe02763d836ac674af274ff33447202b865b48e98e63cd398ade12fd0442e5c6abd7538213d64e86b6ff9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\46be7tph.default-release\prefs-1.js

Filesize
6KB

MD5
8185d80cfa8afad59bd7fc32260faa03

SHA1
d7963e14e00eb9e0c32efcc7c1701377f69beb53

SHA256
1c782767e014474413d3cec4615257162215ae15ba5cc7f3c5488e45708d744d

SHA512
723d7186b746558ebdf86e59214696a0bfb9cd7e983c08a6e5bc4642c81344638fff6d00e71acd1b19b82ba5c76bc3e60d2b95edbaa737611a3fdbe11024a63a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\46be7tph.default-release\prefs-1.js

Filesize
6KB

MD5
bce7aec3a48fd60f45acc3cc105c92b4

SHA1
7499835fc1023da431d80cbe38994ac9d88e2241

SHA256
a2e5d547a127207dbc77bda3c8270d4f07bd99314ea8d7c2a81fabb379f8fd25

SHA512
ba5352ba81a47346e1d6ffd05fa543e3ce6b511b2957f8a370ec8e0b1a9bdd8469ca277ce199300d0e2d46ece933468e4610c511b2568f10b0c9a1a87e6966e6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\46be7tph.default-release\prefs-1.js

Filesize
6KB

MD5
8a0a9d05d628419b3099329f56545c5f

SHA1
1e56bb2252922b87f0821ae33410b5e3c380df3b

SHA256
91bb21d1058fa5539aa9f51e9d2bc94c60582855a75964f2a6ea6e0bc35b86a4

SHA512
bc5b364f3a3d27fc3a13715036614dfc0ddfd85d6eaa5501e718c4ba68e5f3e29a01fd48a6b95b7f2b4792477165b969cab5e088f7708cf1b8a3bd1af0c0156b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\46be7tph.default-release\prefs-1.js

Filesize
6KB

MD5
bec4a182c76f7cf88470c9cb956c0f40

SHA1
8f12bf77055890473d3c96ad69eed332d78655a1

SHA256
d561b599c9f352946cd67586f294b7b6b39b5ae3119df3106c10e806629eac45

SHA512
1dde46d59f0317db475f66009e3fa7e4c512f3edb26f32f28f278e52dca5f6bd87ef6a6c1f24f73400caa2812899bf51ffa6c6447d193cb4f1e6c412d0de13f2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\46be7tph.default-release\prefs.js

Filesize
6KB

MD5
8a633a0fe3801fa09c1c4e910f54df8f

SHA1
d5628ca3396eda9d942b263e4edca5a118078281

SHA256
33a72100a56c5c3f69c44d73ef033cd092ad73b24d744ad53fd36885194fbcef

SHA512
4e1819ed1d352cb13249cb929bf6fada314fbf91ffbef4bde1c319844493d9fe6db50eefdf1e82305b14f8f7c29706781f6ab26dad2db42203c739f21eb36f00

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\46be7tph.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
806e06d4c9a64b458925cb85dac429d4

SHA1
c6f44d93eba4d98feb791712f8eb1c2a749f2435

SHA256
a6d447c4a927e5eea7869c1e800b2a8ff48a20c6443f76ba3bea420b2ecd917e

SHA512
af191179ee611b9fcbef072c2ebd384341df5007f0fd9ede412bcde9650767da40395ccd8aaa076fc368a30a5122982fa1f4caf56da12a1a8fc00f1782d30327

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\46be7tph.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
f5b6cf4ec6679ff480dc684786212481

SHA1
fd01bdc65f5ca408b692fdf0b24cb4f370914c5b

SHA256
6043e69aa345c999832a832ea8f08278df329d104eed5157ff83efa6f2892f7e

SHA512
0159ed7019ce8dc279af3926d2d260ded3aa7e69a9b8db525a70468c0003b0b9a4058f03d4c5af2d8bd08892656575d1b790dbefdd19656224d0990a8539cc74

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\46be7tph.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
271B

MD5
42f488485fe7a9bf0b2da55e0d8a1fbf

SHA1
227a63337ed565dd99f315e5ee849844573cb697

SHA256
d9fd30289965daf19c139827b785f1593536571f398bc4ddae8fffbc824f651b

SHA512
5178b5046af7cd03cd8b086dcef1df80fdbe252cc7f9798cf6dbed47cd90e94c0ae5106763ab75094d1145de264dcdbda0252aac397ef3089fa082c8d27cfe10

