Analysis
-
max time kernel
1532s -
max time network
1555s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-es -
resource tags
arch:x64arch:x86image:win10v2004-20230915-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
01-10-2023 16:43
General
-
Target
Desktop.7z
-
Size
40.8MB
-
MD5
de689d7172570975e45c8de861703d9a
-
SHA1
ca93484119dab6a2058dfd4c8394c1e4dc328e6f
-
SHA256
8324822dead804bf3ea27145f2ad10bf55d839ec8cd914d48160674c8cb50445
-
SHA512
6fdbcd62e70ee4cf6a066697ce224da349993a97b8e913bbb6a1e47b2c8b91a786a134d3fd023671b919d78436cbfa53ac3ba93cdb424988546c9ec30455e6bd
-
SSDEEP
786432:q+3daapFvXlfdw7y6+SdIapVSNtx/vb26n9GYoQ4Ri4yYqJS8ynd4NMn:Po49leytCVS1nbpLpNSddjn
Malware Config
Signatures
-
Detect Xworm Payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\DEVOS MENU PAID V1.exe family_xworm -
Matrix Ransomware
Targeted ransomware with information collection and encryption functionality.
-
Renames multiple (56) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid process 369 3040 powershell.exe 371 3040 powershell.exe -
Downloads MZ/PE file
-
Modifies Installed Components in the registry 2 TTPs 7 IoCs
Processes:
setup.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\ = "Microsoft Edge" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\StubPath = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\117.0.2045.47\\Installer\\setup.exe\" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Localized Name = "Microsoft Edge" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\IsInstalled = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Version = "43,0,0,0" setup.exe -
Modifies Windows Firewall 1 TTPs 2 IoCs
-
Sets file execution options in registry 2 TTPs 2 IoCs
Processes:
MicrosoftEdgeUpdate.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\nsq87D7.tmp\nsResize.dll acprotect -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wavebrowser.exewavebrowser.exewavebrowser.exewavebrowser.exewavebrowser.exewavebrowser.exewavebrowser.exewavebrowser.exewavebrowser.exemsedge.exewavebrowser.exewavebrowser.exemsedge.exewavebrowser.exewavebrowser.exewavebrowser.exemsedge.exewavebrowser.exewavebrowser.exewavebrowser.exewavebrowser.exewavebrowser.exewavebrowser.exewavebrowser.exewavebrowser.exewavebrowser.exewavebrowser.exewavebrowser.exemsedge.exewavebrowser.exewavebrowser.exewavebrowser.exewavebrowser.exeziptech (1).exewavebrowser.exewavebrowser.exewavebrowser.exesteamwebhelper.exewavebrowser.exewavebrowser.exewavebrowser.exewavebrowser.exemsedge.exewavebrowser.exesteamwebhelper.exewavebrowser.exemsedge.exewavebrowser.exewavebrowser.exewavebrowser.exeMicrosoftEdgeUpdate.exesetup.exewavebrowser.exewavebrowser.exewavebrowser.exemsedge.exewavebrowser.exewavebrowser.exewavebrowser.exewavebrowser.exewavebrowser.exewavebrowser.exemsedge.exewavebrowser.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation ziptech (1).exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation steamwebhelper.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation steamwebhelper.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation setup.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation wavebrowser.exe -
Drops startup file 6 IoCs
Processes:
system.exemapper.bin.exeClient.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe system.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c0918aadad3c42c7132398b2c9316f4f.exe mapper.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c0918aadad3c42c7132398b2c9316f4f.exe mapper.bin.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe Client.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe Client.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe system.exe -
Executes dropped EXE 64 IoCs
Processes:
ziptech (1).exeMultiple_ROBLOX.exeMicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_117.0.2045.47.exesetup.exeMicrosoftEdgeUpdateBroker.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateBroker.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateBroker.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateBroker.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateBroker.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_117.0.2045.47.exesetup.exesetup.exeMicrosoftEdgeUpdate.exefree_setup - key.exeBelonero.exeSteamSetup.exesteamservice.exesteam.exesteam.exesteamwebhelper.exesteamwebhelper.exesteamwebhelper.exesteamwebhelper.exegldriverquery64.exegldriverquery.exesteamwebhelper.exevulkandriverquery64.exevulkandriverquery.exeSteam.exesteamwebhelper.exesteamwebhelper.exesteamwebhelper.exesteamwebhelper.exegldriverquery64.exesteamwebhelper.exegldriverquery.exevulkandriverquery64.exevulkandriverquery.exepdfcentral.exepdfcentral.exepid process 412 ziptech (1).exe 3680 Multiple_ROBLOX.exe 5308 MicrosoftEdgeWebview2Setup.exe 5744 MicrosoftEdgeUpdate.exe 5784 MicrosoftEdgeUpdate.exe 5824 MicrosoftEdgeUpdate.exe 5860 MicrosoftEdgeUpdateComRegisterShell64.exe 5892 MicrosoftEdgeUpdateComRegisterShell64.exe 5920 MicrosoftEdgeUpdateComRegisterShell64.exe 5960 MicrosoftEdgeUpdate.exe 6056 MicrosoftEdgeUpdate.exe 6096 MicrosoftEdgeUpdate.exe 3960 MicrosoftEdgeUpdate.exe 5532 MicrosoftEdge_X64_117.0.2045.47.exe 5712 setup.exe 4660 MicrosoftEdgeUpdateBroker.exe 3872 MicrosoftEdgeUpdate.exe 1840 MicrosoftEdgeUpdate.exe 1288 MicrosoftEdgeUpdateBroker.exe 1220 MicrosoftEdgeUpdate.exe 1484 MicrosoftEdgeUpdate.exe 2800 MicrosoftEdgeUpdateBroker.exe 440 MicrosoftEdgeUpdate.exe 3872 MicrosoftEdgeUpdate.exe 3488 MicrosoftEdgeUpdate.exe 3704 MicrosoftEdgeUpdateBroker.exe 5428 MicrosoftEdgeUpdate.exe 5184 MicrosoftEdgeUpdate.exe 2820 MicrosoftEdgeUpdateBroker.exe 3484 MicrosoftEdgeUpdate.exe 3076 MicrosoftEdgeUpdate.exe 1116 MicrosoftEdgeUpdate.exe 636 MicrosoftEdgeUpdate.exe 792 MicrosoftEdge_X64_117.0.2045.47.exe 5668 setup.exe 2732 setup.exe 5388 MicrosoftEdgeUpdate.exe 5660 free_setup - key.exe 1872 Belonero.exe 4604 SteamSetup.exe 1092 steamservice.exe 3160 steam.exe 4768 steam.exe 4372 steamwebhelper.exe 5436 steamwebhelper.exe 2216 steamwebhelper.exe 5336 steamwebhelper.exe 4544 gldriverquery64.exe 3144 gldriverquery.exe 4476 steamwebhelper.exe 5940 vulkandriverquery64.exe 4644 vulkandriverquery.exe 4500 Steam.exe 1732 steamwebhelper.exe 5480 steamwebhelper.exe 3640 steamwebhelper.exe 568 steamwebhelper.exe 4684 gldriverquery64.exe 3572 steamwebhelper.exe 4632 gldriverquery.exe 1472 vulkandriverquery64.exe 3856 vulkandriverquery.exe 1228 pdfcentral.exe 1876 pdfcentral.exe -
Loads dropped DLL 64 IoCs
Processes:
MsiExec.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exemsedge.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exemsedge.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeSteamSetup.exesteam.exepid process 4768 MsiExec.exe 5744 MicrosoftEdgeUpdate.exe 5784 MicrosoftEdgeUpdate.exe 5824 MicrosoftEdgeUpdate.exe 5860 MicrosoftEdgeUpdateComRegisterShell64.exe 5824 MicrosoftEdgeUpdate.exe 5892 MicrosoftEdgeUpdateComRegisterShell64.exe 5824 MicrosoftEdgeUpdate.exe 5920 MicrosoftEdgeUpdateComRegisterShell64.exe 5824 MicrosoftEdgeUpdate.exe 5960 MicrosoftEdgeUpdate.exe 6056 MicrosoftEdgeUpdate.exe 6096 MicrosoftEdgeUpdate.exe 6096 MicrosoftEdgeUpdate.exe 6056 MicrosoftEdgeUpdate.exe 3960 MicrosoftEdgeUpdate.exe 3872 MicrosoftEdgeUpdate.exe 1840 MicrosoftEdgeUpdate.exe 3872 MicrosoftEdgeUpdate.exe 1840 MicrosoftEdgeUpdate.exe 3792 msedge.exe 1220 MicrosoftEdgeUpdate.exe 1484 MicrosoftEdgeUpdate.exe 1220 MicrosoftEdgeUpdate.exe 1484 MicrosoftEdgeUpdate.exe 440 MicrosoftEdgeUpdate.exe 3872 MicrosoftEdgeUpdate.exe 440 MicrosoftEdgeUpdate.exe 3872 MicrosoftEdgeUpdate.exe 3488 MicrosoftEdgeUpdate.exe 5428 MicrosoftEdgeUpdate.exe 5184 MicrosoftEdgeUpdate.exe 5428 MicrosoftEdgeUpdate.exe 5184 MicrosoftEdgeUpdate.exe 5884 msedge.exe 3484 MicrosoftEdgeUpdate.exe 3076 MicrosoftEdgeUpdate.exe 3484 MicrosoftEdgeUpdate.exe 3076 MicrosoftEdgeUpdate.exe 1116 MicrosoftEdgeUpdate.exe 636 MicrosoftEdgeUpdate.exe 636 MicrosoftEdgeUpdate.exe 1116 MicrosoftEdgeUpdate.exe 5388 MicrosoftEdgeUpdate.exe 4604 SteamSetup.exe 4604 SteamSetup.exe 4604 SteamSetup.exe 4604 SteamSetup.exe 4604 SteamSetup.exe 4604 SteamSetup.exe 4604 SteamSetup.exe 4604 SteamSetup.exe 4768 steam.exe 4768 steam.exe 4768 steam.exe 4768 steam.exe 4768 steam.exe 4768 steam.exe 4768 steam.exe 4768 steam.exe 4768 steam.exe 4768 steam.exe 4768 steam.exe 4768 steam.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Registers COM server for autorun 1 TTPs 64 IoCs
Processes:
MicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeSWUpdater.exeSWUpdaterComRegisterShell64.exesetup.exeSWUpdaterComRegisterShell64.exeSWUpdaterComRegisterShell64.exesetup.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F795C339-932E-4B24-85B3-C7865BE4C1B9}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.177.11\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.177.11\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.177.11\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.177.11\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\CLSID\{F87D77DF-DEF2-4294-9F4B-A92E5A6725DE}\InprocServer32\ = "C:\\Users\\Admin\\Wavesor Software\\SWUpdater\\1.3.133.0\\psuser.dll" SWUpdater.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\CLSID\{F87D77DF-DEF2-4294-9F4B-A92E5A6725DE}\InprocServer32 SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\CLSID\{F6994161-37C3-47C9-BE83-C84C33A1CF2A}\InprocServer32\ThreadingModel = "Both" SWUpdater.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}\LocalServer32 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\117.0.2045.47\\notification_click_helper.exe" setup.exe Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\CLSID\{F6994161-37C3-47C9-BE83-C84C33A1CF2A}\InprocServer32 SWUpdaterComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\CLSID\{F87D77DF-DEF2-4294-9F4B-A92E5A6725DE}\InprocServer32 SWUpdater.exe Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\CLSID\{D7EC6DDA-90E9-44BA-863B-6C3500BB5BDF}\InProcServer32 SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\CLSID\{F87D77DF-DEF2-4294-9F4B-A92E5A6725DE}\InprocServer32\ = "C:\\Users\\Admin\\Wavesor Software\\SWUpdater\\1.3.133.0\\psuser_64.dll" SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F795C339-932E-4B24-85B3-C7865BE4C1B9}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.177.11\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\CLSID\{D12748C8-5013-45E2-9A24-2FB7C2EEFB7C}\LocalServer32 SWUpdater.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.177.11\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32 setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F795C339-932E-4B24-85B3-C7865BE4C1B9}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\117.0.2045.47\\notification_click_helper.exe\"" setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\CLSID\{D7EC6DDA-90E9-44BA-863B-6C3500BB5BDF}\InProcServer32\ThreadingModel = "Both" SWUpdater.exe Key deleted \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\CLSID\{F87D77DF-DEF2-4294-9F4B-A92E5A6725DE}\InprocServer32 SWUpdater.exe Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\CLSID\{F6994161-37C3-47C9-BE83-C84C33A1CF2A}\InprocServer32 SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\CLSID\{9CD78CBC-FD21-4FFF-B452-9D792A58B7C4}\LocalServer32\ = "\"C:\\Users\\Admin\\Wavesor Software\\WaveBrowser\\1.3.15.3\\notification_helper.exe\"" setup.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\CLSID\{D7EC6DDA-90E9-44BA-863B-6C3500BB5BDF}\InProcServer32 SWUpdater.exe Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\CLSID\{D7EC6DDA-90E9-44BA-863B-6C3500BB5BDF}\InProcServer32 SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\CLSID\{D7EC6DDA-90E9-44BA-863B-6C3500BB5BDF}\InProcServer32\ThreadingModel = "Both" SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32\ThreadingModel = "Apartment" setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\CLSID\{F87D77DF-DEF2-4294-9F4B-A92E5A6725DE}\InprocServer32\ThreadingModel = "Both" SWUpdater.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\CLSID\{F6994161-37C3-47C9-BE83-C84C33A1CF2A}\InprocServer32\ = "C:\\Users\\Admin\\Wavesor Software\\SWUpdater\\1.3.133.0\\psuser_64.dll" SWUpdaterComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\CLSID\{3C41B0C4-B5B6-4293-BED4-C927CCFDB909}\LocalServer32 SWUpdater.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32 setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F795C339-932E-4B24-85B3-C7865BE4C1B9}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\ThreadingModel = "Apartment" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\117.0.2045.47\\PdfPreview\\PdfPreviewHandler.dll" setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\CLSID\{F87D77DF-DEF2-4294-9F4B-A92E5A6725DE}\InprocServer32\ThreadingModel = "Both" SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\CLSID\{F87D77DF-DEF2-4294-9F4B-A92E5A6725DE}\InprocServer32\ThreadingModel = "Both" SWUpdaterComRegisterShell64.exe Key deleted \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\CLSID\{F6994161-37C3-47C9-BE83-C84C33A1CF2A}\InprocServer32 SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\CLSID\{D7EC6DDA-90E9-44BA-863B-6C3500BB5BDF}\InProcServer32\ = "C:\\Users\\Admin\\Wavesor Software\\SWUpdater\\1.3.133.0\\psuser_64.dll" SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.177.11\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32 setup.exe Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\CLSID\{9E0CE9B5-C498-40A8-B7F2-B89AF1C56FFF}\LocalServer32 SWUpdater.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\CLSID\{9E0CE9B5-C498-40A8-B7F2-B89AF1C56FFF}\LocalServer32\ = "\"C:\\Users\\Admin\\Wavesor Software\\SWUpdater\\SWUpdater.exe\"" SWUpdater.exe Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\CLSID\{F6994161-37C3-47C9-BE83-C84C33A1CF2A}\InprocServer32 SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\CLSID\{F6994161-37C3-47C9-BE83-C84C33A1CF2A}\InprocServer32\ThreadingModel = "Both" SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\CLSID\{D7EC6DDA-90E9-44BA-863B-6C3500BB5BDF}\InProcServer32\ = "C:\\Users\\Admin\\Wavesor Software\\SWUpdater\\1.3.133.0\\psuser_64.dll" SWUpdaterComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F795C339-932E-4B24-85B3-C7865BE4C1B9}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F795C339-932E-4B24-85B3-C7865BE4C1B9}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.177.11\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\CLSID\{F87D77DF-DEF2-4294-9F4B-A92E5A6725DE}\InprocServer32 SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\CLSID\{F87D77DF-DEF2-4294-9F4B-A92E5A6725DE}\InprocServer32\ = "C:\\Users\\Admin\\Wavesor Software\\SWUpdater\\1.3.133.0\\psuser_64.dll" SWUpdaterComRegisterShell64.exe Key deleted \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\CLSID\{F6994161-37C3-47C9-BE83-C84C33A1CF2A}\InprocServer32 SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\CLSID\{D12748C8-5013-45E2-9A24-2FB7C2EEFB7C}\LocalServer32\ = "\"C:\\Users\\Admin\\Wavesor Software\\SWUpdater\\1.3.133.0\\SWUpdaterOnDemand.exe\"" SWUpdater.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\CLSID\{9CD78CBC-FD21-4FFF-B452-9D792A58B7C4}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\Wavesor Software\\WaveBrowser\\1.3.15.3\\notification_helper.exe" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F795C339-932E-4B24-85B3-C7865BE4C1B9}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\CLSID\{1BE9D40C-2307-4213-830E-7E3CE9EDF0C2}\LocalServer32 SWUpdater.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\nsq87D7.tmp\nsResize.dll upx -
Adds Run key to start application 2 TTPs 9 IoCs
Processes:
Client.exesystem.exeSteamSetup.exeSWUpdater.exemapper.bin.exeWKAopkeae.bin.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Client.exe\" .." Client.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Client.exe\" .." Client.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\ProgramData\\system.exe\" .." system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\ProgramData\\system.exe\" .." system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Steam = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -silent" SteamSetup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wavesor SWUpdater = "\"C:\\Users\\Admin\\Wavesor Software\\SWUpdater\\1.3.133.0\\SWUpdaterCore.exe\"" SWUpdater.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c0918aadad3c42c7132398b2c9316f4f = "\"C:\\Users\\Admin\\Desktop\\Nueva carpeta - copia (2)\\mapper.bin.exe\" .." mapper.bin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\c0918aadad3c42c7132398b2c9316f4f = "\"C:\\Users\\Admin\\Desktop\\Nueva carpeta - copia (2)\\mapper.bin.exe\" .." mapper.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rZLTYnaGFJ = "C:\\Users\\Admin\\AppData\\Roaming\\qRKZSeoJZE\\DoFPSqNiCH.exe" WKAopkeae.bin.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
SWUpdater.exeSWUpdater.exeSWUpdater.exemsedge.exeSWUpdater.exeSWUpdater.exemsedge.exeSWUpdater.exeSWUpdater.exeSWUpdater.exeSWUpdater.exeSWUpdater.exeSWUpdater.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SWUpdater.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SWUpdater.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SWUpdater.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA msedge.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SWUpdater.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SWUpdater.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA msedge.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SWUpdater.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SWUpdater.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SWUpdater.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SWUpdater.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SWUpdater.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SWUpdater.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exepdfcentral.exemsiexec.exeziptech (1).exedescription ioc process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: pdfcentral.exe File opened (read-only) \??\I: pdfcentral.exe File opened (read-only) \??\L: pdfcentral.exe File opened (read-only) \??\M: pdfcentral.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\N: pdfcentral.exe File opened (read-only) \??\Z: pdfcentral.exe File opened (read-only) \??\A: pdfcentral.exe File opened (read-only) \??\Q: ziptech (1).exe File opened (read-only) \??\S: ziptech (1).exe File opened (read-only) \??\Y: pdfcentral.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: ziptech (1).exe File opened (read-only) \??\G: ziptech (1).exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: ziptech (1).exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: ziptech (1).exe File opened (read-only) \??\I: ziptech (1).exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\X: pdfcentral.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: pdfcentral.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: ziptech (1).exe File opened (read-only) \??\K: pdfcentral.exe File opened (read-only) \??\V: pdfcentral.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\R: ziptech (1).exe File opened (read-only) \??\U: ziptech (1).exe File opened (read-only) \??\Y: ziptech (1).exe File opened (read-only) \??\H: pdfcentral.exe File opened (read-only) \??\P: pdfcentral.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\T: pdfcentral.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: ziptech (1).exe File opened (read-only) \??\U: pdfcentral.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\H: ziptech (1).exe File opened (read-only) \??\V: ziptech (1).exe File opened (read-only) \??\Z: ziptech (1).exe File opened (read-only) \??\Q: pdfcentral.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
setup.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects setup.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Checks system information in the registry 2 TTPs 18 IoCs
System information is often read in order to detect sandboxing environments.