Download Submit
C:\Users\Admin\AppData\Roaming\Updat.exe

Filesize
346.8MB

MD5
5775f807e138c17ccb56890472ef1133

SHA1
d559be29a90faf81b56d912f7ba7ed45d4bacb36

SHA256
40801a93b9099ff6019e1c3480ec6652c23a08bc543a13de3207c962c77c38bb

SHA512
4b4d3a15d96846b4a3b9a2def220a6b52fb1402e5df0ff8c0054794ed074b12246c1530f1493c18af84d3cf5b51bdb18c56de0eb9d12644bbc52c9c0094ce175

Download Submit
C:\Users\Admin\AppData\Roaming\Version.exe

Filesize
399.6MB

MD5
4f393706972221f97789469f7466ce39

SHA1
5b4693ccee71c3a568052853a5fc3e6913beb4de

SHA256
6e98decc2472db8d3089edd26268c5aae0303157d16a1fe09ba610b3093ede3e

SHA512
2d20a224549f32c0bf1d8bd8ec107e00496d192c596aedfdab126c268e84a3b24ca62f412eae12f897030dd82a1a80ddb155a5adff58caa6477c089e6fef3b95

Download Submit
C:\Users\Admin\Downloads\Archive.rar

Filesize
26.9MB

MD5
71c94f6fb21462f593185723b59130b3

SHA1
f82d69dab362b27a264abb7d878178074ddce991

SHA256
f5af95fb0c36b60be0d918ba5974470cf9133b35133e51631668eb868e67b978

SHA512
423db723cb3d412e02a7176535d515c0efda714f4ed9f15ed2a40a9c8724078ad6bd469d37b5cb1791a4511c1d9b7d7c23c18679e85ee7af858a75752d50d5c5

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 174307.crdownload

Filesize
108.6MB

MD5
d13ede142a647dc82ad4564785b5ae43

SHA1
ab51c9e908c97e24c31c1267d6c0214a4fdd693a

SHA256
db242a7bfc9c32a344bde2c8c124201d6d80069f8c06c9abc546b719c81dcc2e

SHA512
f7582ef75992cbb28939e6ec4345b99009a471d5f8e63ec59ebfddc4e70028c796e569aff9cede9580a639db676354737c5417e004d4c8f227f74d1e28476c71

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 338807.crdownload

Filesize
3.4MB

MD5
8a3faa499854ea7ff1a7ea5dbfdfccfb

SHA1
e0c4e5f7e08207319637c963c439e60735939dec

SHA256
e5e9f54a55ad4b936adaed4cca5b4d29bd6f308f1a0136a7e3c0f5fb234e7fff

SHA512
4c7474353dd64e1a1568b93e17be3f2f0eaf24b7d520339c033f46a517b0e048e88bda1b5d5bcfe62353930d8d76a7037ec6200882df8afc310322a5d5fceb25

Download Submit
C:\Users\Admin\Downloads\ZLauncher\ZLauncher\Sourse\cs\VVXA.dll

Filesize
6KB

MD5
80ace199c226c57c680768eb852c2ae1

SHA1
f29aab2a13df7a3c7a6035c48069238bf5f86e97

SHA256
842a0be3f55cfe26f09c82aa6bb91339e9caedea9a784a838e821d22d24e61fc

SHA512
68ecbe046ea5adb530eb4bf8fd018fd4d880c771236edd91ca5f7dd6d538ecb2e46e94f06d5d6188c9e46349af99922feadbe8d7799d6c19d6754405604b7452

Download Submit
C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22.zip

Filesize
351KB

MD5
b03b887ae392b6f33fad562becfc0482

SHA1
101c2388c16ca7678a8426739ec7a1b505a6f6aa

SHA256
93db5f4e53b9c0514b9c0c4c562be8d8e7c3d64f8542c03b7e7f032a9c5d0c55

SHA512
0c1cd2e1f5c32b76aa8c994b6399acf81c6f9e2558e120d2eefcde9628a162fa4c3c74aae519a59640f49ee6ca1a33f3faeeaea5e8c02aef9749af0c74d4dc73

Download Submit
C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\bin\A5QtxkSZgFZ.exe

Filesize
2.4MB

MD5
027834b2ebc7f1b02143d8e7f8c17aab

SHA1
c4d19cab893e0fcb19d5de25e26e441faceb88ee

SHA256
5b740dd5064d571eb065d94e252b11dd2c5ff0f82e7932c06c4acfd55e5a0cb1

SHA512
0c87b7ddc9ec8b32ed9a787cb633d232cca78cb58d0b42fe2ffc7206498d2121c608b45b6f5cc696cf96d2b771385036abfb2b19b6d1a6d6d133dc7a867af353

Download Submit
C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\bin\A5QtxkSZgFZ.exe

Filesize
2.4MB

MD5
027834b2ebc7f1b02143d8e7f8c17aab

SHA1
c4d19cab893e0fcb19d5de25e26e441faceb88ee

SHA256
5b740dd5064d571eb065d94e252b11dd2c5ff0f82e7932c06c4acfd55e5a0cb1

SHA512
0c87b7ddc9ec8b32ed9a787cb633d232cca78cb58d0b42fe2ffc7206498d2121c608b45b6f5cc696cf96d2b771385036abfb2b19b6d1a6d6d133dc7a867af353

Download Submit
C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\bin\A5QtxkSZgFZ.exe

Filesize
2.4MB

MD5
027834b2ebc7f1b02143d8e7f8c17aab

SHA1
c4d19cab893e0fcb19d5de25e26e441faceb88ee

SHA256
5b740dd5064d571eb065d94e252b11dd2c5ff0f82e7932c06c4acfd55e5a0cb1

SHA512
0c87b7ddc9ec8b32ed9a787cb633d232cca78cb58d0b42fe2ffc7206498d2121c608b45b6f5cc696cf96d2b771385036abfb2b19b6d1a6d6d133dc7a867af353

Download Submit
C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\bin\CefSharp.Core.dll

Filesize
1.3MB

MD5
a44554d38b7a25a7ab2320fe731c5298

SHA1
c287a88fd3a064b387888f4bbc37a0630c877253

SHA256
35980974bdba6d5dd6a4dc1072e33aab77f72f56c46779cb0216e4801dcc36ab

SHA512
bd8956b7e8ca6d1129fbbb950dd913183b3e92601c2c900aed26d695782e4663654ac57074e1f0f2efcf9cced969487162910dc9bb52b42572d61994b07f2aad

Download Submit
C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\bin\SLAgent.dll

Filesize
6.0MB

MD5
9b248dfff1d2b73fd639324741fe2e08

SHA1
e82684cd6858a6712eff69ace1707b3bcd464105

SHA256
39943c30732988289ca346902f007a72124bd98b82e08b0b9739241cdab4018e

SHA512
56784a895f113088e3c92ccd96f354473e5d849fb9d0798868ff5e9477f60854e8bc7c9759c63417c9298f8702abab266722439b445977c6e940da393b8b696c

Download Submit
C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\bin\SLAgent.dll

Filesize
6.0MB

MD5
9b248dfff1d2b73fd639324741fe2e08

SHA1
e82684cd6858a6712eff69ace1707b3bcd464105

SHA256
39943c30732988289ca346902f007a72124bd98b82e08b0b9739241cdab4018e

SHA512
56784a895f113088e3c92ccd96f354473e5d849fb9d0798868ff5e9477f60854e8bc7c9759c63417c9298f8702abab266722439b445977c6e940da393b8b696c

Download Submit
C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\bin\SynapseInjector.dll

Filesize
6.0MB

MD5
9b248dfff1d2b73fd639324741fe2e08

SHA1
e82684cd6858a6712eff69ace1707b3bcd464105

SHA256
39943c30732988289ca346902f007a72124bd98b82e08b0b9739241cdab4018e

SHA512
56784a895f113088e3c92ccd96f354473e5d849fb9d0798868ff5e9477f60854e8bc7c9759c63417c9298f8702abab266722439b445977c6e940da393b8b696c

Download Submit
C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\bin\chrome_elf.dll