Processes:
MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exemsedge.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe -
Drops file in System32 directory 1 IoCs
Processes:
setup.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk setup.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
firefox.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Desktop Background.bmp" firefox.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
free_setup - key.exepid process 5660 free_setup - key.exe 5660 free_setup - key.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
WKAopkeae.bin.exeWKAopkeae.bin.exedescription pid process target process PID 2500 set thread context of 7220 2500 WKAopkeae.bin.exe WKAopkeae.bin.exe PID 7756 set thread context of 7924 7756 WKAopkeae.bin.exe WKAopkeae.bin.exe -
Drops file in Program Files directory 64 IoCs
Processes:
setup.exesteam.exesetup.exesteamwebhelper.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\Locales\kk.pak setup.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\bg_gradient_mask.tga_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\styles\tenfootcontroller_dongleupdate.css_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\controller_config_controller_switch_joycon_left.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\graphics\icon_controller_bpm_disabled.tga_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sc_touchpad_touch_md.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_outlined_button_x_lg.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\steamui\awardicon.js_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_035_magic_0316.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\graphics\inbox_notification.tga_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sd_ltrackpad_up.svg_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps4_trackpad_left_md.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps_color_button_triangle_lg.png_ steam.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\oneds.dll setup.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\input_controller_glyph_plus.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_010_wpn_0416.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\steamui\libraries\libraries~d432c02e4.js_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\chord_steamcontroller_gordon.vdf_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\xbox_rt_soft_md.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps_color_button_x_md.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\video.dll_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps5_trackpad_r_touch.svg_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps4_r1_lg.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps5_r1_sm.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_dpad_right.svg_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_touch_tap_md.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\libavformat-58.dll_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\click.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\profile\profile_bg_wash.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\steamui\libraries\libraries~a5790b328.js_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\steam\cached\game_details_header_mask.tga_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\graphics\btnOvrOnBottom.tga_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\resource\overlay_turkish.txt_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_mouse_4_lg.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_mouse_mid_click.svg_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\steamui\sounds\deck_ui_default_activation.wav_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0526.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\login\connect.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\library\controller_sourcemode_trigger.xml_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\audio\settings_audio_card_wiz.xml_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_035_magic_0344.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_buttons_n_sm.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps5_button_create_sm.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_button_x.svg_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps4_trackpad_up_sm.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\bin\cef\cef.win7x64\locales\ko.pak_ steam.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\117.0.2045.47\identity_proxy\win11\identity_helper.Sparse.Beta.msix setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\Locales\am.pak setup.exe File created C:\Program Files (x86)\Steam\package\tmp\graphics\nav_highlight_selected.tga_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\steam\cached\fav_remove.tga_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps_outlined_button_triangle.svg_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sc_dpad_right_lg.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_brazilian.txt.gz_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\parental\choosefeatures.xml_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\graphics\icon_button_stop_down.tga_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\public\c9.tga_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps4_r1.svg_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\resource\layout\friendpanel.layout_ steam.exe File opened for modification C:\Program Files (x86)\Steam\debug.log steamwebhelper.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0337.png_ steam.exe File created C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\login\user_login.png_ steam.exe -
Drops file in Windows directory 11 IoCs
Processes:
msiexec.exesteam.exedescription ioc process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI8EEE.tmp msiexec.exe File created C:\Windows\Installer\{B49406D8-4171-4801-8E93-CD18B90BD12B}\ProductIcon msiexec.exe File opened for modification C:\Windows\Installer\{B49406D8-4171-4801-8E93-CD18B90BD12B}\ProductIcon msiexec.exe File opened for modification C:\Windows\INF\msmouse.PNF steam.exe File created C:\Windows\Installer\e5b8d4a.msi msiexec.exe File created C:\Windows\Installer\e5b8d48.msi msiexec.exe File opened for modification C:\Windows\Installer\e5b8d48.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{B49406D8-4171-4801-8E93-CD18B90BD12B} msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\Downloads\Sin confirmar 458655.crdownload nsis_installer_1 C:\Users\Admin\Downloads\Sin confirmar 458655.crdownload nsis_installer_2 C:\Users\Admin\Wavesor Software\SWUpdater\Install\{D9BEC43C-1473-4760-BDB8-6B047258E9C4}\WaveInstaller-v1.3.15.3.exe nsis_installer_1 C:\Users\Admin\Wavesor Software\SWUpdater\Install\{D9BEC43C-1473-4760-BDB8-6B047258E9C4}\WaveInstaller-v1.3.15.3.exe nsis_installer_2 -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vssvc.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001e27da6a5c4e13030000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001e27da6a0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809001e27da6a000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1e27da6a000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001e27da6a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Checks processor information in registry 2 TTPs 27 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
free_setup - key.exesteam.exeSteam.exeSteam.exesteamwebhelper.exefirefox.exesteam.exesteamwebhelper.exefirefox.exesteamwebhelper.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 free_setup - key.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 steam.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Steam.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Steam.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 steamwebhelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 steam.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz steamwebhelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz steam.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 steam.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz steamwebhelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz steam.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 steamwebhelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Steam.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString free_setup - key.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Steam.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 steamwebhelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz steamwebhelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Steam.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Steam.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 8 schtasks.exe 6560 schtasks.exe 6432 schtasks.exe 8176 schtasks.exe 1444 schtasks.exe -
Enumerates system info in registry 2 TTPs 26 IoCs
Processes:
msedge.exemsedge.exewavebrowser.exemsedge.exemsedge.exewavebrowser.exemsedge.exemsedge.exemsedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer wavebrowser.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName wavebrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName wavebrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS wavebrowser.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS wavebrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Processes:
setup.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\EnterpriseMode setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\EnterpriseMode\MSEdgePath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29} setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations\C:\Program Files (x86)\Microsoft\Edge\Application = "1" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\117.0.2045.47\\BHO" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\117.0.2045.47\\BHO" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29} setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3" setup.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute setup.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe" setup.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
MicrosoftEdgeUpdate.exesetup.exeMicrosoftEdgeUpdate.exesetup.exesteamwebhelper.exesetup.exemsiexec.exesteamwebhelper.exesteamwebhelper.exewavebrowser.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = bc0d0000d26ac84089f4d901 setup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft setup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager setup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" setup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = c370b53871cfe770922607490ba141feb44ecf012baf7afc1a68e164fe0ea2f6 setup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 setup.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = a918ae7bac7dd404a7dec8a31c3c0cab9be15600c6417ac7e19c77b2cfcedf01 setup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\ steamwebhelper.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall" setup.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c004d006900630072006f0073006f00660074005c0045006400670065005c004100700070006c00690063006100740069006f006e005c00390032002e0030002e003900300032002e00360037005c006d00730065006400670065005f0065006c0066002e0064006c006c0000000000 setup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\InstallerPinned = "0" setup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\ steamwebhelper.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\ steamwebhelper.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software setup.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133406535165434486" wavebrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe -
Modifies registry class 64 IoCs
Processes:
SWUpdaterComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeSWUpdaterComRegisterShell64.exesetup.exeSWUpdaterComRegisterShell64.exeSWUpdater.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exemsiexec.exeMicrosoftEdgeUpdate.exesetup.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{617E37E1-AC79-4162-BACC-C797A1D31D3E}\NumMethods SWUpdaterComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.177.11\\MicrosoftEdgeUpdateBroker.exe\"" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{44367D77-92C0-45E8-840D-0C098E650CE8} SWUpdaterComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\.xht setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{8129608C-48BD-42A6-9EBC-7B0933A5CFA3}\ProxyStubClsid32\ = "{D7EC6DDA-90E9-44BA-863B-6C3500BB5BDF}" SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{617E37E1-AC79-4162-BACC-C797A1D31D3E}\NumMethods\ = "5" SWUpdater.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{068FAC78-4F23-4F74-99A0-F7C4797D5ECA}\NumMethods\ = "41" SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32\ = "{F795C339-932E-4B24-85B3-C7865BE4C1B9}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32\ = "{F795C339-932E-4B24-85B3-C7865BE4C1B9}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher.1.0\CLSID\ = "{08D832B9-D2FD-481F-98CF-904D00DF63CC}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\NumMethods\ = "7" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{E44DDEE0-3097-499E-9DD5-7D5D5DCC401D}\NumMethods SWUpdater.exe Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{C5E89508-3927-4EF5-A3B3-C479F0D4E36F}\NumMethods SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{E44B162B-4287-40B0-8E7A-6E251D80B3DF}\ = "IAppWeb" SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{068FAC78-4F23-4F74-99A0-F7C4797D5ECA}\ = "IApp" SWUpdaterComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32\ = "{F795C339-932E-4B24-85B3-C7865BE4C1B9}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{C5E89508-3927-4EF5-A3B3-C479F0D4E36F}\ = "IAppCommand" SWUpdaterComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8D60494B17141084E839DC819BB01DB2 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc\CLSID\ = "{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine.1.0\CLSID\ = "{5F6A18BB-6231-424B-8242-19E5BB94F8ED}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\MSEdgeHTM\shell\open setup.exe Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{617E37E1-AC79-4162-BACC-C797A1D31D3E}\ProxyStubClsid32 SWUpdater.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32\ = "{F795C339-932E-4B24-85B3-C7865BE4C1B9}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\ = "Microsoft Edge Update Update3Web" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{92333BDA-3022-4A7F-8858-081260EA85DE}\ = "ICredentialDialog" SWUpdaterComRegisterShell64.exe Key deleted \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\CLSID\{2B2AD342-8BBC-40AD-AF1B-6887EAB9D3D0}\InprocHandler32 SWUpdater.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ = "Microsoft Edge Update Legacy On Demand" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ = "ICredentialDialog" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0\ = "Microsoft Edge Update Legacy On Demand" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0\0 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32\ = "{F795C339-932E-4B24-85B3-C7865BE4C1B9}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{F795C339-932E-4B24-85B3-C7865BE4C1B9}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\CLSID SWUpdater.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{D669BD5D-A9B6-47FD-B558-81508AEF48C4}\NumMethods\ = "4" SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WavesorSWUpdater.PolicyStatusUser.1.0\ = "SWUpdater Policy Status Class" SWUpdater.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32\ = "{F795C339-932E-4B24-85B3-C7865BE4C1B9}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{E44B162B-4287-40B0-8E7A-6E251D80B3DF}\ProxyStubClsid32 SWUpdaterComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8EDF453E-CD8F-4C56-BBA1-AA63266058E5} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32\ = "{F795C339-932E-4B24-85B3-C7865BE4C1B9}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO.1\ setup.exe Key created \REGISTRY\MACHINE\Software\Classes\MSEdgeMHT\shell\open\command setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4} MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{92333BDA-3022-4A7F-8858-081260EA85DE}\NumMethods SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{CEF9DF20-AE5B-4A54-B479-9C2AFC1C2683}\ProxyStubClsid32\ = "{D7EC6DDA-90E9-44BA-863B-6C3500BB5BDF}" SWUpdater.exe Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{730EBDF4-7AD2-4516-BF1A-6C6F28C60CF9} SWUpdaterComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{50363C3E-2FB2-4EC0-A827-CD3314F526C5}\NumMethods SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WaveBrwsHTM.7QYZTXW4MY5KE37UI44WX2DWPU\Application\ApplicationCompany = "Wavesor Software" setup.exe -
Processes:
msedge.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E msedge.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 msedge.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e msedge.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e msedge.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd msedge.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd msedge.exe -
NTFS ADS 8 IoCs
Processes:
msedge.exemsedge.exemsedge.exedescription ioc process File created C:\Users\Admin\Downloads\Sin confirmar 458655.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Sin confirmar 458655.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Sin confirmar 729187.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Sin confirmar 394071.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Sin confirmar 100262.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Sin confirmar 743855.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Sin confirmar 704516.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Sin confirmar 894374.crdownload:SmartScreen msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exeziptech (1).exemsedge.exemsiexec.exepowershell.exeMicrosoftEdgeUpdate.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exeidentity_helper.exemsedge.exepid process 900 msedge.exe 900 msedge.exe 4436 msedge.exe 4436 msedge.exe 1176 identity_helper.exe 1176 identity_helper.exe 2336 msedge.exe 2336 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4632 msedge.exe 4580 msedge.exe 4580 msedge.exe 1776 msedge.exe 1776 msedge.exe 412 ziptech (1).exe 412 ziptech (1).exe 3604 msedge.exe 3604 msedge.exe 8 msiexec.exe 8 msiexec.exe 3040 powershell.exe 3040 powershell.exe 3040 powershell.exe 5744 MicrosoftEdgeUpdate.exe 5744 MicrosoftEdgeUpdate.exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 3260 msedge.exe 3260 msedge.exe 3792 msedge.exe 3792 msedge.exe 3648 identity_helper.exe 3648 identity_helper.exe 5744 MicrosoftEdgeUpdate.exe 5744 MicrosoftEdgeUpdate.exe 5744 MicrosoftEdgeUpdate.exe 5744 MicrosoftEdgeUpdate.exe 412 ziptech (1).exe 412 ziptech (1).exe 2776 msedge.exe 2776 msedge.exe 5884 msedge.exe 5884 msedge.exe 412 ziptech (1).exe 5348 msedge.exe 5348 msedge.exe 2596 msedge.exe 2596 msedge.exe 3448 identity_helper.exe 3448 identity_helper.exe 5056 msedge.exe 5056 msedge.exe 496 msedge.exe 496 msedge.exe 496 msedge.exe 3740 identity_helper.exe 3740 identity_helper.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe -
Suspicious behavior: GetForegroundWindowSpam 6 IoCs
Processes:
steam.exeSteam.exeSteam.exeXWare loader.bin.exesightware.bin.exesystem.exepid process 4768 steam.exe 4500 Steam.exe 6972 Steam.exe 6028 XWare loader.bin.exe 7320 sightware.bin.exe 672 system.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
Processes:
msedge.exemsedge.exepid process 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
ziptech (1).exemsiexec.exemsiexec.exedescription pid process Token: SeDebugPrivilege 412 ziptech (1).exe Token: SeShutdownPrivilege 3348 msiexec.exe Token: SeIncreaseQuotaPrivilege 3348 msiexec.exe Token: SeSecurityPrivilege 8 msiexec.exe Token: SeCreateTokenPrivilege 3348 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3348 msiexec.exe Token: SeLockMemoryPrivilege 3348 msiexec.exe Token: SeIncreaseQuotaPrivilege 3348 msiexec.exe Token: SeMachineAccountPrivilege 3348 msiexec.exe Token: SeTcbPrivilege 3348 msiexec.exe Token: SeSecurityPrivilege 3348 msiexec.exe Token: SeTakeOwnershipPrivilege 3348 msiexec.exe Token: SeLoadDriverPrivilege 3348 msiexec.exe Token: SeSystemProfilePrivilege 3348 msiexec.exe Token: SeSystemtimePrivilege 3348 msiexec.exe Token: SeProfSingleProcessPrivilege 3348 msiexec.exe Token: SeIncBasePriorityPrivilege 3348 msiexec.exe Token: SeCreatePagefilePrivilege 3348 msiexec.exe Token: SeCreatePermanentPrivilege 3348 msiexec.exe Token: SeBackupPrivilege 3348 msiexec.exe Token: SeRestorePrivilege 3348 msiexec.exe Token: SeShutdownPrivilege 3348 msiexec.exe Token: SeDebugPrivilege 3348 msiexec.exe Token: SeAuditPrivilege 3348 msiexec.exe Token: SeSystemEnvironmentPrivilege 3348 msiexec.exe Token: SeChangeNotifyPrivilege 3348 msiexec.exe Token: SeRemoteShutdownPrivilege 3348 msiexec.exe Token: SeUndockPrivilege 3348 msiexec.exe Token: SeSyncAgentPrivilege 3348 msiexec.exe Token: SeEnableDelegationPrivilege 3348 msiexec.exe Token: SeManageVolumePrivilege 3348 msiexec.exe Token: SeImpersonatePrivilege 3348 msiexec.exe Token: SeCreateGlobalPrivilege 3348 msiexec.exe Token: SeCreateTokenPrivilege 3348 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3348 msiexec.exe Token: SeLockMemoryPrivilege 3348 msiexec.exe Token: SeIncreaseQuotaPrivilege 3348 msiexec.exe Token: SeMachineAccountPrivilege 3348 msiexec.exe Token: SeTcbPrivilege 3348 msiexec.exe Token: SeSecurityPrivilege 3348 msiexec.exe Token: SeTakeOwnershipPrivilege 3348 msiexec.exe Token: SeLoadDriverPrivilege 3348 msiexec.exe Token: SeSystemProfilePrivilege 3348 msiexec.exe Token: SeSystemtimePrivilege 3348 msiexec.exe Token: SeProfSingleProcessPrivilege 3348 msiexec.exe Token: SeIncBasePriorityPrivilege 3348 msiexec.exe Token: SeCreatePagefilePrivilege 3348 msiexec.exe Token: SeCreatePermanentPrivilege 3348 msiexec.exe Token: SeBackupPrivilege 3348 msiexec.exe Token: SeRestorePrivilege 3348 msiexec.exe Token: SeShutdownPrivilege 3348 msiexec.exe Token: SeDebugPrivilege 3348 msiexec.exe Token: SeAuditPrivilege 3348 msiexec.exe Token: SeSystemEnvironmentPrivilege 3348 msiexec.exe Token: SeChangeNotifyPrivilege 3348 msiexec.exe Token: SeRemoteShutdownPrivilege 3348 msiexec.exe Token: SeUndockPrivilege 3348 msiexec.exe Token: SeSyncAgentPrivilege 3348 msiexec.exe Token: SeEnableDelegationPrivilege 3348 msiexec.exe Token: SeManageVolumePrivilege 3348 msiexec.exe Token: SeImpersonatePrivilege 3348 msiexec.exe Token: SeCreateGlobalPrivilege 3348 msiexec.exe Token: SeCreateTokenPrivilege 3348 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3348 msiexec.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
msedge.exepid process 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
msedge.exemsedge.exemsedge.exepid process 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 4436 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 3792 msedge.exe 5884 msedge.exe 5884 msedge.exe 5884 msedge.exe 5884 msedge.exe 5884 msedge.exe 5884 msedge.exe 5884 msedge.exe 5884 msedge.exe 5884 msedge.exe 5884 msedge.exe 5884 msedge.exe 5884 msedge.exe 5884 msedge.exe 5884 msedge.exe 5884 msedge.exe 5884 msedge.exe -
Suspicious use of SetWindowsHookEx 47 IoCs
Processes:
OpenWith.exeziptech (1).exesteam.exeSteam.exeSteam.exefirefox.exepid process 4568 OpenWith.exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 412 ziptech (1).exe 4768 steam.exe 4500 Steam.exe 6972 Steam.exe 6104 firefox.exe 6104 firefox.exe 6104 firefox.exe 6104 firefox.exe 6104 firefox.exe 6104 firefox.exe 6104 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4436 wrote to memory of 5044 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5044 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 5000 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 900 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 900 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 4784 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 4784 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 4784 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 4784 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 4784 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 4784 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 4784 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 4784 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 4784 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 4784 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 4784 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 4784 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 4784 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 4784 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 4784 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 4784 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 4784 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 4784 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 4784 4436 msedge.exe msedge.exe PID 4436 wrote to memory of 4784 4436 msedge.exe msedge.exe -
System policy modification 1 TTPs 6 IoCs
Processes:
setup.exemsedge.exemsedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} = "1" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection msedge.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\ setup.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Desktop.7z1⤵PID:1656
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:4568
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff93ec046f8,0x7ff93ec04708,0x7ff93ec047182⤵PID:5044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:5000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:82⤵PID:4784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:12⤵PID:4688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:12⤵PID:4084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:12⤵PID:4972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:12⤵PID:2816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=3676 /prefetch:82⤵PID:1856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=3676 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:12⤵PID:1068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:12⤵PID:5020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:12⤵PID:1504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:12⤵PID:4492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:12⤵PID:3200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --service-sandbox-type=video_capture --mojo-platform-channel-handle=5568 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --service-sandbox-type=audio --mojo-platform-channel-handle=5376 /prefetch:82⤵PID:2740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:12⤵PID:4316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:12⤵PID:5012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:12⤵PID:1312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:12⤵PID:4128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:12⤵PID:3796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:12⤵PID:1212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:12⤵PID:3408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:12⤵PID:2324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:12⤵PID:4940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6688 /prefetch:12⤵PID:3976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:12⤵PID:1144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:12⤵PID:2700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:12⤵PID:3028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:12⤵PID:976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:12⤵PID:2728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --service-sandbox-type=collections --mojo-platform-channel-handle=5808 /prefetch:82⤵PID:1324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7316 /prefetch:82⤵PID:4284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:12⤵PID:4656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:12⤵PID:3768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:12⤵PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6516 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:12⤵PID:3944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7456 /prefetch:12⤵PID:3956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7364 /prefetch:12⤵PID:2844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:12⤵PID:4728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7052 /prefetch:12⤵PID:1732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7384 /prefetch:12⤵PID:636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:12⤵PID:1152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7664 /prefetch:12⤵PID:4956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6768 /prefetch:12⤵PID:412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7804 /prefetch:12⤵PID:4572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6980 /prefetch:12⤵PID:4264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:12⤵PID:3792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:12⤵PID:3392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7092 /prefetch:12⤵PID:3980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7760 /prefetch:12⤵PID:752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7664 /prefetch:12⤵PID:3220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6192 /prefetch:82⤵PID:4128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:12⤵PID:4504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7604 /prefetch:12⤵PID:3792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7812 /prefetch:12⤵PID:1580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:12⤵PID:1492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7748 /prefetch:12⤵PID:3016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=7404 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7668 /prefetch:82⤵PID:2056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1776
-
-
C:\Users\Admin\Downloads\ziptech (1).exe"C:\Users\Admin\Downloads\ziptech (1).exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:412 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" http://lookup.searchitziptech.com?b1f968f7adb13dde90136672b12b5428=H1xAXFNHXl5bUFQNEQQwBw9cQ1pZQlddXlFLVVFCX1pZU1QJDB0LUwoFRQgCQVdbRllECAJZWwgKV19VB0dcQ1tRRg1UTQ1cDwdADUcXBw8FDxcAPh0LU10MAAZXGxYK3⤵
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:3792 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff93ec046f8,0x7ff93ec04708,0x7ff93ec047184⤵PID:4688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,3419625040398751883,12132025616440317651,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2532 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:3260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3419625040398751883,12132025616440317651,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1912 /prefetch:24⤵PID:5480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,3419625040398751883,12132025616440317651,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:84⤵PID:4400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3419625040398751883,12132025616440317651,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:14⤵PID:5612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3419625040398751883,12132025616440317651,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:14⤵PID:5592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3419625040398751883,12132025616440317651,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:14⤵PID:5996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2092,3419625040398751883,12132025616440317651,131072 --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=4084 /prefetch:84⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3419625040398751883,12132025616440317651,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:14⤵PID:6112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3419625040398751883,12132025616440317651,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:14⤵PID:3136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3419625040398751883,12132025616440317651,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:84⤵PID:2744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3419625040398751883,12132025616440317651,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:3648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3419625040398751883,12132025616440317651,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:14⤵PID:212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3419625040398751883,12132025616440317651,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:14⤵PID:4904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3419625040398751883,12132025616440317651,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:14⤵PID:4140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3419625040398751883,12132025616440317651,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:14⤵PID:5912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3419625040398751883,12132025616440317651,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:14⤵PID:3424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3419625040398751883,12132025616440317651,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:14⤵PID:4232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3419625040398751883,12132025616440317651,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:14⤵PID:5752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3419625040398751883,12132025616440317651,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:14⤵PID:4868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3419625040398751883,12132025616440317651,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:14⤵PID:5084
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:3⤵
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:5884 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0xf8,0x134,0x7ff93ec046f8,0x7ff93ec04708,0x7ff93ec047184⤵PID:712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1492,12132661902216080128,5749860925430930798,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:24⤵PID:4276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1492,12132661902216080128,5749860925430930798,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:2776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1492,12132661902216080128,5749860925430930798,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:84⤵PID:2604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1492,12132661902216080128,5749860925430930798,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:14⤵PID:4288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1492,12132661902216080128,5749860925430930798,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:14⤵PID:5632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1492,12132661902216080128,5749860925430930798,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:14⤵PID:3512
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://www.ziptechapp.com/thankyou?tyid=ad7dc585-86dc-4fa6-9f33-004a59b2df2a3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2596 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff93ec046f8,0x7ff93ec04708,0x7ff93ec047184⤵PID:5160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,12398539404085084144,3024253299604480432,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:24⤵PID:960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,12398539404085084144,3024253299604480432,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:5348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,12398539404085084144,3024253299604480432,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=3020 /prefetch:84⤵PID:1688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12398539404085084144,3024253299604480432,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:14⤵PID:1236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12398539404085084144,3024253299604480432,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:14⤵PID:2832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12398539404085084144,3024253299604480432,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:14⤵PID:5620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,12398539404085084144,3024253299604480432,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:84⤵PID:1584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,12398539404085084144,3024253299604480432,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:3448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12398539404085084144,3024253299604480432,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:14⤵PID:4140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12398539404085084144,3024253299604480432,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:14⤵PID:4352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12398539404085084144,3024253299604480432,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:14⤵PID:5744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,12398539404085084144,3024253299604480432,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:14⤵PID:4252
-
-
-
-
C:\Users\Admin\Downloads\Multiple_ROBLOX.exe"C:\Users\Admin\Downloads\Multiple_ROBLOX.exe"2⤵
- Executes dropped EXE
PID:3680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:12⤵PID:3424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:12⤵PID:368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:12⤵PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1996,2911675870373266248,16292333054463344685,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=6444 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3604
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\DLL Injector_2.1.0_x86_en-US.msi"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:3348
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2640
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2800
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1856
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f8 0x5041⤵PID:5024
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 23039F3B6028C49D78437B3B6B9ECBC8 C2⤵
- Loads dropped DLL
PID:4768
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1624
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -Wait2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /silent /install3⤵
- Executes dropped EXE
PID:5308 -
C:\Program Files (x86)\Microsoft\Temp\EUAA46.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUAA46.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"4⤵
- Sets file execution options in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
PID:5744 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:5784
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:5824 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.177.11\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.177.11\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:5860
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.177.11\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.177.11\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:5892
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.177.11\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.177.11\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:5920
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzcuMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzcuMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OUFFNjkzMzctRjFBOS00NURBLUJDNUItQ0U1Q0UxMUZBQkM2fSIgdXNlcmlkPSJ7NjU0QkQ3RDEtQjE0Qy00RUQ4LUJGRjEtQTBBOTc2QUNGRDMzfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins4OUJCNzA0RC01Mjg3LTRBODItQjQ1OC0xNTMwMUE4M0EyMkV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgb3NfcmVnaW9uX25hbWU9IlVTIiBvc19yZWdpb25fbmF0aW9uPSIyNDQiIG9zX3JlZ2lvbl9kbWE9IjAiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtxV0pTeld3UGZkY0xSK1hHSXY2eHJaZmlZT3hoUFUyczFOV21qV2NhRlBnPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTc3LjExIiBuZXh0dmVyc2lvbj0iMS4zLjE3Ny4xMSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzQ3MjQyMTM3NyIgaW5zdGFsbF90aW1lX21zPSIyMDk2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:5960
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{9AE69337-F1A9-45DA-BC5B-CE5CE11FABC6}" /silent5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6056
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2244
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:6096 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzcuMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzcuMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OUFFNjkzMzctRjFBOS00NURBLUJDNUItQ0U1Q0UxMUZBQkM2fSIgdXNlcmlkPSJ7NjU0QkQ3RDEtQjE0Qy00RUQ4LUJGRjEtQTBBOTc2QUNGRDMzfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntGRkE4MDJFQi0yMEJCLTQyRUUtODU0Qi0xNUIyODRBRjA1Rjh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgb3NfcmVnaW9uX25hbWU9IlVTIiBvc19yZWdpb25fbmF0aW9uPSIyNDQiIG9zX3JlZ2lvbl9kbWE9IjAiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtxV0pTeld3UGZkY0xSK1hHSXY2eHJaZmlZT3hoUFUyczFOV21qV2NhRlBnPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMDYuMC41MjQ5LjExOSIgbmV4dHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iNSIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzQ4MTg5MTU0MiIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:3960
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E4E43C07-5D38-4D49-880B-DFC5B9244FEA}\MicrosoftEdge_X64_117.0.2045.47.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E4E43C07-5D38-4D49-880B-DFC5B9244FEA}\MicrosoftEdge_X64_117.0.2045.47.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
PID:5532 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E4E43C07-5D38-4D49-880B-DFC5B9244FEA}\EDGEMITMP_8E500.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E4E43C07-5D38-4D49-880B-DFC5B9244FEA}\EDGEMITMP_8E500.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{E4E43C07-5D38-4D49-880B-DFC5B9244FEA}\MicrosoftEdge_X64_117.0.2045.47.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5712
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzcuMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzcuMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OUFFNjkzMzctRjFBOS00NURBLUJDNUItQ0U1Q0UxMUZBQkM2fSIgdXNlcmlkPSJ7NjU0QkQ3RDEtQjE0Qy00RUQ4LUJGRjEtQTBBOTc2QUNGRDMzfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InszQ0JDRTM4Ri0zNjBELTRBMTAtODEwOC1DNjQ4QjNFOTM1RDF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgb3NfcmVnaW9uX25hbWU9IlVTIiBvc19yZWdpb25fbmF0aW9uPSIyNDQiIG9zX3JlZ2lvbl9kbWE9IjAiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMTcuMC4yMDQ1LjQ3IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NDk5MjUxMDc5IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzQ5OTM1MDk4MCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc3MDAzNzQwNjUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5mLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzhkNTFiODVlLWE2OWQtNGFjNy04YmNmLTMwZTdlZDI1ZWQyZD9QMT0xNjk2NzgzNzU1JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVQ5MTZPd1hLM2VLMm10NjFoYUlBNjlxdWg5UjNsdXZMV2NYWTkxQ3JIMDJieVU4RVo4M29SZE1UUGJEQkhkNEUyVU9oRnRrNDlOUVVnclhsSjBEdDBBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTU3NjgxNzIwIiB0b3RhbD0iMTU3NjgxNzIwIiBkb3dubG9hZF90aW1lX21zPSIxMTYzMyIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc3MDEwMTI2NzUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NzIwODczMjM3IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MTA5MzgxNDgxIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iODM4IiBkb3dubG9hZF90aW1lX21zPSIyMDEzNyIgZG93bmxvYWRlZD0iMTU3NjgxNzIwIiB0b3RhbD0iMTU3NjgxNzIwIiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSIzODgxMyIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:3488
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5456
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5584
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5684
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.177.11\MicrosoftEdgeUpdateBroker.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.177.11\MicrosoftEdgeUpdateBroker.exe" -Embedding1⤵
- Executes dropped EXE
PID:4660 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /broker2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3872
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /medsvc1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.177.11\MicrosoftEdgeUpdateBroker.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.177.11\MicrosoftEdgeUpdateBroker.exe" -Embedding1⤵
- Executes dropped EXE
PID:1288 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /broker2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1220
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /medsvc1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.177.11\MicrosoftEdgeUpdateBroker.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.177.11\MicrosoftEdgeUpdateBroker.exe" -Embedding1⤵
- Executes dropped EXE
PID:2800 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /broker2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:440
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /medsvc1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3872
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5312
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2744
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.177.11\MicrosoftEdgeUpdateBroker.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.177.11\MicrosoftEdgeUpdateBroker.exe" -Embedding1⤵
- Executes dropped EXE
PID:3704 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /broker2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5428
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /medsvc1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5184
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.177.11\MicrosoftEdgeUpdateBroker.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.177.11\MicrosoftEdgeUpdateBroker.exe" -Embedding1⤵
- Executes dropped EXE
PID:2820 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /broker2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3484
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /medsvc1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3076
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3144
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4452
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:496 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93ec046f8,0x7ff93ec04708,0x7ff93ec047182⤵PID:5900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:82⤵PID:3768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:22⤵PID:4756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:12⤵PID:4836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:12⤵PID:6068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:12⤵PID:1952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:12⤵PID:3596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:82⤵PID:5200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:12⤵PID:5860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4512 /prefetch:12⤵PID:5704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4420 /prefetch:12⤵PID:4812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:12⤵PID:4236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2200 /prefetch:12⤵PID:5888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5564 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4456 /prefetch:12⤵PID:4320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:12⤵PID:756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:12⤵PID:2320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --service-sandbox-type=audio --mojo-platform-channel-handle=5716 /prefetch:82⤵PID:3012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:12⤵PID:3424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2128 /prefetch:12⤵PID:5480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:12⤵PID:3216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:12⤵PID:568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:12⤵PID:5088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2016 /prefetch:12⤵PID:5980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:12⤵PID:4912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:12⤵PID:5940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:12⤵PID:4640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:12⤵PID:5860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:12⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:12⤵PID:4400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4356 /prefetch:12⤵PID:3412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:12⤵PID:5872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:12⤵PID:860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2024 /prefetch:12⤵PID:212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:12⤵PID:2772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --service-sandbox-type=collections --mojo-platform-channel-handle=6472 /prefetch:82⤵PID:5356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:12⤵PID:2040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:12⤵PID:1560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=4436 /prefetch:82⤵PID:5772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:12⤵PID:1700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:12⤵PID:5188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6976 /prefetch:12⤵PID:4256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7288 /prefetch:12⤵PID:4752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2688 /prefetch:12⤵PID:4920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:12⤵PID:1068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7552 /prefetch:12⤵PID:3200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:12⤵PID:5128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7856 /prefetch:12⤵PID:4508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --service-sandbox-type=collections --mojo-platform-channel-handle=7820 /prefetch:82⤵PID:2760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=8260 /prefetch:82⤵PID:4032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:12⤵PID:5844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8144 /prefetch:12⤵PID:1964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8308 /prefetch:12⤵PID:4256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:12⤵PID:5808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8420 /prefetch:12⤵PID:4604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9168 /prefetch:12⤵PID:5928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:12⤵PID:4428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7948 /prefetch:12⤵PID:4400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9000 /prefetch:12⤵PID:2732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:12⤵PID:3744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7612 /prefetch:12⤵PID:5436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9048 /prefetch:12⤵PID:2896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7176 /prefetch:12⤵PID:4048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8716 /prefetch:12⤵PID:5792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9172 /prefetch:12⤵PID:4500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7832 /prefetch:82⤵PID:5880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=7892 /prefetch:82⤵PID:5896
-
-
C:\Users\Admin\Downloads\SteamSetup.exe"C:\Users\Admin\Downloads\SteamSetup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:4604 -
C:\Program Files (x86)\Steam\bin\steamservice.exe"C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install3⤵
- Executes dropped EXE
PID:1092
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:5004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7832 /prefetch:12⤵PID:5008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8140 /prefetch:12⤵PID:5852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8576 /prefetch:12⤵PID:3324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:12⤵PID:1092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9064 /prefetch:12⤵PID:3140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8184 /prefetch:12⤵PID:3584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8652 /prefetch:12⤵PID:5948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1572 /prefetch:12⤵PID:5796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8464 /prefetch:12⤵PID:5240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8832 /prefetch:12⤵PID:4128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9320 /prefetch:12⤵PID:4880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9376 /prefetch:12⤵PID:3956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9260 /prefetch:12⤵PID:5760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9392 /prefetch:12⤵PID:3348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8276 /prefetch:82⤵PID:5696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:12⤵PID:4792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8328 /prefetch:12⤵PID:5408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8400 /prefetch:12⤵PID:2896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:12⤵PID:1348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=8384 /prefetch:82⤵PID:4284