Filesize
788KB

MD5
6499ea6b92ab4971886bd06c12625819

SHA1
5ebb75eeca7625b9511233158a02f50a92867a39

SHA256
6820f276c0d71557a0c7b997fd2f4a3ac6a45c86454c4dc3bcfa29843b5c470b

SHA512
e57703730e42eb9d80e762337e08176705b349f54fbd429edc657d44c9dc3a1f9ccfa594bc3ef622798aebb5bc69b225abb266b00f9b350ae59f734c2f31f63d

Download Submit
C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\bin\jidLbB90c.bin

Filesize
2.4MB

MD5
027834b2ebc7f1b02143d8e7f8c17aab

SHA1
c4d19cab893e0fcb19d5de25e26e441faceb88ee

SHA256
5b740dd5064d571eb065d94e252b11dd2c5ff0f82e7932c06c4acfd55e5a0cb1

SHA512
0c87b7ddc9ec8b32ed9a787cb633d232cca78cb58d0b42fe2ffc7206498d2121c608b45b6f5cc696cf96d2b771385036abfb2b19b6d1a6d6d133dc7a867af353

Download Submit
C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\bin\jidLbB90c.bin

Filesize
2.4MB

MD5
027834b2ebc7f1b02143d8e7f8c17aab

SHA1
c4d19cab893e0fcb19d5de25e26e441faceb88ee

SHA256
5b740dd5064d571eb065d94e252b11dd2c5ff0f82e7932c06c4acfd55e5a0cb1

SHA512
0c87b7ddc9ec8b32ed9a787cb633d232cca78cb58d0b42fe2ffc7206498d2121c608b45b6f5cc696cf96d2b771385036abfb2b19b6d1a6d6d133dc7a867af353

Download Submit
C:\Users\Admin\Downloads\synapse-v2-launcher-12-5-22\bin\jidLbB90c.bin

Filesize
2.4MB

MD5
027834b2ebc7f1b02143d8e7f8c17aab

SHA1
c4d19cab893e0fcb19d5de25e26e441faceb88ee

SHA256
5b740dd5064d571eb065d94e252b11dd2c5ff0f82e7932c06c4acfd55e5a0cb1

SHA512
0c87b7ddc9ec8b32ed9a787cb633d232cca78cb58d0b42fe2ffc7206498d2121c608b45b6f5cc696cf96d2b771385036abfb2b19b6d1a6d6d133dc7a867af353

Download Submit
C:\Users\Admin\Downloads\winrar-x64-622.exe

Filesize
3.4MB

MD5
8a3faa499854ea7ff1a7ea5dbfdfccfb

SHA1
e0c4e5f7e08207319637c963c439e60735939dec

SHA256
e5e9f54a55ad4b936adaed4cca5b4d29bd6f308f1a0136a7e3c0f5fb234e7fff

SHA512
4c7474353dd64e1a1568b93e17be3f2f0eaf24b7d520339c033f46a517b0e048e88bda1b5d5bcfe62353930d8d76a7037ec6200882df8afc310322a5d5fceb25

Download Submit
C:\Users\Admin\Downloads\winrar-x64-622.exe

Filesize
3.4MB

MD5
8a3faa499854ea7ff1a7ea5dbfdfccfb

SHA1
e0c4e5f7e08207319637c963c439e60735939dec

SHA256
e5e9f54a55ad4b936adaed4cca5b4d29bd6f308f1a0136a7e3c0f5fb234e7fff

SHA512
4c7474353dd64e1a1568b93e17be3f2f0eaf24b7d520339c033f46a517b0e048e88bda1b5d5bcfe62353930d8d76a7037ec6200882df8afc310322a5d5fceb25

Download Submit
memory/1184-2106-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/1184-2093-0x00000000004C0000-0x000000000058A000-memory.dmp

Filesize
808KB

Download
memory/1184-2094-0x0000000005440000-0x00000000059E4000-memory.dmp

Filesize
5.6MB

Download
memory/1184-2109-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/1184-2097-0x0000000008220000-0x0000000008242000-memory.dmp

Filesize
136KB

Download
memory/1184-2092-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/1184-2096-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

Filesize
64KB

Download
memory/1184-2095-0x0000000004E90000-0x0000000004F22000-memory.dmp

Filesize
584KB

Download
memory/3292-2343-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/3292-2339-0x0000000000380000-0x0000000000388000-memory.dmp