-
-
C:\Users\Admin\Downloads\pdfcentral.exe"C:\Users\Admin\Downloads\pdfcentral.exe"2⤵
- Executes dropped EXE
PID:1228
-
-
C:\Users\Admin\Downloads\pdfcentral.exe"C:\Users\Admin\Downloads\pdfcentral.exe"2⤵
- Executes dropped EXE
PID:1876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9056 /prefetch:12⤵PID:1212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:12⤵PID:3324
-
-
C:\Users\Admin\Downloads\pdfcentral.exe"C:\Users\Admin\Downloads\pdfcentral.exe"2⤵
- Enumerates connected drives
PID:5608 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://application.pdfcentralapp.com3⤵
- Checks whether UAC is enabled
- Enumerates system info in registry
- Modifies system certificate store
- NTFS ADS
- System policy modification
PID:4492 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ff93ca98e88,0x7ff93ca98e98,0x7ff93ca98ea84⤵PID:4820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:34⤵PID:3848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2020 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:24⤵PID:2576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=2448 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:84⤵PID:2864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-nacl --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3468 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:14⤵
- Checks computer location settings
PID:6116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-nacl --first-renderer-process --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3376 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:14⤵
- Checks computer location settings
PID:3664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --disable-nacl --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4584 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:14⤵
- Checks computer location settings
PID:2908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=4992 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:84⤵PID:1432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=5056 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:84⤵PID:5616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-nacl --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5148 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:14⤵PID:2996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=5604 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:84⤵PID:4240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5396 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:84⤵PID:5552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=5932 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:84⤵PID:4272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-nacl --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=6032 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:14⤵PID:1768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-nacl --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5992 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:14⤵
- Checks computer location settings
PID:4880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5956 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:84⤵PID:2244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-nacl --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=6488 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:14⤵
- Checks computer location settings
PID:1020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-nacl --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=6352 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:14⤵PID:5400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5956 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:84⤵PID:2740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=4592 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:84⤵PID:5988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6852 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:84⤵PID:5812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6984 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:84⤵PID:1604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=5212 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:84⤵PID:2472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6332 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:84⤵PID:2184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=7196 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:84⤵PID:1404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=7060 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:84⤵PID:4296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-nacl --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=7496 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:14⤵
- Checks computer location settings
PID:5592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=7680 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:84⤵PID:5376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-nacl --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=5136 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:14⤵
- Checks computer location settings
PID:1472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=es --service-sandbox-type=audio --mojo-platform-channel-handle=7216 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:84⤵PID:5616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-nacl --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=6908 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:14⤵
- Checks computer location settings
PID:3264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=es --service-sandbox-type=collections --mojo-platform-channel-handle=5012 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:84⤵PID:4296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=es --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8328 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:84⤵PID:2028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=8360 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:84⤵PID:4160
-
-
C:\Users\Admin\Downloads\Wave Browser.exe"C:\Users\Admin\Downloads\Wave Browser.exe"4⤵PID:5904
-
-
C:\Users\Admin\Downloads\Wave Browser.exe"C:\Users\Admin\Downloads\Wave Browser.exe"4⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\nsx8BEE.tmp\SWUpdaterSetup.exe"C:\Users\Admin\AppData\Local\Temp\nsx8BEE.tmp\SWUpdaterSetup.exe" /install "bundlename=WaveBrowser&appguid={EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}&appname=WaveBrowser&needsadmin=False&lang=en&usagestats=1&installdataindex=1"5⤵PID:5344
-
C:\Program Files (x86)\Wavesor\Temp\GUMA6F6.tmp\SWUpdater.exe"C:\Program Files (x86)\Wavesor\Temp\GUMA6F6.tmp\SWUpdater.exe" /install "bundlename=WaveBrowser&appguid={EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}&appname=WaveBrowser&needsadmin=False&lang=en&usagestats=1&installdataindex=1"6⤵
- Adds Run key to start application
- Checks whether UAC is enabled
PID:1628 -
C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe"C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe" /regserver7⤵
- Registers COM server for autorun
- Checks whether UAC is enabled
- Modifies registry class
PID:6092 -
C:\Users\Admin\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe"C:\Users\Admin\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe" /user8⤵
- Registers COM server for autorun
- Modifies registry class
PID:4484
-
-
C:\Users\Admin\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe"C:\Users\Admin\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe" /user8⤵
- Registers COM server for autorun
- Modifies registry class
PID:1100
-
-
C:\Users\Admin\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe"C:\Users\Admin\Wavesor Software\SWUpdater\1.3.133.0\SWUpdaterComRegisterShell64.exe" /user8⤵
- Registers COM server for autorun
- Modifies registry class
PID:5620
-
-
-
C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe"C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJTV1VwZGF0ZXIiIHVwZGF0ZXJ2ZXJzaW9uPSIxLjMuMTMzLjAiIHNoZWxsX3ZlcnNpb249IjEuMy4xMzMuMCIgaXNtYWNoaW5lPSIwIiBzZXNzaW9uaWQ9InsyQzdDRjA2RS0xRjI2LTQ2MEItOEY5NS02RThFQjRFM0EwMkF9IiB1c2VyaWQ9IntlYTYwZmQ4Yy03YjBiLTQ0OGUtOTJiMy1jNThlYjhkNTZkOTN9IiBpbnN0YWxsc291cmNlPSJvdGhlcmluc3RhbGxjbWQiIHJlcXVlc3RpZD0ie0NCMjM5QzU1LUZBRTItNDc4Qy1BM0YwLTJFRDAzRjE1Qzk4N30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RjZGNjBBQ0UtNzFBRC00NjEwLTgwRDQtOTI1MzcyOUZCNEI3fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjEzMy4wIiBsYW5nPSJlbiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iNjEyIi8-PC9hcHA-PC9yZXF1ZXN0Pg7⤵
- Checks whether UAC is enabled
PID:5368
-
-
C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe"C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe" /handoff "bundlename=WaveBrowser&appguid={EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}&appname=WaveBrowser&needsadmin=False&lang=en&usagestats=1&installdataindex=1" /installsource otherinstallcmd /sessionid "{2C7CF06E-1F26-460B-8F95-6E8EB4E3A02A}"7⤵
- Checks whether UAC is enabled
PID:5356
-
-
-
-
-
C:\Users\Admin\Downloads\Wave Browser.exe"C:\Users\Admin\Downloads\Wave Browser.exe"4⤵PID:1972
-
-
C:\Users\Admin\Downloads\Wave Browser.exe"C:\Users\Admin\Downloads\Wave Browser.exe"4⤵PID:1456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=8596 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:84⤵PID:3536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=8196 --field-trial-handle=2024,i,12344275082517755660,12674538593008841635,262144 /prefetch:84⤵PID:1588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window /prefetch:54⤵
- Checks whether UAC is enabled
- Checks system information in the registry
- Enumerates system info in registry
- System policy modification
PID:5552 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=117.0.2045.47 --initial-client-data=0x160,0x164,0x168,0x13c,0x1b0,0x7ff93ca98e88,0x7ff93ca98e98,0x7ff93ca98ea85⤵PID:4508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=3260 --field-trial-handle=2832,i,7893227917647478640,5135912367852538873,262144 /prefetch:35⤵PID:1064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2816 --field-trial-handle=2832,i,7893227917647478640,5135912367852538873,262144 /prefetch:25⤵PID:2936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3672 --field-trial-handle=2832,i,7893227917647478640,5135912367852538873,262144 /prefetch:85⤵PID:2956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=3316 --field-trial-handle=2832,i,7893227917647478640,5135912367852538873,262144 /prefetch:85⤵PID:6092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=4348 --field-trial-handle=2832,i,7893227917647478640,5135912367852538873,262144 /prefetch:85⤵PID:5468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=4508 --field-trial-handle=2832,i,7893227917647478640,5135912367852538873,262144 /prefetch:85⤵PID:164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=4508 --field-trial-handle=2832,i,7893227917647478640,5135912367852538873,262144 /prefetch:85⤵PID:3164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=4444 --field-trial-handle=2832,i,7893227917647478640,5135912367852538873,262144 /prefetch:85⤵PID:5980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=4512 --field-trial-handle=2832,i,7893227917647478640,5135912367852538873,262144 /prefetch:85⤵PID:5556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=2740 --field-trial-handle=2832,i,7893227917647478640,5135912367852538873,262144 /prefetch:85⤵PID:3492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=4636 --field-trial-handle=2832,i,7893227917647478640,5135912367852538873,262144 /prefetch:85⤵PID:6796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=4664 --field-trial-handle=2832,i,7893227917647478640,5135912367852538873,262144 /prefetch:85⤵PID:6180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4656 --field-trial-handle=2832,i,7893227917647478640,5135912367852538873,262144 /prefetch:25⤵PID:1444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=4732 --field-trial-handle=2832,i,7893227917647478640,5135912367852538873,262144 /prefetch:85⤵PID:5044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=4780 --field-trial-handle=2832,i,7893227917647478640,5135912367852538873,262144 /prefetch:85⤵PID:8164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=5100 --field-trial-handle=2832,i,7893227917647478640,5135912367852538873,262144 /prefetch:85⤵PID:6572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=4860 --field-trial-handle=2832,i,7893227917647478640,5135912367852538873,262144 /prefetch:85⤵PID:6988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=4836 --field-trial-handle=2832,i,7893227917647478640,5135912367852538873,262144 /prefetch:85⤵PID:8140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=4948 --field-trial-handle=2832,i,7893227917647478640,5135912367852538873,262144 /prefetch:85⤵PID:7360
-
-
-
-
-
C:\Users\Admin\Downloads\pdfcentral.exe"C:\Users\Admin\Downloads\pdfcentral.exe"2⤵PID:5696
-
-
C:\Users\Admin\Downloads\pdfcentral.exe"C:\Users\Admin\Downloads\pdfcentral.exe"2⤵PID:1336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,4657071839530168158,3695385279002115355,131072 --lang=es --service-sandbox-type=collections --mojo-platform-channel-handle=9356 /prefetch:82⤵PID:5192
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:900
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4620
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f8 0x5041⤵PID:2496
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:1116
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:636 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9F82F0EE-29E1-422C-83F1-4A1360F24AA5}\MicrosoftEdge_X64_117.0.2045.47.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9F82F0EE-29E1-422C-83F1-4A1360F24AA5}\MicrosoftEdge_X64_117.0.2045.47.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable2⤵
- Executes dropped EXE
PID:792 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9F82F0EE-29E1-422C-83F1-4A1360F24AA5}\EDGEMITMP_F4757.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9F82F0EE-29E1-422C-83F1-4A1360F24AA5}\EDGEMITMP_F4757.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9F82F0EE-29E1-422C-83F1-4A1360F24AA5}\MicrosoftEdge_X64_117.0.2045.47.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Registers COM server for autorun
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- System policy modification
PID:5668 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9F82F0EE-29E1-422C-83F1-4A1360F24AA5}\EDGEMITMP_F4757.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9F82F0EE-29E1-422C-83F1-4A1360F24AA5}\EDGEMITMP_F4757.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2732
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzcuMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzcuMTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDhEMEI2RTItODA2Ni00QTZBLTlBMUMtM0Q4NUNEOTdFOUNGfSIgdXNlcmlkPSJ7NjU0QkQ3RDEtQjE0Qy00RUQ4LUJGRjEtQTBBOTc2QUNGRDMzfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins4RDkxRDdCMi1DRDYzLTQ5OTYtOTIwNS00NUU3NEE2REM1QkN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgb3NfcmVnaW9uX25hbWU9IlVTIiBvc19yZWdpb25fbmF0aW9uPSIyNDQiIG9zX3JlZ2lvbl9kbWE9IjAiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtxV0pTeld3UGZkY0xSK1hHSXY2eHJaZmlZT3hoUFUyczFOV21qV2NhRlBnPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTc3LjExIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC42OSI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIxNiIgcmQ9IjYxMDEiIHBpbmdfZnJlc2huZXNzPSJ7NTk4RjNDQUYtMTc3QS00NDM0LUFGMTItQUM2QUYyMjAxRjYyfSIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSI5Mi4wLjkwMi42NyIgbmV4dHZlcnNpb249IjExNy4wLjIwNDUuNDciIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaXNfcGlubmVkX3N5c3RlbT0idHJ1ZSIgbGFzdF9sYXVuY2hfY291bnQ9IjEiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzQwNjUyNjk2MzQzMzY0MCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTA0ODI3MDQ3NjEiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTA0ODI5MDQzODIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTA1MzM4OTU1NTQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTA1NTI3NDU0OTgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwNzczMzc0NDg2IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iNDk5IiBkb3dubG9hZGVkPSIxNTc2ODE3MjAiIHRvdGFsPSIxNTc2ODE3MjAiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIyIiBpbnN0YWxsX3RpbWVfbXM9IjIyMDU5Ii8-PHBpbmcgYWN0aXZlPSIxIiBhPSIxNiIgcj0iMTYiIGFkPSI2MTAxIiByZD0iNjEwMSIgcGluZ19mcmVzaG5lc3M9IntEOThEMjNERi0xQjIyLTQwQjMtODAxRS02RjgxNDk0ODAzOUF9Ii8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjExNy4wLjIwNDUuNDciIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZT0iNjExMSIgY29ob3J0PSJycmZAMC45OSI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSItMSIgcmQ9Ii0xIiBwaW5nX2ZyZXNobmVzcz0iezNFNjA1NjJGLUM4MkUtNDdCQy1CRjM5LTdGRDExRTBBRjQ5N30iLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:5388
-
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap24188:122:7zEvent121331⤵PID:3788
-
C:\Users\Admin\Desktop\free_setup - key.exe"C:\Users\Admin\Desktop\free_setup - key.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
PID:5660 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c schtasks /create /tn \Service\Data /tr """"C:\Users\Admin\AppData\Roaming\ServiceData\Belonero.exe""" """C:\Users\Admin\AppData\Roaming\ServiceData\Belonero.dat"""" /st 00:01 /du 9800:59 /sc once /ri 1 /f2⤵PID:1992
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \Service\Data /tr """"C:\Users\Admin\AppData\Roaming\ServiceData\Belonero.exe""" """C:\Users\Admin\AppData\Roaming\ServiceData\Belonero.dat"""" /st 00:01 /du 9800:59 /sc once /ri 1 /f3⤵
- Creates scheduled task(s)
PID:8
-
-
-
C:\Users\Admin\AppData\Roaming\ServiceData\Belonero.exeC:\Users\Admin\AppData\Roaming\ServiceData\Belonero.exe "C:\Users\Admin\AppData\Roaming\ServiceData\Belonero.dat"1⤵
- Executes dropped EXE
PID:1872
-
C:\Program Files (x86)\Steam\steam.exe"C:\Program Files (x86)\Steam\steam.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Checks processor information in registry
PID:3160 -
C:\Program Files (x86)\Steam\steam.exe"C:\Program Files (x86)\Steam\steam.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4768 -
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" "-lang=es_ES" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=4768" "-buildid=1696019606" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\steam.exe" "-launcher=0" --enable-media-stream --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu "--disable-features=SameSiteByDefaultCookies" "--enable-blink-features=ResizeObserver,Worklet,AudioWorklet" "--disable-blink-features=Badging"3⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:4372 -
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1696019606 --initial-client-data=0x370,0x374,0x378,0x34c,0x37c,0x7ff93ac8f070,0x7ff93ac8f080,0x7ff93ac8f0904⤵
- Executes dropped EXE
PID:5436
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --field-trial-handle=1416,11619768329921643786,11284222412625959840,131072 --enable-features=CastMediaRouteProvider --disable-features=SameSiteByDefaultCookies --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --product-version="Valve Steam Client" --lang=es-ES --buildid=1696019606 --steamid=0 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --mojo-platform-channel-handle=1688 /prefetch:24⤵
- Executes dropped EXE
PID:2216
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1416,11619768329921643786,11284222412625959840,131072 --enable-features=CastMediaRouteProvider --disable-features=SameSiteByDefaultCookies --lang=es --service-sandbox-type=network --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --product-version="Valve Steam Client" --lang=es-ES --buildid=1696019606 --steamid=0 --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --mojo-platform-channel-handle=2184 /prefetch:84⤵
- Executes dropped EXE
PID:5336
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --field-trial-handle=1416,11619768329921643786,11284222412625959840,131072 --enable-features=CastMediaRouteProvider --disable-features=SameSiteByDefaultCookies --enable-blink-features=ResizeObserver,Worklet,AudioWorklet --disable-blink-features=Badging --lang=es --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --product-version="Valve Steam Client" --buildid=1696019606 --steamid=0 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2468 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
PID:4476
-
-
-
C:\Program Files (x86)\Steam\bin\gldriverquery64.exe.\bin\gldriverquery64.exe3⤵
- Executes dropped EXE
PID:4544
-
-
C:\Program Files (x86)\Steam\bin\gldriverquery.exe.\bin\gldriverquery.exe3⤵
- Executes dropped EXE
PID:3144
-
-
C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe.\bin\vulkandriverquery64.exe3⤵
- Executes dropped EXE
PID:5940
-
-
C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe.\bin\vulkandriverquery.exe3⤵
- Executes dropped EXE
PID:4644
-
-
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\Desktop\" -spe -an -ai#7zMap17933:92:7zEvent227441⤵PID:1300
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\Desktop\" -an -ai#7zMap30565:794:7zEvent130111⤵PID:5332
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1312
-
C:\Program Files (x86)\Steam\Steam.exe"C:\Program Files (x86)\Steam\Steam.exe"1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4500 -
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" "-lang=es_ES" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=4500" "-buildid=1696019606" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\Steam.exe" "-launcher=0" --enable-media-stream --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu "--disable-features=SameSiteByDefaultCookies" "--enable-blink-features=ResizeObserver,Worklet,AudioWorklet" "--disable-blink-features=Badging"2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:1732 -
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1696019606 --initial-client-data=0x370,0x374,0x378,0x34c,0x37c,0x7ff93e42f070,0x7ff93e42f080,0x7ff93e42f0903⤵
- Executes dropped EXE
PID:5480
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --field-trial-handle=1580,8864213208541472665,6280132287421470504,131072 --enable-features=CastMediaRouteProvider --disable-features=SameSiteByDefaultCookies --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --product-version="Valve Steam Client" --lang=es-ES --buildid=1696019606 --steamid=0 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --mojo-platform-channel-handle=1656 /prefetch:23⤵
- Executes dropped EXE
PID:3640
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1580,8864213208541472665,6280132287421470504,131072 --enable-features=CastMediaRouteProvider --disable-features=SameSiteByDefaultCookies --lang=es --service-sandbox-type=network --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --product-version="Valve Steam Client" --lang=es-ES --buildid=1696019606 --steamid=0 --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --mojo-platform-channel-handle=1652 /prefetch:83⤵
- Executes dropped EXE
PID:568
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --field-trial-handle=1580,8864213208541472665,6280132287421470504,131072 --enable-features=CastMediaRouteProvider --disable-features=SameSiteByDefaultCookies --enable-blink-features=ResizeObserver,Worklet,AudioWorklet --disable-blink-features=Badging --lang=es --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --product-version="Valve Steam Client" --buildid=1696019606 --steamid=0 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2484 /prefetch:13⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3572
-
-
-
C:\Program Files (x86)\Steam\bin\gldriverquery64.exe.\bin\gldriverquery64.exe2⤵
- Executes dropped EXE
PID:4684
-
-
C:\Program Files (x86)\Steam\bin\gldriverquery.exe.\bin\gldriverquery.exe2⤵
- Executes dropped EXE
PID:4632
-
-
C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe.\bin\vulkandriverquery64.exe2⤵
- Executes dropped EXE
PID:1472
-
-
C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe.\bin\vulkandriverquery.exe2⤵
- Executes dropped EXE
PID:3856
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5928
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\Desktop\*\" -spe -an -ai#7zMap23097:466:7zEvent128891⤵PID:864
-
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe"1⤵PID:5376
-
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe" --rename-msedge-exe --system-level --verbose-logging --msedge --channel=stable2⤵PID:5756
-
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe" --msedge --channel=stable --delete-old-versions --system-level --verbose-logging3⤵
- Modifies data under HKEY_USERS
PID:3516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level3⤵PID:1588
-
-
-
C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe"C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe" -Embedding1⤵
- Checks whether UAC is enabled
PID:1560 -
C:\Users\Admin\Wavesor Software\SWUpdater\Install\{D9BEC43C-1473-4760-BDB8-6B047258E9C4}\WaveInstaller-v1.3.15.3.exe"C:\Users\Admin\Wavesor Software\SWUpdater\Install\{D9BEC43C-1473-4760-BDB8-6B047258E9C4}\WaveInstaller-v1.3.15.3.exe" /installerdata="C:\Users\Admin\AppData\Local\Temp\guiEECD.tmp"2⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\nsjF69E.tmp\setup.exe"C:\Users\Admin\AppData\Local\Temp\nsjF69E.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\nsjF69E.tmp\wavebrowser.packed.7z" --wid=2hba4pwa --make-chrome-default --installerdata="C:\Users\Admin\AppData\Local\Temp\guiEECD.tmp"3⤵
- Registers COM server for autorun
- Modifies registry class
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\nsjF69E.tmp\setup.exeC:\Users\Admin\AppData\Local\Temp\nsjF69E.tmp\setup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Crashpad" --annotation=channel= --annotation=plat=Win64 --annotation=prod=WaveBrowser --annotation=ver=1.3.15.3 --initial-client-data=0x278,0x27c,0x280,0x248,0x284,0x7ff6785e37a0,0x7ff6785e37b0,0x7ff6785e37c04⤵PID:2600
-
-
C:\Users\Admin\AppData\Local\Temp\nsjF69E.tmp\setup.exe"C:\Users\Admin\AppData\Local\Temp\nsjF69E.tmp\setup.exe" --verbose-logging --installerdata="C:\Users\Admin\AppData\Local\Temp\guiEECD.tmp" --create-shortcuts=0 --install-level=04⤵
- Checks computer location settings
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\nsjF69E.tmp\setup.exeC:\Users\Admin\AppData\Local\Temp\nsjF69E.tmp\setup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Crashpad" --annotation=channel= --annotation=plat=Win64 --annotation=prod=WaveBrowser --annotation=ver=1.3.15.3 --initial-client-data=0x278,0x27c,0x280,0x250,0x284,0x7ff6785e37a0,0x7ff6785e37b0,0x7ff6785e37c05⤵PID:1988
-
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --prevdefbrowser=6 --install-type=1 --from-installer4⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:4880 -
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\WaveBrowser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\WaveBrowser\User Data" --annotation=channel= --annotation=plat=Win64 --annotation=prod=WaveBrowser --annotation=ver=1.3.15.3 --initial-client-data=0xf4,0xf0,0xfc,0x118,0xf8,0x7ff93e319ae0,0x7ff93e319af0,0x7ff93e319b005⤵PID:5592
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=gpu-process --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:25⤵PID:1748
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --start-stack-profiler --mojo-platform-channel-handle=1788 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:4168
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=2472 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:5468
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --first-renderer-process --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3596 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:4240
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --extension-process --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3776 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:5300
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=3520 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:2840
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=4352 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:552
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4576 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:5940
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4440 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:1656
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4392 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:4160
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5136 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:1704
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5280 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:4764
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5332 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:224
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5628 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:4472
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --start-stack-profiler --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5792 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:5004
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --instant-process --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5940 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:464
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=3576 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:4684
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6276 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:4712
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6572 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6280
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6392 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6356
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=3040 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6476
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6588 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6568
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6760 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6664
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=4980 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6760
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=5020 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6844
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=4464 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6908
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=6828 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6936
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6292 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:1948
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6232 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:4920
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=5964 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6160
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6276 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6228
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6572 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6260
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6716 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:2736
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6344 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6424
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=6376 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6388
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6908 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:4860
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=7056 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6660
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=7196 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6688
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=7096 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6592
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=7044 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6692
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=7344 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:1324
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=7728 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6060
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=7880 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:4264
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=7696 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6948
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=8324 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6960
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=8464 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6348
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=8604 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6644
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=8744 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:1840
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=8864 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:7064
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=8896 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6152
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=9024 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6448
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6660 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6820
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --extension-process --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --mojo-platform-channel-handle=4948 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:2012
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --extension-process --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --mojo-platform-channel-handle=6908 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:2520
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --extension-process --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --mojo-platform-channel-handle=6580 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:6292
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --mojo-platform-channel-handle=7156 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:6208
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6860 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6620
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --extension-process --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --mojo-platform-channel-handle=6856 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:4544
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --extension-process --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --mojo-platform-channel-handle=9304 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:4152
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --extension-process --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --mojo-platform-channel-handle=9440 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:6912
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --extension-process --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --mojo-platform-channel-handle=9428 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:6256
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6880 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:7024
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=4560 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:2028
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=9128 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵
- Checks computer location settings
PID:4240
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=4588 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6828
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=9640 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6644
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=9304 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6860
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=9348 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6476
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:3304
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=8768 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:1968
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --extension-process --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --mojo-platform-channel-handle=1652 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:5500
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6380 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:7124
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=528 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6944
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --start-stack-profiler --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6748 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:25⤵PID:8140
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=1212 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:8096
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --extension-process --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --mojo-platform-channel-handle=9548 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:1208
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --start-stack-profiler --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --mojo-platform-channel-handle=9568 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:1300
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --start-stack-profiler --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --mojo-platform-channel-handle=3596 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:4924
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --mojo-platform-channel-handle=8468 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:6272
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --mojo-platform-channel-handle=8496 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:7248
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --mojo-platform-channel-handle=8580 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:6412
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --mojo-platform-channel-handle=8816 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:6832
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --start-stack-profiler --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --mojo-platform-channel-handle=8780 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:5660
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --mojo-platform-channel-handle=5536 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:7648
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --start-stack-profiler --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --mojo-platform-channel-handle=4728 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:7816
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --mojo-platform-channel-handle=8840 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:6996
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --instant-process --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --mojo-platform-channel-handle=8764 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:756
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --extension-process --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --mojo-platform-channel-handle=5068 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:7896
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=2992 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:5216
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=5364 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6616
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --mojo-platform-channel-handle=5252 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:3208
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --mojo-platform-channel-handle=9080 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:6620
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=es --service-sandbox-type=audio --mojo-platform-channel-handle=8744 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6468
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5428 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:656
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=5760 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:1560
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=7848 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:6764
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=6812 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:3884
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --mojo-platform-channel-handle=5996 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:85⤵PID:2740
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --mojo-platform-channel-handle=5696 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:7924
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --start-stack-profiler --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --mojo-platform-channel-handle=7240 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:8188
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --mojo-platform-channel-handle=7436 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:4180
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --mojo-platform-channel-handle=8036 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:6104
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --start-stack-profiler --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --mojo-platform-channel-handle=7324 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:5876
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --mojo-platform-channel-handle=7936 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:1948
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --mojo-platform-channel-handle=10088 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:6176
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --mojo-platform-channel-handle=10124 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:4156
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --mojo-platform-channel-handle=3396 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:7780
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --mojo-platform-channel-handle=10436 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:7312
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --mojo-platform-channel-handle=3732 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:2840
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --mojo-platform-channel-handle=10476 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:4884
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --mojo-platform-channel-handle=10628 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:952
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --mojo-platform-channel-handle=10624 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:7340
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --mojo-platform-channel-handle=11308 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:8216
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --mojo-platform-channel-handle=11344 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:8280
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --start-stack-profiler --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --mojo-platform-channel-handle=11508 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:8304
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --start-stack-profiler --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --mojo-platform-channel-handle=9844 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:4056
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --start-stack-profiler --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --mojo-platform-channel-handle=9996 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:1060
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --mojo-platform-channel-handle=12756 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:8792
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --mojo-platform-channel-handle=12764 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:8860
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --mojo-platform-channel-handle=13192 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:8988
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --mojo-platform-channel-handle=13212 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:8836
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --mojo-platform-channel-handle=5148 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:2588
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --mojo-platform-channel-handle=11916 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:9196
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --start-stack-profiler --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --mojo-platform-channel-handle=13096 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:9092
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --mojo-platform-channel-handle=11600 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:8660
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --mojo-platform-channel-handle=12172 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:6316
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=130 --mojo-platform-channel-handle=12016 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:8632
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --mojo-platform-channel-handle=13656 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:7076
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=129 --mojo-platform-channel-handle=11640 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:8376
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=132 --mojo-platform-channel-handle=4152 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:7272
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=133 --mojo-platform-channel-handle=7880 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:8720
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=134 --mojo-platform-channel-handle=10268 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:3416
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=135 --mojo-platform-channel-handle=11964 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:9316
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=136 --mojo-platform-channel-handle=4792 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:9488
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=137 --mojo-platform-channel-handle=8948 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:9596
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=138 --mojo-platform-channel-handle=9380 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:9668
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=139 --mojo-platform-channel-handle=7340 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:9740
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=140 --mojo-platform-channel-handle=6272 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:9792
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=141 --mojo-platform-channel-handle=4720 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:7668
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=142 --mojo-platform-channel-handle=5292 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:3816
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=143 --mojo-platform-channel-handle=13496 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:7984
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=144 --mojo-platform-channel-handle=5364 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:8804
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=145 --mojo-platform-channel-handle=6368 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:7460
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=146 --mojo-platform-channel-handle=4680 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:8952
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=147 --mojo-platform-channel-handle=9472 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:5792
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=148 --mojo-platform-channel-handle=10016 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:8688
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --extension-process --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=149 --mojo-platform-channel-handle=8648 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵
- Checks computer location settings
PID:9716
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=150 --mojo-platform-channel-handle=12248 --field-trial-handle=2052,i,3790285096753593147,4376432517662954791,131072 /prefetch:15⤵PID:9960
-
-
-
-
-
C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe"C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJTV1VwZGF0ZXIiIHVwZGF0ZXJ2ZXJzaW9uPSIxLjMuMTMzLjAiIHNoZWxsX3ZlcnNpb249IjEuMy4xMzMuMCIgaXNtYWNoaW5lPSIwIiBzZXNzaW9uaWQ9InsyQzdDRjA2RS0xRjI2LTQ2MEItOEY5NS02RThFQjRFM0EwMkF9IiB1c2VyaWQ9IntlYTYwZmQ4Yy03YjBiLTQ0OGUtOTJiMy1jNThlYjhkNTZkOTN9IiBpbnN0YWxsc291cmNlPSJvdGhlcmluc3RhbGxjbWQiIHJlcXVlc3RpZD0ie0U0NzI4M0NGLTIxRDItNDYwQy1CQ0VCLUFGMDkxREY5RjY0NH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7RUIxNDlBRDItQ0U0RS00RjUxLUI3RkMtQTE0OUZBQTRDQ0FGfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjE1LjMiIGxhbmc9ImVzIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHBzOi8vY2RuLnN3dXBkYXRlci5jb20vYnVpbGQvV2F2ZUJyb3dzZXIvc3RhYmxlL3dpbi8xMTEyMzk3NTEyNzA3LzY0L1dhdmVJbnN0YWxsZXItdjEuMy4xNS4zLmV4ZSIgZG93bmxvYWRlZD0iOTE5OTkyOTYiIHRvdGFsPSI5MTk5OTI5NiIgZG93bmxvYWRfdGltZV9tcz0iNzg5NSIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjY0NSIgZG93bmxvYWRfdGltZV9tcz0iOTE3MSIgZG93bmxvYWRlZD0iOTE5OTkyOTYiIHRvdGFsPSI5MTk5OTI5NiIgaW5zdGFsbF90aW1lX21zPSIzMDk4NCIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Checks whether UAC is enabled
PID:6056
-
-
C:\Program Files (x86)\Steam\Steam.exe"C:\Program Files (x86)\Steam\Steam.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6972 -
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" "-lang=es_ES" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=6972" "-buildid=1696019606" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\Steam.exe" "-launcher=0" --enable-media-stream --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu "--disable-features=SameSiteByDefaultCookies" "--enable-blink-features=ResizeObserver,Worklet,AudioWorklet" "--disable-blink-features=Badging"2⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:4684 -
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1696019606 --initial-client-data=0x370,0x374,0x378,0x34c,0x37c,0x7ff93e44f070,0x7ff93e44f080,0x7ff93e44f0903⤵PID:6436
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --field-trial-handle=1656,12930395088012214944,6564607093481956180,131072 --enable-features=CastMediaRouteProvider --disable-features=SameSiteByDefaultCookies --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --product-version="Valve Steam Client" --lang=es-ES --buildid=1696019606 --steamid=0 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --mojo-platform-channel-handle=1660 /prefetch:23⤵PID:1524
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1656,12930395088012214944,6564607093481956180,131072 --enable-features=CastMediaRouteProvider --disable-features=SameSiteByDefaultCookies --lang=es --service-sandbox-type=network --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --product-version="Valve Steam Client" --lang=es-ES --buildid=1696019606 --steamid=0 --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --mojo-platform-channel-handle=2200 /prefetch:83⤵PID:6708
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --field-trial-handle=1656,12930395088012214944,6564607093481956180,131072 --enable-features=CastMediaRouteProvider --disable-features=SameSiteByDefaultCookies --enable-blink-features=ResizeObserver,Worklet,AudioWorklet --disable-blink-features=Badging --lang=es --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --product-version="Valve Steam Client" --buildid=1696019606 --steamid=0 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2540 /prefetch:13⤵PID:5380