Filesize
32KB

Download
memory/3936-2315-0x00007FFF216A0000-0x00007FFF216B1000-memory.dmp

Filesize
68KB

Download
memory/3936-2268-0x00007FFF1CFD0000-0x00007FFF1D004000-memory.dmp

Filesize
208KB

Download
memory/3936-2314-0x00007FFF24100000-0x00007FFF24117000-memory.dmp

Filesize
92KB

Download
memory/3936-2316-0x00007FFF1CF50000-0x00007FFF1CF67000-memory.dmp

Filesize
92KB

Download
memory/3936-2319-0x00007FFF1CF10000-0x00007FFF1CF2D000-memory.dmp

Filesize
116KB

Download
memory/3936-2317-0x00007FFF1CF30000-0x00007FFF1CF41000-memory.dmp

Filesize
68KB

Download
memory/3936-2312-0x00007FFF241B0000-0x00007FFF241C8000-memory.dmp

Filesize
96KB

Download
memory/3936-2269-0x00007FFF0DA40000-0x00007FFF0DCF4000-memory.dmp

Filesize
2.7MB

Download
memory/3936-2267-0x00007FF7D5320000-0x00007FF7D5418000-memory.dmp

Filesize
992KB

Download
memory/4252-2140-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2155-0x0000000009010000-0x0000000009048000-memory.dmp

Filesize
224KB

Download
memory/4252-2257-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2270-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2244-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2242-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2300-0x000000000C6D0000-0x000000000C70E000-memory.dmp

Filesize
248KB

Download
memory/4252-2298-0x000000000C530000-0x000000000C54C000-memory.dmp

Filesize
112KB

Download
memory/4252-2301-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2302-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2303-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2304-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2305-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2306-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2307-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2308-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2309-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2310-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2311-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2255-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2313-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2254-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2253-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2252-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2161-0x0000000009CA0000-0x0000000009CF0000-memory.dmp

Filesize
320KB

Download
memory/4252-2245-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2239-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2235-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2236-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2156-0x0000000008FE0000-0x0000000008FEE000-memory.dmp

Filesize
56KB

Download
memory/4252-2164-0x0000000009E70000-0x0000000009E82000-memory.dmp

Filesize
72KB

Download
memory/4252-2226-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2163-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2153-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2225-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2210-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2209-0x00000000060D0000-0x00000000060DA000-memory.dmp

Filesize
40KB

Download
memory/4252-2151-0x0000000006C20000-0x0000000006C28000-memory.dmp

Filesize
32KB

Download
memory/4252-2150-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2149-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2148-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2146-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2165-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2143-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2166-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2141-0x0000000005A10000-0x0000000005A20000-memory.dmp

Filesize
64KB

Download
memory/4252-2243-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2208-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2207-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2205-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2256-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2135-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2121-0x0000000005A10000-0x0000000005A20000-memory.dmp

Filesize
64KB

Download
memory/4252-2134-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2133-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2132-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2131-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2130-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2203-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2129-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2127-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2202-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2201-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2128-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2199-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2200-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2167-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2169-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2198-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2136-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/4252-2171-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2120-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/4252-2196-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2172-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2197-0x000000000AD40000-0x000000000B26C000-memory.dmp

Filesize
5.2MB

Download
memory/4252-2195-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2194-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2193-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2192-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2173-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2175-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2188-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2176-0x0000000005A10000-0x0000000005A20000-memory.dmp

Filesize
64KB

Download
memory/4252-2191-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2190-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2189-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2186-0x000000006D1E0000-0x000000006E106000-memory.dmp

Filesize
15.1MB

Download
memory/4252-2137-0x0000000005A10000-0x0000000005A20000-memory.dmp

Filesize
64KB

Download
memory/4320-2144-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/4320-2152-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/4688-2157-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/4688-2154-0x0000000002F30000-0x0000000002F40000-memory.dmp

Filesize
64KB

Download
memory/4688-2158-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/5432-2142-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/5432-2124-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/5432-2125-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download
memory/5736-2117-0x00000000059E0000-0x00000000059F0000-memory.dmp

Filesize
64KB

Download
memory/5736-2119-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/5736-2108-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/5736-2110-0x00000000059E0000-0x00000000059F0000-memory.dmp

Filesize
64KB

Download
memory/5736-2107-0x0000000000D40000-0x0000000000FB6000-memory.dmp

Filesize
2.5MB

Download