-
-
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --field-trial-handle=1656,12930395088012214944,6564607093481956180,131072 --enable-features=CastMediaRouteProvider --disable-features=SameSiteByDefaultCookies --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --product-version="Valve Steam Client" --lang=es-ES --buildid=1696019606 --steamid=0 --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --mojo-platform-channel-handle=1108 /prefetch:23⤵PID:7600
-
-
-
C:\Program Files (x86)\Steam\bin\gldriverquery64.exe.\bin\gldriverquery64.exe2⤵PID:4540
-
-
C:\Program Files (x86)\Steam\bin\gldriverquery.exe.\bin\gldriverquery.exe2⤵PID:376
-
-
C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe.\bin\vulkandriverquery64.exe2⤵PID:3208
-
-
C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe.\bin\vulkandriverquery.exe2⤵PID:4384
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:6584
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:6176
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Sets desktop wallpaper using registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:6104 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6104.0.542104129\1862272525" -parentBuildID 20221007134813 -prefsHandle 1856 -prefMapHandle 1848 -prefsLen 20938 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc0d42ec-f695-423b-8727-78e8b093c2be} 6104 "\\.\pipe\gecko-crash-server-pipe.6104" 1948 181677d5358 gpu3⤵PID:1100
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6104.1.586371937\1138492981" -parentBuildID 20221007134813 -prefsHandle 2336 -prefMapHandle 2332 -prefsLen 20974 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73007d96-68c9-4ea7-8fb1-d84c36dc1629} 6104 "\\.\pipe\gecko-crash-server-pipe.6104" 2348 18167132f58 socket3⤵
- Checks processor information in registry
PID:5248
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6104.2.1661067592\646535783" -childID 1 -isForBrowser -prefsHandle 3108 -prefMapHandle 3104 -prefsLen 21012 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a8cb08d-ba5a-410f-8bd0-fe0cad52155d} 6104 "\\.\pipe\gecko-crash-server-pipe.6104" 3120 1816b7b0858 tab3⤵PID:6712
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6104.3.8899952\1153686587" -childID 2 -isForBrowser -prefsHandle 3588 -prefMapHandle 3584 -prefsLen 26437 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c49e9474-e58a-4b8b-b8b2-2cc8c89628aa} 6104 "\\.\pipe\gecko-crash-server-pipe.6104" 3600 1815ad62b58 tab3⤵PID:1200
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6104.4.2110635378\1024215922" -childID 3 -isForBrowser -prefsHandle 4480 -prefMapHandle 4476 -prefsLen 26496 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a92f74b-2681-4c9a-b732-88f8f8f5f519} 6104 "\\.\pipe\gecko-crash-server-pipe.6104" 4488 1816cc1da58 tab3⤵PID:4384
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6104.7.845871922\689492594" -childID 6 -isForBrowser -prefsHandle 5696 -prefMapHandle 5700 -prefsLen 26656 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {08e3bb31-cdb0-444f-959c-bb7bbc1e69bf} 6104 "\\.\pipe\gecko-crash-server-pipe.6104" 5688 1816a624358 tab3⤵PID:1916
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6104.6.1714845739\2016323025" -childID 5 -isForBrowser -prefsHandle 5504 -prefMapHandle 5508 -prefsLen 26656 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {704a200b-7d4c-4ded-8cb7-9c938b175033} 6104 "\\.\pipe\gecko-crash-server-pipe.6104" 5496 18168c98e58 tab3⤵PID:6856
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6104.5.1858910221\452063590" -childID 4 -isForBrowser -prefsHandle 5408 -prefMapHandle 2776 -prefsLen 26656 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {13f1e8c0-85f5-48e1-b0ba-2b6f8a944f96} 6104 "\\.\pipe\gecko-crash-server-pipe.6104" 5420 1815ad2f058 tab3⤵PID:6164
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6104.8.1696982388\1677618621" -childID 7 -isForBrowser -prefsHandle 6084 -prefMapHandle 6080 -prefsLen 26831 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f91120d3-f44c-4038-92aa-5d115c64e3cd} 6104 "\\.\pipe\gecko-crash-server-pipe.6104" 6100 1816f473558 tab3⤵PID:7692
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6104.9.52736919\856406968" -childID 8 -isForBrowser -prefsHandle 5432 -prefMapHandle 2968 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ffcd5a4-7bc1-4de0-8f56-f819fa280c75} 6104 "\\.\pipe\gecko-crash-server-pipe.6104" 6360 1816d94d858 tab3⤵PID:7860
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6104.10.1650550785\1207865105" -childID 9 -isForBrowser -prefsHandle 4480 -prefMapHandle 5148 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {31709855-c7bf-4ce2-a32c-94ed75601379} 6104 "\\.\pipe\gecko-crash-server-pipe.6104" 5584 1817135a258 tab3⤵PID:5780
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6104.13.1382714204\150913056" -childID 12 -isForBrowser -prefsHandle 6736 -prefMapHandle 6740 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {76aadea0-747f-409a-9f8c-7cae7944fd60} 6104 "\\.\pipe\gecko-crash-server-pipe.6104" 6728 1816fb11058 tab3⤵PID:7756
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6104.12.1448947011\169823185" -childID 11 -isForBrowser -prefsHandle 6552 -prefMapHandle 6548 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {42104093-55d8-4f0a-bc93-dfcc2e415d0d} 6104 "\\.\pipe\gecko-crash-server-pipe.6104" 6560 1816fb12558 tab3⤵PID:7748
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6104.11.1342506697\210510696" -childID 10 -isForBrowser -prefsHandle 3536 -prefMapHandle 3532 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc2c1ce1-5880-45c3-9923-617d681add98} 6104 "\\.\pipe\gecko-crash-server-pipe.6104" 2900 1816a0c0f58 tab3⤵PID:8120
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6104.14.390677533\752657578" -childID 13 -isForBrowser -prefsHandle 6980 -prefMapHandle 6984 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {136294fc-af98-4485-9a51-55de81a943f7} 6104 "\\.\pipe\gecko-crash-server-pipe.6104" 6972 1816f3f4f58 tab3⤵PID:8140
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6104.15.1755095417\664366489" -parentBuildID 20221007134813 -prefsHandle 6480 -prefMapHandle 6364 -prefsLen 27096 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9347b7a9-72a2-4917-b42c-6ba0bc5b6e12} 6104 "\\.\pipe\gecko-crash-server-pipe.6104" 6396 1816d41c258 rdd3⤵PID:8036
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6104.16.2008391626\1742027129" -childID 14 -isForBrowser -prefsHandle 10668 -prefMapHandle 10672 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2214ea2-ca35-47d3-bd38-5c694da82537} 6104 "\\.\pipe\gecko-crash-server-pipe.6104" 10660 1816d94f058 tab3⤵PID:2208
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6104.17.966724845\1390498049" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6400 -prefMapHandle 6424 -prefsLen 27096 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3cf8cf52-d4d4-4cb1-881b-c1bf571a2635} 6104 "\\.\pipe\gecko-crash-server-pipe.6104" 5792 1816f2c9258 utility3⤵PID:2756
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6104.18.1580727459\194478588" -childID 15 -isForBrowser -prefsHandle 6620 -prefMapHandle 5484 -prefsLen 27096 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d178f09a-b17f-49ff-b2a3-b345629abefd} 6104 "\\.\pipe\gecko-crash-server-pipe.6104" 6992 1816d94d858 tab3⤵PID:4280
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6104.19.1500879599\1403837754" -childID 16 -isForBrowser -prefsHandle 6560 -prefMapHandle 4588 -prefsLen 27634 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0f6341b-2abc-4383-9b15-fb8efb6345c0} 6104 "\\.\pipe\gecko-crash-server-pipe.6104" 6872 18170b47d58 tab3⤵PID:7928
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6104.20.464092280\1069619028" -childID 17 -isForBrowser -prefsHandle 6628 -prefMapHandle 5468 -prefsLen 27903 -prefMapSize 232675 -jsInitHandle 1484 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c35d0ab0-f597-4bfa-97ff-4db8aceb1def} 6104 "\\.\pipe\gecko-crash-server-pipe.6104" 6664 1815ad63b58 tab3⤵PID:8152
-
-
-
C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\devos_paid.exe"C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\devos_paid.exe"1⤵PID:7372
-
C:\Users\Admin\AppData\Local\Temp\DEVOS MENU PAID V1.exe"C:\Users\Admin\AppData\Local\Temp\DEVOS MENU PAID V1.exe"2⤵PID:1068
-
-
C:\Users\Admin\AppData\Local\Temp\injector.exe"C:\Users\Admin\AppData\Local\Temp\injector.exe"2⤵PID:5264
-
-
C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\mapper.bin.exe"C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\mapper.bin.exe"1⤵
- Drops startup file
- Adds Run key to start application
PID:4644 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\mapper.bin.exe" "mapper.bin.exe" ENABLE2⤵
- Modifies Windows Firewall
PID:4360
-
-
C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\New Client.exe"C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\New Client.exe"1⤵PID:2416
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵PID:5576
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\New Client.exe" /sc minute /mo 12⤵
- Creates scheduled task(s)
PID:6560
-
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"2⤵
- Drops startup file
- Adds Run key to start application
PID:7000 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F3⤵PID:5752
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\Client.exe" /sc minute /mo 13⤵
- Creates scheduled task(s)
PID:8176
-
-
-
C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\sightware.bin.exe"C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\sightware.bin.exe"1⤵PID:5792
-
C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\WKAopkeae.bin.exe"C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\WKAopkeae.bin.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2500 -
C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\WKAopkeae.bin.exe"C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\WKAopkeae.bin.exe"2⤵PID:7220
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\WKAopkeae.bin.exe" "WKAopkeae.bin.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:7376
-
-
-
C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\XWare loader.bin.exe"C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\XWare loader.bin.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:6028 -
C:\ProgramData\system.exe"C:\ProgramData\system.exe"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
PID:672 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- Creates scheduled task(s)
PID:1444
-
-
-
C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\XWare loader.bin.exe"C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\XWare loader.bin.exe"1⤵PID:3960
-
C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\WKAopkeae.bin.exe"C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\WKAopkeae.bin.exe"1⤵
- Suspicious use of SetThreadContext
PID:7756 -
C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\WKAopkeae.bin.exe"C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\WKAopkeae.bin.exe"2⤵PID:7924
-
-
C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\sightware.bin.exe"C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\sightware.bin.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:7320
-
C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\New Client.exe"C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\New Client.exe"1⤵PID:1412
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵PID:8076
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\New Client.exe" /sc minute /mo 12⤵
- Creates scheduled task(s)
PID:6432
-
-
C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\devos_paid.exe"C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\devos_paid.exe"1⤵PID:1948
-
C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\mapper.bin.exe"C:\Users\Admin\Desktop\Nueva carpeta - copia (2)\mapper.bin.exe"1⤵PID:7804
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --strtl=ti1⤵
- Enumerates system info in registry
PID:6024 -
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\WaveBrowser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\WaveBrowser\User Data" --annotation=channel= --annotation=plat=Win64 --annotation=prod=WaveBrowser --annotation=ver=1.3.15.3 --initial-client-data=0x10c,0x108,0x114,0x12c,0x110,0x7ff93e319ae0,0x7ff93e319af0,0x7ff93e319b002⤵PID:8068
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=gpu-process --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 --field-trial-handle=1824,i,13316384470766035388,5774578712493549987,131072 /prefetch:22⤵PID:932
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --start-stack-profiler --mojo-platform-channel-handle=2160 --field-trial-handle=1824,i,13316384470766035388,5774578712493549987,131072 /prefetch:82⤵PID:3056
-
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵PID:8784
-
C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe"C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe" /c1⤵
- Checks whether UAC is enabled
PID:9148 -
C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe"C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe" /cr2⤵
- Checks whether UAC is enabled
PID:9132
-
-
C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe"C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe" /ua /installsource core2⤵
- Checks whether UAC is enabled
PID:9748
-
-
C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe"C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe" /ua /installsource scheduler1⤵
- Checks whether UAC is enabled
PID:1580 -
C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe"C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe" /registermsihelper2⤵
- Checks whether UAC is enabled
PID:9580
-
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵PID:1360
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4Browser Extensions
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Modify Registry
8Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5c4b7da809e5d3ddc2289eaee3c5e3033
SHA19de425d7bf1346c12b238d04d84a7022a75fa7ba
SHA256182a04959e1847e39efdb95563f58397e09ec5471aadaed94e4692e891ba8aab
SHA512d6021a96185d23ca6b22cd395d5d400c45718e12cc139b442ac3619b37aeff3c745689612627c6a862f4974917e8bc5937a32dccf0cc721e22f6d534aec59981
-
Filesize
5.5MB
MD5c6eaeae3cab85586271aa8e94a1d3de8
SHA14b7b23bf9e9e966ffcf21e8306f31765b993ae23
SHA256c91c71046f15cc7f5dc4bb4e1e14b5a7a3329ea95954a245c47e181c808a70d2
SHA5126ec08f95e66ec4a00c72a5a257bcfbbacad09b8a2de4168780373e76fef6951dc0a830b2eb129799dea8dbdc30eb10bc73061aeeab4ce8074f3bb6ede9e7cc81
-
Filesize
3.6MB
MD5866c8b284ecfd3cd6ed888321182c8aa
SHA1ad0a2c584f8ca5605b9dc20ea917adf5eb9da56c
SHA2564a637c11cc3c2a9c1055c0f98f504fad0e8b55f9d86297d4075b9adecc2cdcbb
SHA512f7df85e0c5ec594c03f17e47dc513721ea561f585ff437f7041855f86c4f39d87509212aae90f750e4f81dfeea35311202a34a89498c3c4d83d522c00256dca1
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\117.0.2045.47\MicrosoftEdge_X64_117.0.2045.47.exe
Filesize150.4MB
MD559ec211f83745271f989059a8137a5cd
SHA1e60e64c2cdc36773e1fb891b2dbfb7b2e589fa24
SHA2563002c89c474be1f99a8a9461d406ba73d50bc64b6a99d91771d520f1fc970431
SHA5121088c2cfa2e8f2c30b6620b5b45d951ca51990c4cf4bd0b0fe466155fc41b735c378ac6b3783eb31185ec84ee0f16fd4420323eabae4f089be239289a1991d9e
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{9F82F0EE-29E1-422C-83F1-4A1360F24AA5}\EDGEMITMP_F4757.tmp\SETUP.EX_
Filesize1.5MB
MD58ddaa66f7563bc14af48694c185b3816
SHA1c867a998da3389dc577cc57a8b9cea402643509a
SHA256c92762f9a422c5cedba73162437fa2e8847559fa5ca8b1a240feef1394e376bf
SHA5126f15f6fd0d40855002bb45744e64a33d30025c93992165754b36160c1fd6dc8c32cdae9bc8a9a9d2f3ba2afc7b49127d5d0dc85e7f9acb5921f10baae9cc4b8c
-
Filesize
201KB
MD5d182a0d12ca3a95fe1f2f5134861ae1b
SHA10c5f3e8a767a2b5ab7510d6139f47336e333e906
SHA25614ba66344ddd4816d823d5ecc97bf94da5d441299401e8955f44b1df7969be06
SHA512ab33ae1e3684c40b1a1d801d8b0ad8e0d624c9b3db60945a0c30a3efa02a2d69d284620859421407c9891db0fab4c4c57ece10b22b7b801dcb34ccd6f4ea2f12
-
Filesize
4.1MB
MD5b4411620a3551834e4f699cc5a9b27e6
SHA15093960cc86613e310d13770b5adef00fe93f3eb
SHA2563caf4a246169b2d30c6bf18fa0b7a4a01bbe933cfb781f3da4c6b3cb67b59d04
SHA51247dde07212c2d5eea548d7794fc6bb9d86ced9a0848aaeab81fa8844fc5cab7eac58e386e96a81c663b914c85c0a7116033e2b2cfd18559d40aa6c83f9a6c024
-
C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_
Filesize15KB
MD5577b7286c7b05cecde9bea0a0d39740e
SHA1144d97afe83738177a2dbe43994f14ec11e44b53
SHA256983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
SHA5128cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0
-
Filesize
20KB
MD500bf35778a90f9dfa68ce0d1a032d9b5
SHA1de6a3d102de9a186e1585be14b49390dcb9605d6
SHA256cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2
SHA512342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041
-
Filesize
23B
MD5836dd6b25a8902af48cd52738b675e4b
SHA1449347c06a872bedf311046bca8d316bfba3830b
SHA2566feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
SHA5126ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80
-
Filesize
244KB
MD5c7afc24e396da59a4ef402ddd2ccbceb
SHA1dafbca40f8420fdf6c426fa6a3f0f6a43fb493d9
SHA256996cd2d01542cec922c384708dcbfc8aee8773333ebda9a398f0236675f129b1
SHA512013ff1f14b8c7214c88e42cf5d270324f4bbac6bf6b5eafa7dadf8d658c0eaa97a52f326df62867dab7926e8edbcb5bac89a0e675c57de5558f78b1bce313ef2
-
Filesize
95B
MD5d27dfb2c08cb60fb6877033e77ef2c19
SHA169a5551e695c3b17fea59670d8155a8dd4c90519
SHA25674b6a10b7ca18bd9b450e4cfb23af0226fa9ffe50924adec967e55622335cd6f
SHA51287f20c7634c9d77731e1c070b9b8427ebc91e120e207c0395923020ecd48eb5fdb26f9254df69a370ea480265c56e164f49c65c9babf1220af27d705d362c8c8
-
Filesize
358B
MD5a0e87b96dc04dfc4da746714a04c3a26
SHA14d6a38e8138c5e7cae0f1a26da0ca85d6b96b74c
SHA256bb51415131b62231100f6bfc946f7718d781c1d8be5c76370adad33bc41b45ad
SHA5123a4cca531a413bbb18ad15f795ca354f7d1f8fb91f373a1c45d7652308aead31381bc26071b18984bbdfae5afe25c042252caab6c77341d2dd9a1cc57fc24785
-
Filesize
1001B
MD5fa518626c9342f91fdc2c4600ed63954
SHA1d699e6740eb5e4aad323654fa1410c242dc56761
SHA2563b646865a074a81f717447a947ecf9d212988258c552b26890027f7bdc4ae084
SHA5127266ddc1cb0d346becf9fc81941ab3a4863a0a41284faa65c17dbfbed8cee5d6f3b804461f2cbec7346f41031774399b4e0c1a783dd44720fe39a0506fb6057c
-
Filesize
703B
MD58961fdd3db036dd43002659a4e4a7365
SHA17b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA256c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
SHA512531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
-
Filesize
687B
MD50807cf29fc4c5d7d87c1689eb2e0baaa
SHA1d0914fb069469d47a36d339ca70164253fccf022
SHA256f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
SHA5125324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
-
Filesize
141KB
MD5677edd1a17d50f0bd11783f58725d0e7
SHA198fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA256c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
SHA512c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
-
Filesize
82B
MD551b22bf3c76d59126ccd50e006b95cf4
SHA12687a759498525e8450f8158d66a598de0b00d6c
SHA256ed76eb68ca85d562c7c443f79dcfc54dc3e9bb4ddf480a115a44bc7fc0a4a9bf
SHA512d8026d5693033c76a71da14e3e079a25b49cf1c318a0a50384c7d6dfd75b719200d48b9885d479ed30dfdc50a19fc192ee9ea5fb2d32d7f273c71d5194ba44b5
-
Filesize
53B
MD5cfce6d6cb6a42c8b55a06739608388d7
SHA1c96c82f027578044eb0da361668fc44c6ca5fe52
SHA256e4b2f4dff7999ffd2b296979f3ee89d957cd2a87e481a643ae1549efc706838a
SHA51227e4ae9e7802da22c96e331186e5339585a01141725bfb237e4f4f90a8977d2d90ec11b369b900b3dfcc0058d6f31b1f27a377362f3db04b8b420cca5c4cf5e3
-
Filesize
160B
MD5c3911ceb35539db42e5654bdd60ac956
SHA171be0751e5fc583b119730dbceb2c723f2389f6c
SHA25631952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
SHA512d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
-
Filesize
66B
MD5e78d62f2ec9ddd44e92e6e6c7fe80101
SHA1b547d058e0737b8719e3ca7e8c1c03bb9a409fb1
SHA2566456e2df9740b85fc151dd0419a98d93444b3d9eb00d7f0352cdcd0352f632a3
SHA512c439f39f655b56aa675f890e30036a6cabca7b5177d1261cee4497a365f381321bfec4493823fabf71d5ea7116b04466e149857008357f16ec959f2092ce97e3
-
Filesize
72B
MD59f6d6805f4f2f6d574a2efb8ad7ed5bb
SHA1dfabc6d1677dfb0f4208690d16d4e7e11923f3e7
SHA25642cd1f4f4837470f4ae1b6d84ffd1e95440e0532a57bfe6fe8cca8b2e66b8674
SHA5125140578f8d05047c2725f576cb3f430d3a662f10d1a98589b79861b3b6321c87e9c6299013f2bb4f002351ead826c27d07f48262f032c93035c3eeff9709cb84
-
C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5552_1961709224\Notification\notification.html
Filesize4KB
MD59337227839989d5b8b6371379469c0a9
SHA1e075dc2a09d4d35b1f5e4f3e3ccfeac931af5980
SHA256aa53bdec21b2d2a6884d951b109f2ada801ab5fdf8dcfba8ea8a5a5d651587cd
SHA512f3dcdc6519ef4c7d18ac6108846dd080ec08b5cd02bbeda8978d33363ddea572460058f0e8e9da35343ab7d79ea1e5d7ff36245cfc3948e0f58a641e21d0af65
-
C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5552_1961709224\Notification\notification_fast.bundle.js.LICENSE.txt
Filesize295B
MD59fadcda30b07120e2cb70b5a003acff9
SHA1a4eb198c6ae011cfb495a25d7c04b62fdd1d0346
SHA25663ec623c2bda74fc3e3d2796151ffe93255e8bd76b2d8bdfe2ea0b401848b15f
SHA512e34a8bce98ac7eeeb3416a9d2e8f331181a25e06467aa211af4a12a88cef0c5b2678792d03378f888c212eff6340647ac99f97aa2cadb75c3777527fddf77552
-
C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5552_1961709224\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt
Filesize1KB
MD528ea2ecbf59506eef5a64d2e8736fc7f
SHA115811e52e73656e86bcad5f51820fa28dd195185
SHA2562eee63800a6d6184a05efb417e90cad719318f10e939ff28bf0ebc350f679c44
SHA5121896ceba504d0a1690c6b949e555a68e80a30fa3fa85b9a4e65ef4903668b01844b6f6f8e4125a67f673b16ebfa046e71bd17c573682e18a08bba12e1db2edf8
-
C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5552_1961709224\json\i18n-hub\fr-CA\strings.json
Filesize62KB
MD5b9977a8cc712b5795e05f02bd10e438b
SHA1e4ac8a528d0f0c282dfc14c3b84637b6fcda6c5f
SHA2560d706e0dccfde0a8c70ac998e33db24da6f9b9a52806d97d1ca49b143bd900ea
SHA512d929d3a951f39675f351da9214c53810789856f55d9c4c56c683e75b6eae4d03d8a65f65a68c42d1da6c9bb0b698a01a733dfb2a36a1cc33a4ffb3a80d51b746
-
C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5552_1961709224\json\i18n-mobile-hub\fr-CA\strings.json
Filesize2KB
MD59c4e71ca53d0cdbb877b2ca86f572c55
SHA1bd3d002ee7a166de3d8b70d21a1c692e57b97fa8
SHA256767052f7a29bf7e06374973f6fa94694d63545e8b6573166d2cde41d2dfef405
SHA512b6af69e0e49d7735299e377389d5d9d0c2af9601a4b3475d97e1056167000495054fb96c884fd66cad6e03243a720e6312bf616d650a03341b1434024e4c8aa1
-
C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5552_1961709224\json\i18n-notification-shared\fr-CA\strings.json
Filesize5KB
MD56d3d885edfd99fa8f07f0add1e8320c8
SHA1eb4117a7ff34c36454b23b59ee2074969b1ef876
SHA25669655c8692d18a0aad0971088232346c949ba71aba63746631e7331df5c7bc0e
SHA512452112ecdcf66b24ffb92ca8693b5384a54cffae017bb5f9e35f21855b6bd0b672574a07603eb36456894c26f6dd1015def7f99ce1238ec6b7623bf5dce3543a
-
C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5552_1961709224\json\i18n-notification\fr-CA\strings.json
Filesize2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5552_1961709224\json\i18n-tokenized-card\fr-CA\strings.json
Filesize2KB
MD5cd247582beb274ca64f720aa588ffbc0
SHA14aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA256c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
SHA512bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
-
C:\Program Files\chrome_PuffinComponentUnpacker_BeginUnzipping5552_1961709224\json\wallet\wallet-pre-stable.json
Filesize2.2MB
MD5545d2b1151bbe0470732a5ec71abcd3b
SHA10b58343060a3ba011d72ee42ee2fea620ff6f0b5
SHA2565fd4740c0728516af8207e28ff02298ccfbc8e591e231b239d3f6324263000f8
SHA51286971c4a74b78bc7a1618fbd9b9a50e006ed5921c3bb4660ab4d4fc89a16984dadb614b71ffe42208676a3d6b882e959a72125a684d31f789e26ada01363491f
-
Filesize
121B
MD53b1b4fe28dedd84e578cff4bc593410e
SHA1a929272f1e8d7b93f9b37427e68c9395efb00dc4
SHA2568d1ebb256157f2ddf17a3000425252b4cc3127133ec68ae9e8bcf4fa5d263a12
SHA512fd810c771450ae0e496a56ae95d724984a53a65eda4f95a67bccebe36077e38a286c7d433f431572237a712a09348ec7023ee9d2ffed99b7f8406e09e8913d50
-
Filesize
97KB
MD512cffbd79d94bf893fca46f412aaa5f9
SHA138090b227b660010d342aa938e7b3e6f27068e95
SHA25691e5ce47bb17edc540a85139ee2bb4286810ba09e678933b8706e8749e0959d4
SHA512760e1079e47fa88c45ed329ba263d7a5cc1a543e3c5c8d5a35a339b4b5ffa313b2c12b9d672f5ff7038c79215bc255871bd940f833a0d7f2a59074af41e0c325
-
Filesize
2KB
MD5cfb0ac99f1e8ad2362b9179a666a0425
SHA149407438c2ae8324c15f67f6beb23c3b59f130e4
SHA2565c994b322f81280ba81a1d844f2781ebd384c1bff704e48c7e24d287b0ab55ba
SHA512a3914886c70f1b104d8cebccd14fb31d29d9c83c8b3e104e3a83607d7c15ceb3c182b75d4a022bc7e5c928914c6d0f269549c667a17e23a3670c3938b53231be
-
Filesize
1KB
MD5faf7056148ce00f298008f6e9ba20642
SHA1977d78c52a865459877761eb5b5d1a1421c5babd
SHA256a58b575d27982f1c4e252ea00d202743d7caba12ba914deef389032b420892bc
SHA512b4a8db5aaa37944494bbaefb5fe3bb8ea749ba00a641b0d28140f908b91e04e9fa5f9cd2fa5e37f120353cd487fec5a58f1b79af0e5c12b5430b72a11c3cd8b4
-
Filesize
85KB
MD53e1ff1b713db83df6a8c5e541fb07953
SHA1de10b974ac509d7792bdf101ea0703b9d1bf895d
SHA2566e47d19d977b38b99f6e4fe9db533f454edff88d397fb270593187166c612e02
SHA5128aa0f2eb07a1716dd6fd76939cc33ac049e3c1261b01daf2f73ce95c7a64fa88a202c1bc2e423a8ddcf4391abf8136f7ee99e734ab3c362ca455e757324ad6ba
-
Filesize
766KB
MD5471061756215fd1f387f076ac014303c
SHA1d8397cb5900f52a5cad2416ed8ebf53caa1a3adc
SHA256e6334dcf080aaeca679db70565762a2c296ff5780c1af263530ac7345736bfa9
SHA512ba9d0f2deb2fcd77e75bfe8a9c6241da25c7eb9012d0374ccca8e9cd9cd1c9615efd5f3980166b0b3431c7e3e55ef013cbc37f0d53bd1e2411afb9363ceccb05
-
Filesize
12KB
MD5c2047250cb875bb6381afa418feefbef
SHA1f563f6b257b3ee12ab90a9249b114ed3e68b7247
SHA256c7374805bc08d0f25def1ee524a6bb948b4f7514a83cca40e792848f01c7e9b9
SHA51254ba8adfc61d2197ecc7df8242db3a5bbe849840c25657e8cc9ab1747f08d6b317c034802b166e4cffd1b68783ea3f452c9d8e7161dd7ec34dc82d95bef64d58
-
Filesize
152B
MD545663ae78ebd68c30c0416dbf1fff545
SHA10f75e8e49a0df004040fc765bf5220da3786ffa2
SHA2564e6a1abed753a468a0211fdc04327a03c6018dc79e47395820084bcc1623d8c0
SHA5125b35426f1bed9109d1f7a52be4294d84929cfaf9f1997998302fd8b508cac4b988d358a8f283affa0b8fbce98799b6550206bac5c2415f494da1de1b87a54c8e
-
Filesize
280B
MD57cd4ed22b1b3d8ef1dae41d0fda14a31
SHA19bb5a80ac5c78d800c5fa5cbe69faf19acf942ff
SHA25644e160eb48f48eefb7d92683ad28a59ae5ba64ca7b9c4523a22b57410f212632
SHA512a519a25dc80fdcadfee2a17ca535906603236b7873ad2f252b50918ad65d1a2b0b78e806cf87729522534c974f1d43f1b642d869c41ca4f5e38dcdbca5d4080f
-
Filesize
152B
MD520939d02bbe721f3e8520d98ed19f25b
SHA18f343ea92bd94b45678048b4541bd3997c94c9bc
SHA25611f96a006aa2fe0283304c5649e0b966f50db84cd3f833b4f09cad41f8359209
SHA5127640006dfe4d57d407faaa9618bf68bc695c7039307e4ac28e5a09b0dfdde0bb526cc812f16c325e1e9cdffde79224299024d8b7b462a08fefdf378c99125a32
-
Filesize
280B
MD590d07e2fbb0d6253f8dbbf3ec33ad87f
SHA11d6c4bc6bc63f0b53050be625ed3c4c0d6141408
SHA256dc2cee18cfa4310d19eec0ff42ea685c14f7783d3b898db79402b6ecb74a19a9
SHA51231a94fd7c68e1871106c36a6efc2d7eace413d5bc61cfe3198a04bb673ae39dfb7dce8336a32cc1c70ad9687a09937048927e7bc1b8825d2cf4ce05c1b5b8ec1
-
Filesize
280B
MD55a65b81d2efa63febf7a424aa44714e5
SHA15b488ffe2d1994023ec0c19a3329cd6c3b5ef859
SHA2560f9114c74747b7fe91e7c288fea9ec3ff78ab9744b3d75ec621d13e731611e0a
SHA51295dcec91b0d994f43d12a82fd24b9c70e599961dc67e8e7d07e0b3a92d0745fde6565d1b583be046ed90452323eab5d6a4be8dd0e93c0d043dc4f5f863c4a1a7
-
Filesize
152B
MD52eebcaee961dcc7f9dac5ef03af55c5f
SHA1ab035bc12aa2c956008f2babc0b3eaabfdefb2d0
SHA2560013d490adf59351b60b55056519c3f32148b968651a813dd9c0674eaa8a61ed
SHA5124eb60976b4ebfe6a0cad85cbacb466f62981157ec6cde12c805074f5fc1c89ee72c37e9f2b3878926be9289b2cbe416c517f934df0cc4569def68d898875be5d
-
Filesize
152B
MD53d5af55f794f9a10c5943d2f80dde5c5
SHA15252adf87d6bd769f2c39b9e8eba77b087a0160d
SHA25643e50edafcaaeae9fcd4dce5b99bf14fe79dae1401019443f31aa9ff81347764
SHA5122e2e09a00db732ff934da1e6ab8617fb3c8de482f9667a2c987435d0a5d67550b4bfd66e8b4475012b60908c24e39dff58e2f2ffa55f13ffc55caae1be630c71
-
Filesize
152B
MD5a2583b18d95442720af06bbabf4a6a2d
SHA1c1072a3db1447d546d29d8ccf892791cdbc540a0
SHA256e9f944e6661861aed93db354300da9cef3a8e5660fab48013f96514f608032b1
SHA5122c034f0d7da66e0247d8b26bbbbfeb511bdb5ea6bb71c46223592de4a45787aab71b92b8e0624585bc42bf83578ef28841fc0674f85c0f2acc3af210bde6318a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7722205a-14c2-4a23-ae4d-9a945bef4f4d.tmp
Filesize3KB
MD55dd6cd33a7d6c1486773c87406b50e82
SHA1a7da96033b105976c2f921727dfa9d3d6ace6699
SHA25682b7b51d710c926072dd23da3143f93cf5cfb3be6c1569f5d4d0344f079e46b2
SHA5122b16090ff7e3a6575eb4eb2684cce22d577c9e09383656c3114c7c4232b92d374ffcb65898ce0bef54a15fef8d6f5a90f427551827b7c35adf31b87f7b92864d
-
Filesize
47KB
MD53d734bae1570b8a68dd6b098b8b5cfd7
SHA13836b232a3d2691e84d5925cd78acb52253afd89
SHA2562c9172ec95e9199468e46a16c3f42435e90882744af3cd098fe332edc476c74c
SHA5129b2b50e142618849e0ee1c57269cf137d30bbf8f31459f2e78dd2479a6ded531385b015e51cd6b29a872b53fc78af627f513da33814eb5b597602aa90adc8335
-
Filesize
16KB
MD5d4fff475c2db30a345de218c9314853e
SHA110583ff1e55b0825116448a566df2e2b344ec69d
SHA256ae10ee041048d289c2b792f267722e009001b933f364a9223cf4ec4bf3c788f4
SHA51259616042e72043d4bf4b92178725bf97ea49a3a8a36053e3560cfa8623111111e759f8e0734acef3aee883a6513aa8b65cb6e2a9398caf64a2ad4aec8ffadedf
-
Filesize
89KB
MD5c7705df38623dfcc7c383b1afb85372e
SHA195894edd1363f9c0cd975196304cacdfbc3955f8
SHA256d9d45083c58a7c14b4dc94a6042ae07532bff1145ed7db0547187849eedc49be
SHA5122d926aef7d48ffc2c4a6e25c430ea3c4a1483d6952019729fb69d426705eaadfbe8f9731a6e3d1ee07de19557c5660192af87fcbe3b98b8b94e912f5d550b76c
-
Filesize
49KB
MD56500bf565fb0db8be5980289061f5d8d
SHA1438af675929bdaeaac060d84103859dc0ac8f964
SHA256b0758a7cd099832080d007d70789897792e449b690903459c7b41724f0796133
SHA512b19b6d47e8f53a6328b89f144c86028f938ddb3a6e46dc68f5f4bcc777b86562ab6c34ad11891dad8f4c17113a742fc661d587851f2b5dfb7025a66f3e27c4e8
-
Filesize
20KB
MD587e8230a9ca3f0c5ccfa56f70276e2f2
SHA1eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7
SHA256e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9
SHA51237690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8
-
Filesize
32KB
MD5a27b1424de08957fb95fc561e7443e45
SHA1ff4c84af40921a3e719eb7edd1e8edcf15cc79d1
SHA256f7d6607fae5f6527cda99be80c63924a405d7c6c278690a7b0ee0fcc8b2bc0c8
SHA51266705921dd1725786c3c33d010e23e44311c2b523b7da3cacde8578ac63b917b24a10944f6b92ea7cda276fd8fb755d7299af12d7babb6f378bd8f28e29abeae
-
Filesize
40KB
MD53901431a1cf953a09fb115f792530d50
SHA19d3f7fea615821763849cd320e3c9fe501d9cbda
SHA256f6495dbf769719aa52f4bd6887e8e84a6565368841249e480143f6bdafeac85d
SHA512b480791f426899e8c212d327bce05f9e9b9a9efc0ad09f73168103291a236bf72cc6c3c0f4048ad2feaa560a51235e1ef91dd11720cfc273b99f59fbd60ccb52
-
Filesize
25KB
MD5d1f7982c34c1a14fe97d66f3e5ad8c95
SHA1123631c42e68da2b4529e1a9d8e37e8abf065390
SHA2560caa468c6070c73e662136b467825931826a05cb6192045bac0061f0b75339ca
SHA512b9835e48fef2015404ada6ee3e48289d4210acc994ac46c3150a4d7a118295b38bea97f8eb270b5ee85bd7a6119260156908befb2e26a533e24cbe3cdb64746e
-
Filesize
23KB
MD53070b0d3a0854092db26c3ddd2f7b044
SHA1dcb02d3ca182c85e94fec612e151add71bc5284f
SHA256bb4d02d2480746bd00ae9e0188a1f262480bdbc866bf3ebf7b84052fec535b58
SHA5125552400d2b631f9de2c005d201eeb857b95b2d686606195c498e38e6a4296de78045a74bd463866318bef61e3f51f7a559a55fccf460ff6bc7b0f674b6e2810d
-
Filesize
50KB
MD56ed352da7d6bd38f4d9f28dabb7ba46e
SHA1d1de02671c9de893fc46f55c524639ba410e3030
SHA25607e33a6f863660bcf35474866e6036b6e03e1e8ab770e67f423dcd4404b7376f
SHA5123e11b81e0e68af48147e22a8a0b5cfdf3cb477269d850f8e0a1caf84f19d14c85572be8c3145daaf3ca38a5b271901bfd28c04c998c8b1b88edd042d7c65e972
-
Filesize
128KB
MD59e04ca5705b15e645ac85a23f3995d79
SHA1fafb7a14c449b9b8ecea4d78a0c6a0a3a1a439be
SHA2563ab4064da1a437f0dca8d600449f903129e1d772cea43665d656439cdf0a4b6b
SHA512655a9bc0d97314abab33cfe40466712b426ddea8343bb85ee2f7b527b11bc57d3f30586f91adf8d2740ed073730e716797f4aee71af772d15fadff8a1a514476
-
Filesize
19KB
MD5c06d971269dbf71d8703ee5aa6d8cfec
SHA1fdaa75ba62150370735e8fdd404fb46ccdeca0cf
SHA2563b8906f34758bc12f4c73bc9dbcca8e28b1d03b0f255ab012086a1c86287e8df
SHA5122cbd2de241ef7e834bbb79c219471ca19dcb324ed31451f05c33d4d49ca15c6c78ef34f6a685dd815089dcba894c2ef4e369976ddaf635cbfe5665c877288a15
-
Filesize
56KB
MD5d02ccfcdaa4c441e4a64c3c263afbaef
SHA1ac823442d7f2ae8ad8d12552b01208445abba694
SHA256c00439933c5a21cfba21f8a44189cf602453c97a1caf819ce9e1440550b6b517
SHA5128c74b6f15daf7b9465bfa82c4f3704451558d327b61a50ce9526031eea8e5b0cd1af62955af420ccc95b7f89223f58e4dbfabdc97daa2bb46f305887e238e3fd
-
Filesize
18KB
MD5304c8e5049d52e5daa61ebeea49eda5e
SHA1987329c0f0f7b4913eb4b90badc814a6ab201f32
SHA2562e9b6e9c868ee773f8ae051969af0dcc62e6d7ec2b6e961eb3e46e17056f4ce9
SHA5127a74dc6f2f5e87f4d9389c704e013e22f82d83c8e22655e1cd81b635f3a8b2528d5dbc6142d219b72b67a6bcb5ff555ca038cac68b89268dc3205a6b1ac987f6
-
Filesize
30KB
MD562172a4a4c59434184f71c0f4688ed0b
SHA1ce83e95c0296215a9d9759fff54092b9a34dd794
SHA25667f06be860c6c28e56c2b2228f1402d38dcb64821d85da066b8fc22bb4e29724
SHA5128e3c797bfe4d5bfdc78650e43f6ef003fa7bea5d4e565ffe0f1bb4aff5d0661e4f13665169cd79470df71322c266ac572e52b82755891850d72810015e4b6a49
-
Filesize
33KB
MD5c15d33a9508923be839d315a999ab9c7
SHA1d17f6e786a1464e13d4ec8e842f4eb121b103842
SHA25665c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98
SHA512959490e7ae26d4821170482d302e8772dd641ffbbe08cfee47f3aa2d7b1126dccd6dec5f1448ca71a4a8602981966ef8790ae0077429857367a33718b5097d06
-
Filesize
31KB
MD5514655ab7a142b6c707050da564fea03
SHA1d01bc77f3a648c54aedf0def8f57655d2e341b4f
SHA256403929240fdb5a9f1291ce63ad0ec009ff5e134c052acebf34f2733500820150
SHA5121b813e37c2f54092c51555c1208a2f0081aec44cae58796d42fd682c939cc4f3db6a3e001f6cc8bc8de7116ea1ab77f24dc96fbeca47a2d463870b5cd7a119b0
-
Filesize
38KB
MD52b7ec9fe5044c75348bc52964bf50b78
SHA1039e784c53ba423877c5c845ffb044abbf4c110e
SHA25671c9403962b1f930169325d2c812125a0088d2a695609486bb6f31185e84ff97
SHA51292cb64599e198177093bda32e1c962fdccaa049d9875292b97c6b014d0d0afde750dcef27151751dda3f8639df41bed611bce7816c04d4e581b17b132d169016
-
Filesize
59KB
MD5efdb4325356a875d8b4f08c1cfa15e37
SHA169194b22e4c559b39d3530426e0080da991d3ab0
SHA256980bbb27926afcb4483a703111d7fac67b9a5a68c3ca95d16bb0f2cbb3aabf8e
SHA5128ffba9937ebd27a8181808cb1e1312670ca0335b59b71d2f6400d68e67b6fb4296f4f905f3575b812354c8d9abf4f0d38a626f6f7ea46656a5aa80688e1ebdaa
-
Filesize
42KB
MD5e5bd6e9ad09ce02720d8c40b1e5cfa8c
SHA1854a62422911a0921262cafc9cda04a73a35dec8
SHA256640dacc327ef4ba65893c286bdcd190577e92468936c78acefe1d2d9ef513290
SHA51264d688f33f8e79aca5875c5052f5f9122ab2e0c85ff8a2e879a7df6b23dbb257a4f356626826ecbc5ca0b4c9eee79506bab4a97f59349c9b9d6d68a8ef2deee3
-
Filesize
266KB
MD5af8b411fb091a512813459320af6801e
SHA1461bf6a66e3383e6b655695cc77227b72fedad7e
SHA25670c7f834d17caa74745c0dbd411b913dc14bfd6b0d4f5f2505c8e8e5b01311b1
SHA5122b7bcb3f0e492cfda5df8d9e463952fdb94d7a592216b6fcf9783a66d91736b98fb049fbb99be5bb6d7780824a601f8f4a606bd6f4a1a274894c660d4e5fc466
-
Filesize
37KB
MD59ae1baf20f86be4072ea658b42128520
SHA18bf0ce35787e9b6e61d9a48d81326f4230a3fd4b
SHA256d5da2dba6f328dc2ee2664bad373a87604bc8fe79b18b8d4e6527204e9f521b9
SHA51267162b1ad5374ede841c1fe48c07a71143cf9fb7be41ed94d4dd1df616e3d71d9ee83d86887ccc9e7c00dcd15bea3c08fcda4d4e9d224ccc5c9229ac1b95a65d
-
Filesize
26KB
MD5816fe35a262ded42f91aec9e0c6bfd17
SHA1e3e1e125853aeea873ff9cc3a97493a8ab1960bd
SHA2561f4f7a014bbc71ab2fca3cd903086d21d44aed4df7cc03169c288b358f94378e
SHA512284d1c639ee4ce2feae0254e295b1feb65c099ff19f6935310ad3dba22c010acd315d71f0cf2c34d2473fc6685509e78ab15b5dd5ca86a9712ff9f76f0b069d1
-
Filesize
184KB
MD58abfe6dfa7b0d9a5a4b7268155054740
SHA1fe841d96c94923c7732014a81bcb574fe2c10584
SHA25675799b61c8d93b46365ae3a603ef508acee921adbf2abf4ada583fc4e0e4bb82
SHA512a6a475c64d5e0bc3cb94bd38b38da66f5b4470f50738286f2d42030d2e32ef15d6c795dfa8da36502e536819dababe9386ca7419f2c6cb0e8580053ace1166d4
-
Filesize
78KB
MD5f536e8f265fbbd76a5f7b9fc0ea0ad69
SHA18db474f6ca6e7548d47cc3b078e66abdd5719066
SHA25663678162cb830afba8013a29be9148c72c3dd90561f1b0e7a3cdfbfd883912d6
SHA5122d8d79bf7dd4ddd61b871b3e54e61972cfd2cad17f11865707e006a4f9ffada7b9b2524a1f7ce056aefd2b36e43264a813fd9ece00b3182d034aee5fb84a75d0
-
Filesize
83KB
MD5f35ad0c20d2f7e02b99e4866a98989d1
SHA17e9960316f3eb5bc7b5f2fda0b761acf0ca898b1
SHA25686145e56e9b4bd3a42e3ddf6b7cb6bc8e9372891aa5bae35ea0f3facda3c99aa
SHA512253fe78f7ea21143f4c8d0fedbb29eb3debf6b08e5ecab1cf2a4c0dee1f80d9a870e6847aa9fb9a39d8d2f4e601594b633869b2fe77f8a1c3363372e6ff477cb
-
Filesize
22KB
MD5a9ad24d87bf7a9c645d9b8b790593bf1
SHA1c6cab88ffac2b80a6a2e16ff85e29b12d295dacd
SHA25611ee43c5246de0c54b56ce811a3946da9020f5b2e5cc3f8ec2d067a17886ea78
SHA5121978af63de462a0b96aa8432e7b877ba1320a3f2afc5cd3a3e6610c12130f91105f6cfdb2c2b80f885d76ad28abb430f53574d350948b7793a1c5b8e0469066c
-
Filesize
145KB
MD58f1c7f5187e8e78fdb31a5e6c688e803
SHA164b1ef52851b1c5b130bd7fc12576329d1738f0d
SHA2560598e13041b04bd01dc5e5849abebac0e253bbac3ec6bdc71ca62b84100717f4
SHA512b5f744e0af9d4736b542060471404e074fca5769ffebef2becd0a311329bae985b97ffb52247e571ee0c2a9b7a99cb3fd5d91f21bd807a09d0a45fb651d12217
-
Filesize
63KB
MD52f6f533a6c4fb6b986e398c95e0c918e
SHA1b04bc96103c6422af0307c3995a22fc137f3eaf5
SHA256fc1e1f4f42b20e1885c27f4cdb9e07fbcff029243e68dc6dbdbdd97a1bfa64d0
SHA5121112c3bfdafe94c2d6a2e5014409638eb52043f26b9ad5984895c6ad4474be089d67471fd5911fcfbb379684e1fae06fc0752597a85553a283311c21ad20df77
-
Filesize
63KB
MD5856ef3bd18707c6480c582ed6709e6fb
SHA1bc47755c8c3f3ddb91cfdf1ec298b0a76c603706
SHA256bcab6949c6eda21b0e21c07ab420d2fb78302afb49da639b82fa65b2fdb7f7c2
SHA512ee8bbdb60a805b0be7476245a7f1ce3768718993d12e686332ec636f90d638d64ed74966859eb06b245ad07f00bb05e4589c30d782000feeda01981cbb44a192
-
Filesize
70KB
MD54036ecb8d7b0b80f58c6e8ded8e47cad
SHA1a1f95e00b158dc6552e1d69006477b0567001d9a
SHA256e3abbfc40c124278fb9b145ffb7122ea3bc7621983e8c30d9a022de6683f96ff
SHA512e0c68d33f3738c77de0e979b9d68c185009a1d39cb79e23dc5baf6fbd6907a9fd17efe6964d6154a1a93feec50b0b692029fa7495eadabe96ee7ede5de0217f5
-
Filesize
22KB
MD55385bbb130250634dcbdaa30ca0b6945
SHA1cfcf7afb3d39e3244f5df6daac50930a8fae67e3
SHA2566e589032caab59558e64d1966df24586f40c70fe44354ed466b2961ac223019d
SHA5128297323fbe58d7351816bc6c7bedb1925bbd9d1f34e36ef293409111217d963d767b6842979cc194ce90793c6166da36a5253d44cb0628a3813e8554d094089a
-
Filesize
18KB
MD5199abdf70b59e843ea970be05d7210b6
SHA1b385b751215c845a16bc73a4f58d7616bbcd81d3
SHA2568c1940e92c3e9981680f4ff046d52ff4653c2c8ec43874618dccab9434af2718
SHA512f467797f6c846f837c0cc7226a858008854d519e3823f9994b600794c34bbc084355c9c17879d46b0657983ec27cf5c7179579b5540be53aaa666b8d40348835
-
Filesize
28KB
MD5c2d5f5d97f98796f5bb5079b9071417e
SHA1bca79718eccc12630b4809f7e1dc3e27d92bf56f
SHA2569f877e48244ab98e4a41a699720b8388071483f297fcd240cbe88001f17e0e5a
SHA512f035c76038944c46d3e9714cbc2fd08c8b06c5cf88a8ad8082f828ca7d11eb1f3b89d810188effdee204a92ce9dc75f9c48a754254b3737151f121d27cf07665
-
Filesize
253B
MD5941ac2d13d505a6d89534e047bd58b45
SHA1f405956e2a057f93a9a820fae7b0aa343d51da1c
SHA2568502c4f526196fbe8dc1d536cb0df5914f44c6def8f1297391e1ae30bc47d88b
SHA5124240126ba6608fffb8f6f6d99ff5abb74954ac20b0406847b1d8a6969c2c7eb70045a24b452b5ce5aa9cf0e99ff7f1026c79aeedc30e98ca504b1b86d0791f08
-
Filesize
325B
MD597293be66ab8a3cbd7ecd30097471c84
SHA13de06305265154b64af54fee4e806b767d46472f
SHA256a0c223be233e4d310f683d1e8dd201b1e974a2cb363c36859e7f712e0349d0fb
SHA512b20e7ece1d919f666a16f3d23c31e154da99559025513bef82d81129390fb3320ecc974905f01868073af2a965e1f391a3a7777f3b5ffd9aa1912e5fe93ef158
-
Filesize
83KB
MD57a12bfd67a44a62f6e4fecb3f8f66933
SHA1396bff0e83402714ac3f0e37b48657ff72931aa4
SHA2562843460fc97f6881b8376409e9808c6ad0b5b2d09ee4050f92983a9200167375
SHA512378de1b8f4fa95b49b13ebd1fc8dcafb749d39ec0eff5afab473d1ac59c2e86ab784115d175ee64cc5a8f219b15fb3448b47de065914254286d50bfc6dd99e2c
-
Filesize
88KB
MD5d6feee28e494a2d4f66325f699fb7069
SHA14b6abe2f89435fed3859a7b3832df9eff883035a
SHA2565232eb912ae6a0be26a353dc5ea194254cfb2dfb983d4ee2e41c346952127a39
SHA512894fb392c281c9e08def09a9b0a8ac2a0583fe80aa58d0f28ed7630edae4e727e1f2cb46dd61a04b75545b9f6a80a117472265b54e1dc1be2ab523a3b07acbe0
-
Filesize
166KB
MD515cf6f9cfe73802c1f68ca472c0fb8f0
SHA1c30e05f9f2efb7fd95cf10b2645cb8d36d95b7d8
SHA256bb4af567a53185db10fe3d781e2901974166c179d8214bd5cf0eabff4b4e1e1a
SHA5121c7b0142de7710af932e810d29add4f46af8177da5066856ed78a79139022cac26e56db1449de9adc0404f24bc77bb6335075c5a5251d1ac7a7c86195a00350a
-
Filesize
8KB
MD58ec8e6dd3bb7ef557fa93c6ef53d9c72
SHA129955f12ae7f42b0c57020a8b825dc89da6df43d
SHA256d40c1c55c4738057dda702958dd988d80ec9721d1065232ea0987a9e065bb508
SHA512ffe33f8eb9d197a8f424d3aeda516e4977e512c22511af69fa2a8cf43b1532665d463014c8a7c8a202b2306740eecbbd30c52ee529754544892f3a06fd237f41
-
Filesize
278B
MD5bc385953de600637c5d819df0d73e531
SHA15f23256f9d9413a801996b519813c06d92e3c153
SHA2563fbbc24ea1e5df95a994bade21983936bafa6ac61bad1ef347d52018367057c1
SHA512fc7ff5ec245096d93f112e747eb7e2de7157bc449cb36aa26b3218a4a51f13b8b792595b5010b2588b9c39dc36539b26bc37b0d74fb6b0819bccadd62a63e879
-
Filesize
39KB
MD5e91f39f65a31a76f9ebc97c25e423645
SHA1d105e157ecd522488572446609573969af37815f
SHA25693a021ad11c57be55cb7c905fb828e6c51e8f045e706d961fd8566d9fe1a142e
SHA512a4139cc7ba8764b5335b3e7ddb84fe7ebb8c87fbddaa84a1bbb9712da075993bddf111646642a40b8ad52cc7a5ebf99debb41342a94ff6bce8eb51b1ac554c95
-
Filesize
39KB
MD580a6b0cf1d3dc7ec59a9a871d4631200
SHA11ff47ba954b00aaf789c6d1ce686ec20315586c9
SHA2564205715b93bb70e10ab1818e917fd4612c3235e7021a4394ab2619c8d2737a01
SHA512ac057a246241771c89baa96406dde3ddd2cd59c1bf4f44e61afe53e89707e4d6f3f66d5e1d36605901e11b126d3fad6edbd559b7b340b77513db227e9ac0f997
-
Filesize
3KB
MD522b986c0edc9e7e96bb7c89627fa79a3
SHA1f7ff9515586bf2c8fb65ee42e8135b4f4e31d56f
SHA256617d6b4caae3d3c2ab2c57884b2ab1363f65dc3457a31aa53e7407580fd49fe7
SHA5125d6c673dc4044a9f16f40d508a633489ee28729d65c821afd9fff78e769291d4e8e483ada78015548aac5ac33d82e5560e5442ad4c8d3b496f9a77627b96e131
-
Filesize
4KB
MD5394bf3cd6c99bf7fdee84d229fa41461
SHA19ba299beb499c971b91a6e0af932403804b1db15
SHA256b90b9cdc51df85f2c6d23973a066b16673caf5ea8600d82b5206f80a7ca6c949
SHA512feee9ca7d87ce544c1ebb540b31ea10ac4bf7171bc2adc92cbcb4fb6b3b906f146f137e3126d9897290351129469341328752867551a267f118ed866870a7ed9
-
Filesize
323B
MD5457bedf74598e18ccf2efd57d21f7fc8
SHA1b491469ac3f842593b6e6ad240f43b528ac781b3
SHA25673f5d4a8f49a4689c91aed9ea73aed556e4262f30e4b48c2fa9b68c4f29d984b
SHA5128c8e377e13a0339d7ebdc0f954e508c57a04c40c73c712920a25a37d4ac5d55b57bc324f3befb7bbcc6737908d790ab94a99dd65fa02d9c8a77cb4fc7f89146f
-
Filesize
225KB
MD52dcb291ecfdb163eb35f4b0d65441278
SHA1d62227938c92358b6c6f078778c595dfff97639e
SHA256e077af57291564f240d41965c553d98056ab18d06c2824e4a86c0c91596ba1c2
SHA512c3128589ebf384b904e8136dd02cfae55fdc52b952ef240fa921c048b97bda784104cf1b790178c78137f4d2931dfce7d90d9860d69c609501e1f3ee4ea9eae3
-
Filesize
729B
MD555fd7b1a50b56a7ee62964e450c1c49d
SHA10f965b53c70f18bc60d4ab95e346e725228317d1
SHA256e6cd9e45e6b0dbcf996a05e41a62644880ce14eeeea07af53c5f854091ee6b27
SHA51224996cbe0d3d4a7c2b8cde7f6f8103d2916a5b24a520e5d5cfaceeaade611f935a36ab42bfbbbfbf22681107b6f051f774102fbaacd79fcbaab36fd0b063f9f0
-
Filesize
389KB
MD5e0133cf4dcf8c698201e31508ade414d
SHA1e86eb4d7fad7010363b8eb44ed33776e66c1fa47
SHA256038e23012947dbe3bbdb3037c17b745c029e83c3e9eefbd477bf14e029882033
SHA512ea855ebffb800e506967548ef43651a40044d6d0d111121f6a3c9999bf0c3b17809bad7c55d23bb7712468e8a21b19bd084fee648d9728590552558630f1d087
-
Filesize
283B
MD517962660fa396a60f6c47f518db6ddf4
SHA10093e5897d667cfcd17e298dc4a28439b32a3c39
SHA256c254287c61a4637e9132b019741efb71732a1c341d8c14d1ebbb2f8724419d8f
SHA512b12d0671cc5f2df689d8f840cb75b48ca0dd5dcc4316bfdfa55ba95d39efec1bb825323d089fc0428d030fc3ada60e42de2b8d737b8f5493a72896378f27e62f
-
Filesize
31KB
MD53bbfb036c0732540f435776005d8c7e2
SHA17ab60abb8a53a4d0fa9bcd6a8ca0fb0e2805d0e8
SHA256ecd3f1b4b5225ab27160940f19d84ad20b4c73fa86c9ba8f84f70a4064a041fa
SHA5123f186b5317ed655cc49edf2c30e0f6e660db440e99e58a4275a101704dcf4eea6c16529d8bdf6113d32405edc3d79b564101231827e34d9823db24464b861858
-
Filesize
301B
MD517db89a172387d7aae8fdce6badd6adb
SHA139d5bd9025bb0f2140f1bdd0c5cfd273a51fdf4a
SHA25662bd876cddfe40e919fe104c2ddd825d21fdf7c0141293195f48ffaed4a3dff5
SHA512194b8a5c9b82e325e0905f4be4e0ae4686e42374eb863bfb185cc12445211e3c005a7e31086c621e711648f40a53487515373d649f8ef284a8f791ed35bc7ada
-
Filesize
61KB
MD53084c82cdc327477456fe91674f8ccc6
SHA1fcce87bc041b5917aa0be11d4d7d77d9f88bc1f7
SHA256fda261821771f505e0f6e9d95458b1c6df5d33c1a39741bc2daea106eb7e24b3
SHA5125838c7c0f99f76eac8d251a44f3902736da36776fce516f1d1d65d86040d324fe541d7162ae2b0dba85dc158b926010c330d3f639c7399eef7dc6639eadee0a9
-
Filesize
7KB
MD53c5f9ea29483235d1de8ddfa15a3c78b
SHA148e6fb71342282aec5f8ddabf10d06b47ae834dc
SHA2563dc7a0cab60aaca8aa8fb33372e5fff30afa05b9ad6197ad3ad5656dbeb6a0e0
SHA51245e3df4730a1e7dfa934417da924d95471f339e89f9576b651952a2ceecacdf935ccf8673e085cc40f8fd6a73f84794ad9b0c2fdcba1f0036b3601122712ae95
-
Filesize
3KB
MD527a99f191fc9888d21ebdc3ed61675de
SHA1344781a8b251490f4d79328443a147834a0e3f7d
SHA256501787241e07d06c1510b3e14f196ab12fa7b2de5cf95a1ecdbd28a6b75bf8fe
SHA512065e57b44434c4db9cd8b8b29ebcb073492136ee2bb43b1ffadf42be8068a5cf99d29660e9fa7c32aded5ec2d3e25cdb03f0b07edd3defea2b83c77fe11f777f
-
Filesize
232B
MD55075ec9b72e3f23e9a2616a41319ce3d
SHA160fb9c7738d4b69418aa29404c0bcd9c0603867f
SHA2566378e09451882272a35bdb705d3ac1b9f9d328097411770c9010920fc80cb464
SHA51261f91c8176d6581267d3a64ae2ea7640116a200427adda8290b4a4e7b80778466d4424f346eadd06218a9ee5919db91dd6470d9c832acda94b195d38c119dab3
-
Filesize
423KB
MD5ec091a288e73963929f0854972c1a5cb
SHA10d06a0cdc818356889158742e95302e5e16b4799
SHA256b079059d606f7ba6cc1c99dfe7230640b7efcc526ca29e09a16ddff7f8f07214
SHA512eaf4675046d0ed4d1cf64deb2d504d4d20623bc76aa6d43e7d8c3ff040bd1ca092e5102c3f8da2017daed28f118e9f6a869a07268d1d7a2d791209947047090e
-
Filesize
29KB
MD594612756a51ed1fbf8420acbd95bb6eb
SHA10d71c8fab0d983af9f86d81820d285915b9d2e80
SHA256bc66e9d1362ee0c956e5665611611fc8b7c9399e2237840cac722ba702d01946
SHA512d94f146a26c4f5c962fb1037e78b261a5c616ea85fea95f265476c4e5f5aed849285929ca846e67773f23cb7fba03d983f5602cfcc24892e7b815844928f3a39
-
Filesize
264B
MD506fa5bc6873ed3afa812ccb5bd5f772e
SHA1b69de35bc66a0baebb6fbd2b205ae235af909496
SHA256cbe3983d114d3054627433e03c52dfc9c6e0fb348d7adb4886cf8f52483c7027
SHA5128b7dff07daca914d6a8459714567671c48ae540efecaebd689d142ae5635a626af027a3e62fea85755fb4d50fb84b74a0ac285fedca57f104d9ad3d711bc0f41
-
Filesize
75KB
MD5a30028d617a4ff7fbad713aca21f0e3e
SHA1f02251710a0eeb57f9897ef4c70efa9de11c208a
SHA25680b8d25995d70275fd06c63777687e0c0973fc9cd3f4c525dbcd65f9d061b1ce
SHA51233dddd272c26cd6d1b81e3a32f21a9784f8df1c9ed37cc133ec8484ec438cc0e9b4fd334b89751cccf26a94c4b7abb57252cc7d00fd2eee538327d6be2e83b20
-
Filesize
12KB
MD5a7798f11dba060a500426321195a7526
SHA16f6f81beea61a74955403be8dfb4b5dbbcf4381c
SHA256dbff955d3bf87d9c2bd37ec8be302c1caebbf0335bb8acbd8edfdcc9cb2beb50
SHA51200227076466ed019ee99ba59f1f7a2a8c65e613f57c7d3794ee236eaa24f804341538332ad3c8ed2c173f7d865645ced73181a293fa51029113ed8dde2665a02
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize5KB
MD576624512340381cd085d8ec6b58ba712
SHA1eeac66e9032d45f6666587fa8e06015a81126ff5
SHA256efed78e02b6e1b5de92bc1b0165683331e1b8ecc60aa26c59b36091b01e059d3
SHA512c9f9c436df75a0140fa8a2b1fe85fd7b0a269ddd6fa125a01926c8c5b7a015c0c2464fa0bd2bbede4921f93b7a717e54a27683e1f69883e610d6a25abaff0d72
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize10KB
MD5f759df18a76c17aa20a4a5cfa9ed89d6
SHA1ac6270dd3cd3a119703ae51da8181ad87a96f5b0
SHA256eb61a423315ea3d68a6cbb01a616dcdd0180c7441079a6ec0eed92cfe4498941
SHA512bfe9841a12764c36349b9c114ccb2ea8b15fa189493207a7e5c0ad7236e0c442743c3cdaea0e7cf5d26b2b8ed00b6215285ea6cc0401d819908737e90d5ae421
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize5KB
MD529a8089ca713bd4790504e78429c6456
SHA14b6e627816b7d8eb2f8b1215a8ae57348b4bef3c
SHA256b2ca3fd81372f5638ee0902f10bb37947ec6a3c88bc18c0e822f11a6bd84188d
SHA512707a7710e4768739fc57373d579b3bc2a3e78a79948e6e318cdb9ae5d17dfb079d11ebb97ec3f34c1082c3598605c9592249356a0c68f40f3497390b863d41f1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize7KB
MD58e3809b1c6513fd2a68bba08f098952e
SHA181f953bc9331c2e665b1608b577957d018eb987c
SHA2568a469add0b5e67f9410a35f5934541f78dabe59db69e37a7b168345fd2afddea
SHA512e0086092fdd87cd6006c9bebe3d9146480772a06fafffbec0922ec8bd67c21c16cd416d8ba45a9740bf7380d605b27767282f9c694f8a829c8720ae3e10c4a5d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize5KB
MD59afbd88d6ecbf4b253c06982378664e7
SHA1191e92595becd17c4147ee3ae7ab153af652f0f2
SHA2569c5f9c9b6bb168a055c6a20584bfc67bbd6d70bff3b25c888f0e27078b1b250c
SHA512df62ad16f1691735d87f4ef61c31c6fdce0633447239a2df929fb03c7d7d107739f923484650aab931196e3e0544e1c1445dc3a21e78611001134ac0fef0f9b8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize11KB
MD561fba7daa0dd9c77f851da98da1f8a04
SHA108a9a68a7216a4db16accd7f70d7e9b2fb58592f
SHA2568fac8ccfd78e0ee360afd6654e5eaf244d3c07467843f325e6feb5196d2ee9b6
SHA512df62c531632fb0d09f886db1544b0a0b7b83f4d743be269f2a19ff87865a942705a56956bc6e40bac0320f158862dd478d3442b6a97572c18ed0b7320c136561
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize5KB
MD5869f5f8d2876f89d8829937fe8f28455
SHA19706245c24226c419c50a9877451181645b188e7
SHA25681bbe6becf6b1528a33b99932fdc11529fe3208f6907546563a00e1bb70dc0d7
SHA512489ac86a56e208ba11e7cb22feda92f8aa80fe9fd1d41d36d7fa82d28f93f1adea41ed104a8bf796f34c8b1b749124bd95bfebdf9ff5cbc224dfe015e852cae8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize11KB
MD5d9ef6ab21bf2f111c57e8f05b0326636
SHA128dfd48868370cb8e87aad47dbcd62a63b5f4c1a
SHA256cb5639d4e04835c33a6f4b955e1c1bec9fff70f691ffa1912c17e69cf542ff1a
SHA512469176bca1870ca993ef49fd5cfe6f57f6b45a213336b47c9601d59ab0c1d547ae2f63e1058d51fe9c30d3dea2ae04a74d52a51c2affaf14d91baef50192be9b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize5KB
MD5805d469ed34693de15565bc339dafda0
SHA11e76da705be4d63b6c882f77cb0a43418bf1ec2b
SHA25622c15b87138ceb9d2594457b5995633d8540aec1b1b52f997845b4eed3d84da7
SHA512a2d8d5f105d445b4e6c29e612c2da3ddde51d244375778ee8be88880265b71275951f3046f136bd9d54168697b65a1c0b33186b07669f0663630f2fd0d1c116b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\content.js
Filesize9KB
MD531a2b4ad6ade485a9c85c5d8ba0b1bb5
SHA15ad37bf6e5adf2be8f8c841c44e191d2645f6ae0
SHA256607f1603e5a06ef8f1ff09a93edf963fd7ceb8ea587d479fab140e15713e1d60
SHA5120d223571e72582f16168ace8d4cae26f286c7d25906c74a91da1642294bd43de90dc21706dfd1f08a66b2663e5ef2142104321689cde09ae226913672e69aaf6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.pexels.com_0.indexeddb.leveldb\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.pexels.com_0.indexeddb.leveldb\MANIFEST-000001
Filesize23B
MD53fd11ff447c1ee23538dc4d9724427a3
SHA11335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA51210a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
180B
MD500a455d9d155394bfb4b52258c97c5e5
SHA12761d0c955353e1982a588a3df78f2744cfaa9df
SHA25645a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed
SHA5129553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f
-
Filesize
7KB
MD5cc967931a0af0efe35646d9c816a5b17
SHA11b4bc628eaba35ca67d869a7c59e48a2179ded16
SHA256534ae7c9b14342542c6604fc6bfd4f10305f69c8f070a84ef741aa24dafb67e8
SHA512159e183c817561fc20d658c023d5384744e597e7ae4c83ebcb7d3ccedbb8ac7033c8dbe36905b178a32f52c5c9ce4791ab244c9423c991f3a79cd9293c4ca24e
-
Filesize
14KB
MD5e2ba39cee9bf1918c4a08f9b98109402
SHA19d8ec94ba520e6fb2aeeec881dd0707ed5813155
SHA2565283483c369c325160943cffc4f058054c6905ef80feba8e98442aa3e991fbc0
SHA512ba21878192fd1925e04c7ae75e3177d81da7f91276cf235a9b83d418fefd8d77f7a749e599e308901bbb2512df14d56ae21b3e67faf852e4595c7ddd68794849
-
Filesize
19KB
MD562a6322c32642defb1c646864adaf1a3
SHA17ab95c06cc8930ff28edbac4a8fab6f28d0a6462
SHA256750bd60e47ad5d942d6ea8206f5497f09ce289b3cbdf0a9a0a5cdc45c32b9b0e
SHA5125a203a181dd6f4ea8ed3429ef3a6bcb52531c18ea7fd0ee6162b0e951277cbb8af12452a6ded922f9b7442b7f100a8a2a4c2a65fb0300485dc91675e0307de5c
-
Filesize
9KB
MD5443b01bbbf8c1a7be384fb79d5f41115
SHA191a03ea6616cfbb56688ef5a00cbb828a5aabab3
SHA25606d2f443df98b30207c5bf1264ca3d1c9e891f7e5ee4e1b8347ce15fa05a4039
SHA5129055a28671350120f6b6d387b9a4c9c17316911322ba40c7b7f0aab0a5395d88a092e0f5ba41925285bbbce84105f002a39c2803198ba122492dbba93e1bf75c
-
Filesize
12KB
MD5b09925924e17a77ce2d602d6d1929068
SHA19a7809451ad207198bae828e767217df80f2ca47
SHA25603db41f0fe4a360c112f0ecadf75c84a1748d24b502020041d057a18b7463b1f
SHA51245a13248eb9dacd7028cc791ec3108c462e7c9fb0cfd7f4d002949c9773d4c10a3dba62dbefffe0cc6e485e0cd15e627dd848607e620a832ddf69eafb2cc3717
-
Filesize
9KB
MD5c662e323124a6a8b3f60cc22e824e0a4
SHA1e2e63f7c7130bf55408256756ea927ea17f8263b
SHA2565a7b47bb562a1e438b4a83ffb1cb4cba7470b41f9094e104b968682de0909c2c
SHA512768f7d803e5b55f4faa6425d0ca20fce8e597374bbe2eb074be0348079256b3948e950d3ffd2b732b3c9e200048a2fc18d1ee3e47f71cf065b0fdd4a2d617f65
-
Filesize
9KB
MD5dd006119de8c6dbda6dc37c9cebc2ea6
SHA1255948cec5c20805ae223b4d27f38bf0b04a71bc
SHA256df99b749bfab89dc091bd3dc1c8a987bda139c59f8b010913a3af4693cea6442
SHA512907cd7f8ea65792d5dd17f88462dc368527a74d6e091d4a2cbff177fdff11586a8d1c026d4280f6a8fd8d4f0d1695e1801eb835a56d1ba5e34dbd6febda57e80
-
Filesize
21KB
MD57514322419c0c493e39550e0c7053b7a
SHA1a1d72a2df13f459e2a606b5be4482878ce225aba
SHA25604d5c1c77cc639996c8144f9a374780e3e15637e3eb1b86a5d43213648736430
SHA512d6ff7267f9193c813389c16d623c2d61a210d149baabbb104e4eabe6f7a250e42b6e1e134b8cee9a44098c23b75cc903990161cdc23b70f9808bc24f19702797
-
Filesize
10KB
MD542b6357c1a3bd3d98fe76cb2f72ac474
SHA190b64bfc99889b7ac9a72b3e5c7a6778dd880260
SHA25630dfbc4a6059cb0ca33216a7d2d937a52621fb127d2938d4cd99b1ddf0fee29c
SHA51214ae72f0607e6b827f9936644ce157603ff209895abcc0905da6631a25364f5c13487ee2b139e8f20e6cc03383d762883909815f3784d3828d152fc0e23af32b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8b70416a-e06c-46f1-8a2b-7c1c05226f04.tmp
Filesize40B
MD520d4b8fa017a12a108c87f540836e250
SHA11ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA2566028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
-
Filesize
13KB
MD575cfc35f8c5beeb2f91303aaf95433d7
SHA1f007e1adba97ca53493a8637875a5781443ea6d7
SHA25667217da1fe03412be4b155bf33051d12ca951e091a908179a128a3381492b579
SHA512dd91baa70d51d25ce3548ee49ffee5f8bc417d7402a8ec95355ab0e949ed14d919e6678d6387bb1811ffd5cecb37135372a90cd406515364648c405273355af0
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
8KB
MD5416fb2b0d90a1c05ef71dbe12ceab17e
SHA16b7984651bac9aa1e046b2302eef4c7d30220243
SHA2562914ec3ef98c615d7d765db393673cdc70a411d598cde24a164296ea735c8899
SHA512d2c7388aa1a2ddadcd5b22285baae736aa2c5ac328ea094d4db6dc8d8fc712301e02d4b8dbaee978169cb79b36c811733fd6dd63caaf19c54f97525cc63c0109
-
Filesize
8KB
MD5e2ed28dce1f54d8b3d00cb6a30e4dd5a
SHA15cc2fb2780263f0d25bfbdeb120d481519f11eb4
SHA256c5a927b40995aa06e219b5c4dc38561a341e44de01f044d8c3c0dd04ed51867a
SHA512be3bd6a64f3c9666840bdf87b568b66578af6f97a286b5cf464549bb4fb67b1e4d7356b3d77bb36ec531de3587dd96bf7447a6efe56291b2febfe775445fa444
-
Filesize
29KB
MD5090ee73fe480d8d8cd6c59805dc03dde
SHA1493ab89e9c131790d3d7cc47d31d26f61290e1af
SHA256f715d3e5ed2623ba884b7245345cd2cea7e79cd9efb11af60616132825f708f7
SHA512b113bba35295f3a69393be4c0443b98c4843598830ba7e2e1ff417850e3ede2c0ae289bb344b0719a8be68c72818bde6fde41b71d14720c2710d0fecc3c90dd1
-
Filesize
5KB
MD50dd99fc0d950afae8f2bf6bf77790e00
SHA147c5db8422eaeffb1bc8b4b27e1bd4c8056a2818
SHA256ecefca52ded8d117de60ca79a0c704a5f07559f00979da3b8f05f6a525810ffb
SHA512ae131412e66fbeb0fa5eb2243af731419ee5f9dc8779b153a5a1191ab158fb9c4068ed47be59621f8cc6c540dcbb6a0a94e4b33e4945f8a605d96cd5e71f3770
-
Filesize
30KB
MD5c645bbca93bd72afd3169a412504dedd
SHA17b497928e6abc23cdee965cb318dbee0654098bf
SHA256416adb13198ff1ec933802f36efd62392b4ac738e7d5774643a6948dca6321d1
SHA512f4b17ad507b45e6da2e4f6a8522bd692ff950d14b3f4d2c10ea911cde1c90b779bfe2d667519aeffe2de9414c84e39be9ff4ce7ec020b9365ecfc393fe1d55a6
-
Filesize
6KB
MD550367a894e5253e49576db366607e9ee
SHA117b65b470200dd2f9d6ccf081372ed4d5831132b
SHA25649f1a39902c68a527db0d3997d5e7f071b4580520f2fa60d397fb5051e18309a
SHA5126a15281fa14d25e73ab1319cefae8dc5689700e8b2001fd47ea4249aaea181d421c55af30368eaae7323be47fa874f7c50f9800c6fe424a15d29bcbd905e7b31
-
Filesize
7KB
MD58ec666150d36d57b4404d212388792e4
SHA1316f838bb86fec131e705f68f9f0bb534a38086c
SHA256ae4c08b6465ff0c1f8d17c2fd4846fed32b419e6dc689f7b5c760e163e4d80f6
SHA512ff5ca45624c575b9467afe9c944e08b30f7a96722cfba5c4953572ac7329502ddb518403194c60fa94b53fcaa7361e56aa3374ce4d816e27b49a91ab16eaaed4
-
Filesize
8KB
MD5e11c20c820250c469c8fdd7291261dc6
SHA122d66364c532433c70f3d96ee8b203b8a9772944
SHA256d372ffe2a3cf1d8797880e193b4a2c319c471acdaccd04cdbbd2417793ed8555
SHA51269073ef6b75288381375a612900741e8008fafd7f07e15503882ff135f9710b227125e73f5398ee17ec68e29a85206065e57d5049fb6d5ddf74fea28890c2d79
-
Filesize
9KB
MD5ff098dc83b60151c4f4b2b62517d7593
SHA11091aaa70d58f18e974dfa387e898e79351b0a7d
SHA256bbfad4404330dfcdf33d39a37cc9c4bae45fb94a3e6c814cf3b6ecd8ecf133cc
SHA512fc1e30ce41b175abed3e0176caa748a111c5261af3c73185c544e1c662359d3365d12e04994aad0e28f28a7269fdeb4c4a1cc3e5fd5c20f90edc2273051ceffe
-
Filesize
14KB
MD5df878612c2cf4c2f2b73a689cfaf3b85
SHA1de6065ee4420a7f38a9fed1287924a696726cdba
SHA256dee8fc4df365ee4298fc25515cdc79d9af1d8c5c53b8a061a59fbb7b819c331d
SHA512302b1281e666224d91514066d95eb6f72c7538b6a97d2f3decf1e2bfcfd022d33f72fa10e65f228f039246013a99c856744422203907205719b03e7f5d490d74
-
Filesize
15KB
MD5430e4f77db6c0d00e613eb714ae996f3
SHA1cd7cd9304f1f639af5212bdcdaab745ef6da8a7e
SHA256c77be4050cf5781c1cf60e13abb0eae1d2a4785865b88ea6346aa65d270cab88
SHA512f60df0927f261d5341547aa87fa4ad5462c7695503dea0ee5e22d6c140973dcd0c56a443922735230604173ce00a75814e8c9935c5a809b0002ad5f7a9e2be5d
-
Filesize
16KB
MD50304cdbf9e20b7d19778282f9851bc0e
SHA10764b5bf336e1d830a9dab9e2deba7bf9ea97d4a
SHA256a65ce4b75c6e7eb76b641773788721db1e00ca85806c8e39380ad214d6762bab
SHA5122b392b7d21aec247334705caddc51979b95ccbe4f2d0f62089ac2e48d4a094dd99ca775cc6be8662435c6f9975295c9e71da9024bf2c78977ada4d9cbf701819
-
Filesize
18KB
MD50d019512aea0fc01415f15cf7dacf2e6
SHA126f250f1d21c34852547a0ff185037b452044897
SHA256a6369efa0cc249bd8262dddc3af39205fa99fa7d7889ec2a02cd85187a4997ca
SHA5123330b951938cf3be130a9c3ed669f6ad71181ae457dd8058a067736f89f6e821b2509a19ee288156daa128928173c96e8b5178d9355982084b441d341854e184
-
Filesize
18KB
MD51dfe58010e193068380df15c7bd2631e
SHA1432b9233587df13ca6ade2ef3dec20fc6b63b775
SHA2569ad63259cf1fe61324c0ac8420724a324e2ac3fa582f0aa9fc5d4a72cd0b65e3
SHA51206a17f3ba355c0a7557b79b43fe5e6db165d040b5027b2d9a32a5a6758be5c2fe3ebd1b8189675e49772b148958794e7c7b6da929ca4cdd7fb9b002b79771169
-
Filesize
19KB
MD55eb9aaac4efdb82720fe81a4873dfa4e
SHA124f6a1aa0fa99e0257e3ea9625210a93295648f3
SHA256d6def9ee87831bb81d593a95a6dc96470096f4f122ee716daade0c23b3b9dd2a
SHA512b92a0cf86c987195f10192d0f0667348d2bf120088b63be78b7fe15aad36587a12cca70586b5e345c9505a1defba155bb67e06af6da2b98d8e82901acbac8963
-
Filesize
20KB
MD54526fce73f95e052f98ed9682c1068a3
SHA123f11e360aafb8a877ee3f19999ea99e2264df22
SHA256942bd9d9595e75a6b28ed78459bd198b9e850a1b039b8fd4ebc96cdbd72549e6
SHA5120875a41d62ebb40f859266e38023574c45f3515fb66e66b06a402413869f26ccaab09171e9d7521a521ca04528003c2ea09003af98bd03170bb6853a8fdbfbe8
-
Filesize
5KB
MD5480379082d538c931ac3edb32e5c70c3
SHA193dbe61875e07d8dd54e039e77cc60ddf910cff7
SHA256faead760e8e7a8e3d526b781dcc28645d2cdf9dc3e49a7cf2cfd3a67a77cca83
SHA512ba9a7c5961937909d2b2124a3465b53b282a6152bb27a48ae79f705cbbf6ab90f7f5643a4b80b015f9f9494a98a2838b5dd4555a5857e4ed1e0508f7397aa9e4
-
Filesize
12KB
MD5759624022316536e662c56a2b2f65974
SHA104fe5baa33e447d2f8ce1e6afe6f43dc10431873
SHA25693421ba7e3fc95577ea484a45a41f5aaefe5b71bf04737ca9ef687ee0cb7840e
SHA5125537bd5b8a37842eaabda7f8ae4c119fe9e1fdf13aabd8147437213e87a0c6c812ccf82799f4a7e850812e41457ed6e7b5d0478b749eaac061587950415ed8a7
-
Filesize
10KB
MD51a46590c5cff428c227a06ec6bf64bc2
SHA1259a203db9478819032a116d317f8f5a9ffba13b
SHA2560aeb4d16bc5040b4daa9061de1b61459eae13a66d494cacd2b9d753325078148
SHA512ae5b9e704504ab59e4d04930c8c1f36b6d914d42866e04cd21a6c8042a0aa9e8ca082f6019743cac37c6ed5c34ca72df412f8b68e7d96871216c3b7f93c67787
-
Filesize
10KB
MD5e9b9b90282342496c0626f05cfccf817
SHA16edf82b74a2e29734c240e7378d165a1caa8e840
SHA2560593b76da8b428cd09413a094d54ad57fda849ea6d8acc8d30f04a19be8cc61a
SHA51231317e4d480f77b0247907f0793dfcf391c330ea3382c895504bc33f7ddc6567a6e991bd838c838a3655b75322abc52580ec7dec18143061b40c10bba51acd99
-
Filesize
11KB
MD5a6f8774d8778093e7d75a92bde19ef7f
SHA185fd14dd4a47e4b12ea01ea825537556a1ad6756
SHA25679cda7a5e25395d87efcaea9fe0059451f405b1e02fe0d3b6fcf5cd5e8e56b03
SHA5123ac7ed3bbfe6a772ef53d5133e05c95e533212f8ee1c94ea7a65beff0e018fad224535a38f16722878ccd9a7da68576fae1a659a26311795e81516e4c808a443
-
Filesize
12KB
MD5f631aae1f5094a418ee70ca5b1d5bafc
SHA19bc2df0a67dc147e8401b529d2cf46baabeaa8fa
SHA256af554c72df661235299fe8ac5f5c649f6c8b6c6962e9d1c2a3a090a1d7fe398a
SHA512b83d22620f0e7b62411479a04ad2701d9bb081e312c7a022a4481fcd507d3a595f37a7ca2b69d69a8453fe1766a8eb6b07c715d09918e516abf5833a160d236a
-
Filesize
12KB
MD58af8c7d17297be32ca2bc8f4ddf31edd
SHA1eff7527de7a520523dc90a31d25333b28cc88ce6
SHA25649f0f68eb8df7e5994d15b03602205ec07edfc7500954ddd686a1533629faaa6
SHA51203c3a56bac4d79a8a87f511ff9b99c9118d712bb5058f7ce93c65326704985cddc4bcbf9de3e44f8e9657c1231872654391b3f7e11eb8523d439125c7030723e
-
Filesize
13KB
MD5c1e8e528e1713a520382067b85381422
SHA10fec38f2c944b59cecda4db6a7480cd45b1a42fd
SHA256fb1409a019fda353e6ed80f82c35b968306030aca465f72936d0663200acba87
SHA5121fc5865547092772c4a7dbc7be705bd55f9236b4b7f293b0784f46b7ca7a6b12bd4a7864176df9a215557e09279992b839b6d00fecea8ee53d117d0c651d60e4
-
Filesize
15KB
MD5682d34abb85ca78d63d1550b54ee2fef
SHA1e5a65d1b0beb49bc79d7b499d4f64e13abe280b8
SHA2560ae2473990ddd3bd1c68bcbbe169b5d61e6d4460f1ea73ce8c9363313a5027af
SHA512e0428185d716541e75fb43057338ca4195f432e4906e17b71c9cca0f20787409e7497b217a28d35149001f5ffc831bc988b1d4afcb6c8f7c02c76deb13e20f66
-
Filesize
15KB
MD517f1028bd361e0821f1e052be48bfe28
SHA17d2424aabcbbc3fe0831cd5cf37b34cd4b9945d1
SHA25681fe9c0eacfe0eb5782ef841858d04dde1c0db63d4034d23ef867fe44d12d20c
SHA512e2cd6646b3fdb126f5e18777fe89ba2d5e64d80cf18d1138dcbd5994483cb3bb9d69849909146557a9d4d1126dcc5f5f120ffc7b2df7c33f6bc5ec15b3c0b1c4
-
Filesize
29KB
MD5897b5f31fb3d1b24a984474d46b87e2b
SHA1c42bce5e6a0f80a5773cc5ec2ab87e98238bd4c5
SHA2563dcccd7d02f1a479c1f75d7185daafd2043406205035e3faa6769dee122fcfb6
SHA512a75ce7d40ea0fa007ac47503ac0a96d1df0627aed5b9cf4b787568eaebbd8735d4410fbbdc733336dae1324c32abfb3b2d5bcdb8defdf1773cc8c0eb6998639f
-
Filesize
19KB
MD5010ed2493ae0ea0298c172cc0d6189a0
SHA1cbf69735f49e141bdc4c71f494ad58c53e8337b9
SHA2563570656e0dfb40330a2f34cff1c09c21fa9dd9ec773eed3868b97177a90f651f
SHA512293092b7e6150abcda405382e231462cffe78af980a174db9a424c0ebcb0d68e6829b146bec2ccf5fc59fe7238b4840e410687d28b2a04cde461437dc45fe81e
-
Filesize
19KB
MD5f0350ef3edea7adee8ffee6ed8d5f343
SHA18ef1686f400879fbcdcccb6d75573b854251a1e5
SHA256aaba2f51922d692b813f76ba879a8743c5717af28b9f51cfc8577e7ae03ab3a0
SHA5124ece2ef7c28c5db034ebf4b9a4356521cba6053ff0ec44b0d2272e97534f160d4ab3ad29f4dc6cb695ffc72e93b35642b1f444469addac008f63f56e68fde4a7
-
Filesize
20KB
MD5f8c1031f7c961bb1818adea0d26676aa
SHA125f28ace6eda271c6e8f581c5bcd84adc559c1d8
SHA256bda7c6217dde972c498a885952ecbc941e78fe6691fa433d0ab3f80f22152b05
SHA51224a8decc551678afe6b059a9d585b973deed477d3e64e4b7f3ddd6e0d64ac5283c4e8b5ed019a1d65b55eeeed38822a48ffe2cb52e000f3994c85fc59c0202e2
-
Filesize
20KB
MD583ea53155c9c131220edbc2045a58a57
SHA1a3981a5b5cc2b590d95489f742a4cde282af2ddd
SHA256e07e08c7cb30decbfecf8ff5f38ba312125443608fb0e26883e5ca8eb4471476
SHA512932131ee33ab0c91195352d4e08231bd1d169d6d9cfa370db2a70d187fe90743fd8754642475d18b252adf1a62eece6339f3cfa3adfdf7bb69d4e86e78740556
-
Filesize
12KB
MD5bb2fc7242a493012a22ef5d8917015dd
SHA1e2ad0f4f078d4f4938a97b1a132b2e98f22ecff8
SHA256a021bbdb6ba8b7b933616e9950eaa86aa49fa142410deff2f4d2dedbc807f1ea
SHA512a8a220bf0e60b9ff9231d658551de94ef3b99434ce19eaa98feeaa8df6d0d64bbc09e1347dcd70a4619cee22cc0d63b755ccfa026474c438f8586df4cb703e75
-
Filesize
16KB
MD54a52015d83e45a448677387f8e81da60
SHA1f35a868d024ac90a79c056d42f6cb636f09d0e10
SHA25639d0402146b603d8202c51923d9a865b84b05ee0d10338cc6deb430dc62dcacb
SHA5125246a8df200d23420823d07a43b53762a6e5eb4ba357687186a9b219d1fbe2871705db7fedb9a442d37f7c00068055f4bababd7d7d2bcd63803db8df50e4bebb
-
Filesize
12KB
MD5a5818a194e9414198643c8c4eab63c53
SHA1dfa2b0944088376a6ac92c057b512af91eb596fb
SHA2562a85962dcdbfe0f40b7f7204d4ce44b976b3eaa9f0879e32fc7709b87840c82d
SHA512ce712e78edaf2cc4dbf5fe9b6d4bd508faa931be0092c11a396cf9024693c90a842e089392abc50255cf7310bb2e654e5054018134301e0b94540eab48f1bc7d
-
Filesize
13KB
MD5cd53497e3bd4ca3f5cb1d3b7517edb0b
SHA1af89d7e783e6d7d56b721bbd9ff04e19f1b68a0e
SHA256dbc3aaa88bb337da1d19edb223e7c85b898156af87706ef2b30cf4614ce64171
SHA512fcee275a37350c946ba9db3535a3a51fb2ddb140c97086ddd1ef097d4cf71aac03e0c92e35209cfe7abcc424e35f43574de1639ff32d772c86c670336b77bae3
-
Filesize
17KB
MD515452232abfcf85b13d9d2beeb910ba5
SHA1cb0ec7b15ba32e581335b2d615f847e1e4434619
SHA2565732142390c397e829b00abbd296680681b2421d48a04849668c1a5fd0c906ec
SHA512fb96c724f11e2cd1b119c765f5e0cd2f439257abc8e6c8708afdd83cde4adf8eb3bbcb80dd6f4670e11e1c7e5d4f8b0cef8ae6113343f2cfe6453a2bbabc97b5
-
Filesize
20KB
MD5191cc7ea03b006dd41472d347cf914df
SHA10f92dc510c751efe637621724d8114a23570569c
SHA256431bb902ffbbbce17b634a710921f832b58d57b4e41d4a2c60dd1dbc955c290e
SHA512667c8d60848d35a99e62ea07e7f66ecb3f2f5ffbc99e28f5539213406fbfb12f8599b9aa0802921f194036ee55e5c2eb46c970771aa26ae0f1ca51d85ff0bd17
-
Filesize
5KB
MD52f78879c37b2c3bec13f98d166ffdb17
SHA12cbbc243724952ea6990da601b9da2cdf232af07
SHA25650e1b711512d5d73d922eb8984b4bf76c57b63ba02fac37ee8cfa83a8f924c99
SHA512745448ee9404f7e646ce1c0f1c79508461b8409be60b62f60514f54b7d92ce10976566991621b2ac92e546fbe67923ab550fc735891662e25f1c99008d9b9321
-
Filesize
13KB
MD5d053f0ec3a47f0f3605b5c1ea19c23d8
SHA15e53e63982387154d968322727d560bec2b0f42f
SHA2560ab6bd7e922ce59dd55159a7ae9bc65deeab23a6890aab8978d2955445472b50
SHA5124401d68b6a36f3243199d5efdee4259ec8fc45fe37baad3919a547045ed8e2b590ebc91f21a59a1ce9b7c4c248324e7501bde3b6727379e0255db0e4bc921ffe
-
Filesize
13KB
MD5464ab7a780c2bb20f9fc91403f196bd4
SHA15b9fd2a3f07ec46d66ded20af023acb0186e6c8a
SHA25652fcd31cbcd8a1a806fa6e1a834df3cd83f169ae53481339850dd45291e4999c
SHA5120abb85fc7de040af6ab1459e482d8f5056a12f96678269d0ac9e40db13629b3c7f9ae1ef9de7bc904ede6ed38fa99b5ec4c1b91c20c855fd618dbac2da9acff0
-
Filesize
14KB
MD5425e57b5ca95b1e9adda2a4384f58de7
SHA17213923eb6ddcf18af567982611137e55dc18a6b
SHA2568a349e46635cca527d0dad4c90bb33c1c2b975ee95de3343eadfdd99daca118e
SHA512dfc80d2400896b11821345694f30f8ea46497d02be216868164eecb5e9f9ec08e1cf48dd34a060b4c4f403746ac95d99e33489ae29ce4fe70e5f84413f9c21dd
-
Filesize
17KB
MD513f188d0337c1375feec26b446524572
SHA1b7e5da172c586c65e513a49980265aa205a6b96e
SHA256cb31873bacfbf9af9275f8c9dd1ed62ec688218d5af26ff0d34cd695323dd1be
SHA51232b01375dbaa360aae259f6b3240c9994ed59258e93aceeabd86e2aadba4bc28edd38b3fb2fe1a2413ad1af1ce81f5ceaefb7f57ee4741c93242f217483f72b4
-
Filesize
19KB
MD52624cee0a45587c62b5663f76e631998
SHA14064ef2a85290aa365f032e36197cba74d76df6a
SHA25619060e8d2a58f528bc1a9588c5835210441249853a7271cd36ed1e2c8ddc40c5
SHA51259263f07e31f1c010d1a6911c74659ae74fb40c04a2d210baf56d4eb25bb31a541de54589b68d3f26c5102fdbdf8e29b8269f20d66b976e4b12ebd35f7fcc579
-
Filesize
14KB
MD5410b2e270747f49168a1cc519c5aa654
SHA12bcdc8da12b95328b614cfd440abc0747cb3ff11
SHA25687453a74a31cb62c04dc6c54d66b9c0c540e203fd79e6d109909c19b32bbac21
SHA51298a2007cc18ac805c660c0f531e7cf7bf193ab6901e3149fb1976a855238706744e70892456702099610c602573093270c5f7ad9b1316829f41f34679a198837
-
Filesize
18KB
MD54987605f616234931d43d0c40a0c2a89
SHA18029da0bba1914f485ee287bf29186c61146e3c6
SHA25627de79a88b5bdd2a0d9203782c1721100c2c43ed8c07d5652141739ac52a5cce
SHA51265098745b801c7269d3b1a1844a39d24f708f00295f3b2f2a70bc559c038b9d7904c482a9c4ca542a901929a7e1bfdef9e1089e92a0b130f3b11fa734d2777c2
-
Filesize
21KB
MD597e23b754f33d69450ec2467c918949d
SHA19d44c602bade7170ac652f540969b984d5ecb7d9
SHA2568ba711938103fb0b9c6094c55d8796dc76d5426818bd85c26289331649f787f6
SHA5129af9b1f2fd821e339a62582c19c6de25ea75e23a64e73a74d1b93dbbf37ae97e52ecc7543139771b5c35ec564ecb95a5c3456d6e88557549496caeba7ea94998
-
Filesize
20KB
MD5883d7ef27229f0bdee2844e4ed6dd957
SHA17d6ffc45de052109de4bd60f9f1cac8c8e42ecdc
SHA2561339b11d2485fe7d1dbc6afe1750e9a1458ddb35f2ae09bd208a3c3103544b2b
SHA5122d57c6c53208b787449d4e18971cb0ab4573642309c8e98da7f02ad8ee8ceeb7822169906efb3a960b1712c7aa5e55602508a5d224ee4d754fcdcba519212844
-
Filesize
13KB
MD5fa9092cbd79903315b74b7083fe24d4f
SHA19100853d06727a7126ba5cc268c393337d9eaa0d
SHA256a1df67313021b72ac64c355f5f80d64d3958b80e7d16bf9b51f9b2a8132be1e9
SHA512546331ea9bdb0ecf4f3153a061ddbbe33571ac7315c5142180d498ef9a8f1101604acfbbfd4c5cb271f4741244af994a6049477977301fd6136b89807884b1db
-
Filesize
13KB
MD550278933f1ad717bb419beef912650f2
SHA1d392be0c860f1adfe9a4801a0c34e0bb50819c8d
SHA256edcf3cce30c77bc080ee10ec551b1fe8d46ad4be7552baac34084140f6e8588e
SHA5129fa95ade81c46293168989d98d092e67f12c4ab051bb2c972a380e59bbd6c57a01d9ec946a9f5378178ee36af461cba709b73bfac7aeecf56e15d11ff1eb7744
-
Filesize
13KB
MD50a23bd00efd37cf8126b8d8b0cef8091
SHA1990188754da656ac0c4ff27e6ae68501a38987c4
SHA2567c99a6e9fddec63ea9e786619aece5576e1e8de28ad4621371f9c66c19688e70
SHA51243a88fc8bbe4bc00f26b7ca6eedcb9bcf371d229a56cd2e3e2039cfdd3757990a8e38bbb9782af4bd59aed5ecf2fa211bdd28e7594f477fb74d2e606a271e31b
-
Filesize
13KB
MD578222e4a5eaef04451fedb99a43b3522
SHA167654a8f759c35074336a9f42769858d2c939c28
SHA25628836f8a4d6402a6800124c1422b16cebd88585fa76294a9c7baced64f3f312a
SHA5126fe1fd2ed9289bfecb44e834131612f65019df5ff3515c7671763644337aece56c1be5619d7f4e2f2da2a8ced3b21e395e9fdf15bedde01814a0536ba52e5a37
-
Filesize
24KB
MD510f5b64000466c1e6da25fb5a0115924
SHA1cb253bacf2b087c4040eb3c6a192924234f68639
SHA256d818b1cebb2d1e2b269f2e41654702a0df261e63ba2a479f34b75563265ee46b
SHA5128a8d230594d6fade63ecd63ba60985a7ccd1353de8d0a119543985bf182fdbb45f38ccc96441c24f0792ea1c449de69563c38348c2bedb2845522a2f83a149db
-
Filesize
25KB
MD55aeb110873c3fa3af5474b759bc4e00c
SHA13e8e8efe14e00c4edfac1ab1a0297a2f71fd4cfa
SHA25634a51d7acb7e62f9662e257ca6e6e2e145ed9cfa0013fcec5b7b652e1daec19b
SHA512c9ca04ef91627f37be148dd7eaf42192d194b9a937c5ff83ca578f64de6452e7c38466b113e70e9954bd15eae58f4886d8edac3a144341745a1ec1c402a71d36
-
Filesize
25KB
MD5856864bd26755b752d5486dcdbb11a92
SHA171b12d5bc5aa9c61f1f499911dce2ce221a26c12
SHA2564a1a43ebc64d160efc72584d573ad37501772f4f285553ed61d9939e224824fb
SHA5125114691903fa41e43f48e7bde4b8c6927af37e3513afb4c86c7199107d3615d3a092bd2a11d0617d5eb60fa7133524bd3dc07d024cb20f3b0e6b883c2d18a2b3
-
Filesize
25KB
MD5d400a05eeba556d329cdb97863832706
SHA117bd420e8bf2ce0f098aee063f5efcd7ae53732b
SHA25633cd30801ef8ec3f50e337110caa6ac75e55b35f28b298a123a9dbfc58aead2c
SHA51216e6c963931da384afeb237037285f8bd99952c0b740bcfb4c742aaeef3ec1d222e294192ed4a44af4a51330b5912e71ef673d07b1235577b4cd69060da7c195
-
Filesize
25KB
MD51b7c86b2cdfbea07fae158e91f6ffb6b
SHA1d9cb358d4e10325817ec816c2952977040b92c1f
SHA2569085942c454a9a5900d089ba5f9c51db1999a2013f7c740632ac6c534bf9f1d1
SHA5127964c12dbc808980c08a802c119797444f50338928b8c4c65b0079a9ad307ad1f2ca8d5fa6f25604929d7df1bcdf461b05bf945a32daf4abcf60371225484a96
-
Filesize
25KB
MD5e927ba26e96d332554274aa8235553a4
SHA1a96b73ffee4ab524d24b8ac3304b75537dfdbe75
SHA25642aea3c8460e52e33c913db13a23e4b47454afea034fe4efc59b3ea05effdbe0
SHA5126b098572b0a8da6951c4e821213ce1fc76b65330fc3fd0e15d6849bb70488e513294ecd9d823cf96fea77fe5560f3c68554d222e13dd44291e6365a23a4122b4
-
Filesize
25KB
MD5f09ec4102dd273330b033c48a468fa7d
SHA13e63dbee40a59bdf18b4064b1412776c6a477a93
SHA25698a9c16c0a78ef084ef6b11b08fb2beac43e080b0121ce3ab6cc6586f50f7240
SHA512094c0cb0068ae9c560535d4e2aff6d40b583287b5a6e637fed07dbd4e29d3c114ada62a8443d9f8111244b25aba8b0d845f44bbaaa35e7a1156411f1766138c2
-
Filesize
25KB
MD5b4e46fa59b555455abbdb81adbbd83f7
SHA1efe362985d81c9325e8c5cd61b2a9fcccf970b83
SHA256ec44202f5d3fa842cc786b9fad02699f9230a0d15cc2974877e2c849e26887db
SHA512d083632a9042b64d602dba79dd4e4496d6ea3f56abe99d5ec721607e194a77f285eef4362fc60e5bfb43c96a240281c2110464ab25952091152299674392be4c
-
Filesize
44KB
MD55c87cfddb0eec2b950e4051c5b2fd5a0
SHA122eab16712559f5b1cb8355a28fe739ff33a23da
SHA2568d064640dca28d8a2ab744e00d51b1164f01e23cd45c8fa58c4f1393bc4d9b40
SHA512332b3e8912d6a013fd558e7a1174d7374c7b441336cd50b8e727b11c1ff239c9a69f534ec10b2af045d4599be5ceacdd9305049983fd0c2c67e5a5a9bdd40011
-
Filesize
25KB
MD5d1c85da0a03e8e690273a27e98a4b69b
SHA1b7b82b969fba2df08dbbd76a80bdf755e8ec3059
SHA2566547c226eddd12085d31d7361d53dc74e9dc2fa9b9c178abde9dddbb8e62407c
SHA5129fbec5edf490220ed3a0828e76f86d9dce18e16a73d7bf589d57f103916d7f0bf81446d81afb275f74001ee093b5df513f0e8dea4eae0db9d482e60eda4c2cd2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d9e8af0704e633671c505a5d3b8272e40e9fb439\eec42078-2e8b-4b2f-9fca-421d802db9b4\index-dir\the-real-index
Filesize96B
MD5f78ea5569ed86ba87a0b94a5ffeb0130
SHA194d2b029fc74ce597d2486093ca38ff4c03a42a2
SHA2568023f9a3964278f427645b78ccf7c2a8bff9be05c3d5dc153b696df2907fd133
SHA5122edcffe704e614da58f5f47fc3af01e77374838a6c88d898cff5ef1f3991bcc9dd5bc61fc326885e690ce3709abe5774d199bd557260a650d5d936c59c7acf8b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d9e8af0704e633671c505a5d3b8272e40e9fb439\eec42078-2e8b-4b2f-9fca-421d802db9b4\index-dir\the-real-index~RFe681a3c.TMP
Filesize48B
MD5a1a5b98b2fb1cf8705ff2cb67370f385
SHA10765b65b3cc2ad20968c2e00186d577f5908dc8f
SHA2569300cbdcde53e7e4c5b1f4c759b83a80474cc6313d40bb93dd1884fa169e9c50
SHA512f9b8c4c4907b3c0a5a6758aa1f7cffa858b4cb7951f567ef2ea04848697cd0fdfc25370fff552756924d2f6e4b884340e4d8b6c5cfa5195f8eecfa5941742c80
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d9e8af0704e633671c505a5d3b8272e40e9fb439\index.txt
Filesize90B
MD5395641b42cbb5fc3e6fa56c356b6e2fb
SHA1ea82e37ad735305f3ca7dafdb940971a7e0d713a
SHA256600ed98e7907b2b6f11bc56c0ee23da8b98144f80acdac58c34e6fc4015e4098
SHA51290d3c6adfe23aeefc2dcd456b110783c813916524d6e8d540b795bb6e4c9a279e202067cd0f56652c5885353cec5f75d4eb240c02d03a2dad19f2578c62bb767
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d9e8af0704e633671c505a5d3b8272e40e9fb439\index.txt
Filesize85B
MD5b7aa69f73346f5bb46c334563f7f3fe1
SHA1e053f4ac8f6b79fa3bbba8e502a96e53b21fead7
SHA256fb0a9b4e736c2f5b5267ea950530dc62cf60a80ee2c09e55bd82cb6a39a4e9e8
SHA512f61a9fa806e96afd1edf12fd99b3e8a9437777041cf15a8821ebc25d49519ee7aab36d596e7284e250bdfd8082bc95d63e386eb761e103c541ac8b061eb17c2b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d9e8af0704e633671c505a5d3b8272e40e9fb439\index.txt
Filesize113B
MD50cc05e3dd11366ddb82d1c379fd3f5ee
SHA1d9a42525524696fd3ea3b5e39fb861ea4220bff8
SHA256d9dc845eabaecabab756948a75b57279fd1c23637cc504b35ba0917de756077f
SHA51215383aaae1c02cf999c3e17d0a1f181460b36e9b4a1aeea33615cd61f108484f545c454609aacad6bce3e0e67ec65f29f91b399c37165a3863edcbfa5de0c5f0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD5868e3a36437ba960de5eebe1328ebe15
SHA1cb76f2be680439b4407f82bb666c6fad8bd5b116
SHA2562919f7cacde9d59bc6bb48912e77dbefce61d05ae24f0979e13c1c8ba802213d
SHA5128b258816e9966942fcc73ac157b066b0bd309b93b3b2835f79ff1eb291da4c2bd220ab0298c251b6c36cc12e681912e727f647fe8c54af1a29fc6daf84034247
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize120B
MD5bd633ac91c074c6d921afd3626127042
SHA1af9d0e5d8041580c41b1dabec08f287a1ca85eb6
SHA25695aa1b45d8b5900f8b2d8fad9f4a557a9ed8d6d7486399d3d419eebbc5782fcf
SHA51264876b7340caa815844293461d304b70db67984812085580f23010f453bdad33a0aac3c2db998c8dc8d399bac91f6c13427c6281b5c8c52c590095556baa1f43
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize96B
MD560d9fdff259690c368be39211850148a
SHA16750f9810afe0d5ba0475144f22fd91008e721b7
SHA2561bd19776ebcb04b611e10851b297393be561f9fe182fbb0561bf0edfbd81ac1a
SHA51238dae6f1407847b3d686d57cc4ce1d4d87f3e4f9e1c29071752e1a940a941d24697c3e84a4f535732ad88493bd2df77a43ee3c873748eb8e0da2b22b1c81a658
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59cb84.TMP
Filesize48B
MD514dbb25e8987eaba18fdf1f5d03d8d05
SHA1cca5c42d70f5a2242f42aedf4bf0538ab3c47dd7
SHA25687b68bdde42b4937ede13e4f72c48a24a39e4801280d6e988dc0c9859fd78d59
SHA5127595e65fb869dc2a4ed5b90db3adca0cb6801f0ef485257c562ed7f9d1b5c786cae72dffe03dd71fdb41c87fa5e638a1fef16c7639e44de988cbfbe6984006bd
-
Filesize
1KB
MD5f140924f648257ebf20af56df9afdfb8
SHA119e90e71518fffd55e9349ab8d25189c005cd884
SHA25638e2446981021142387360cc34f686a95a2b99cfb5f56f91968597556a674e13
SHA51215f3b5f7537ef4b4165544078b8b3c9900dbb500db656d2a9811ce966a298481854203276dc75ec7be947444ea24541e7f25e983efa517fccc5cd0fe14f6ac99
-
Filesize
1KB
MD5f3988a142067bc34b340e8e87604aff0
SHA155f4c80116424797f24825b3223cfeb53ff70688
SHA2562657c8a2054cf34164f5c9ef8a547ebd5a310988c76aed02564da6609290db69
SHA512ba03bcfbf8ac196f69fae332e131888f875dd50b4fd95feb97f230d191873755da17ea33c43aa3a1ecc361025eae7fba0215ebea0e11c5d1be7e01e37962b61c
-
Filesize
1KB
MD5403fef369c42640ef2ff13808f8a5f6f
SHA1067a6602282fc11dda68fd284e012a3745d7164e
SHA2564a6df4505b639c1e6487fce3b28ac4c7df4244164102bc1da53e4d16a56e49c4
SHA512316f3fc0b1614b5874e7ec82b17eff862452611c94b58c374d764cf850f311f5203ff80c030e32be7742543a150f7f118776fc8f70ec4c69ae539ea0fee8f94d
-
Filesize
2KB
MD5539e22437105d427c4a643cf602768d0
SHA1b8729464f3b2fa154252829c89c4b66d8afcc2c4
SHA256be533793f761f09d0cf4189884cdc139ecd2cff1b8a0c16555acbf6301aaf261
SHA5122be9a38d51aeeab192d4c2b0e436918075678df0ce1e88ed40a8bb32bfdc5872656226183582dcd350598c93f1fbc02f8d055b5b9ce4c404b97a199242ae2b43
-
Filesize
3KB
MD5a185840df94f768687da55fa79cb8fcf
SHA15ee8e6798be455bddd53a31592e89126bf7935ec
SHA2563cb0c3d1c6aa2f77c532eba4505c035c4c9f19b4072ae9096a66b747cf79203c
SHA5122803f6154be48cba36d970f3415cb6f77fb9c86a69bc9d60cd4ffbc71d9602064d61b3de2d2bbae25c3bc4de6cc89ec14c5622203aecc7ed58a45f182d123a0a
-
Filesize
4KB
MD51a2a1452cc4ee1ea8dd3aea4a7962526
SHA1a5909215809a4c8771a81bc9f8e2e09b46ba1352
SHA2564f575a01478be84d633ca3847abcc31afe7c68227114d9c7a679680cb46c57e7
SHA5129927f0df059c7064bf447ce7045720fb78fe59db250f3927ff9b8892ee61b6c1133086f77dd7bbc13a8667d89b9c9d797bf80bd9ac3e9364a4fa91389c13cbea
-
Filesize
5KB
MD541597528139013154120bc0e0ebb4c91
SHA1957d7d2895ee0efd5fd06316192ab096307bdbd4
SHA2561a728382a2e34751366be73d26d28f73fc93accca9e3076ff9778c46ec63ace8
SHA51216191708f0ee6d2491693ef7d545867dd6cda6700e754d5d32aa70ae73c16dbd71a2f7f61b96b1d8e0eabba29cddfb58f186491a7e4b70c4deb95b255081f266
-
Filesize
6KB
MD54df4bcbb5662dd92cb791a8d2aaede86
SHA1a6768f4b2c1fdf8994884f2c0aa6a532c41fd2e6
SHA256443be8f68f58403c3ee9b8758c5a5696363532eab720ea1456c3912a530d136c
SHA512f08fadb44abbf2413826c8483a17faae7e9e2fa7e08e08c709305442999e16c49e36316a79ded8a057e77e89117eaf2c9cb1d61f20f89bb2d25da68d15e15b9b
-
Filesize
7KB
MD5792e1241c64e97019e3ad012040288cf
SHA11d077951db4c4436d57a34b515c0b6716102beb6
SHA256ac8a6bcc61661f3ab03b801b5dbec85b4ded22eab41072835c275f84741d714e
SHA51277d559b4c018f2c078820c2b8070a7a16a821853b30e65633b1f23395248b6b37d667748953392954cb199b5d86904d4bca3a69fb99dc2b8d8f9a9cb72912098
-
Filesize
7KB
MD5bf736c206c463ceb092a47ff63d7207b
SHA1154e78a92cdac02d55611462274ba913eb1bed39
SHA25651c17a8e16425cbd8513801f58b57e675553d6e761b4dac9b36361c47933c2ba
SHA512f7b1f627b8a1c09bad26d7dd9417ef8c065a0005ee29bfd47553c500fcc494b62a27cfa794f8f33c05e327732137a2593c0480aa17ce986074caaa0f60a0a9bf
-
Filesize
3KB
MD53d1ee2fd23ffd97f866aa7dd7529c774
SHA15db6780c9559d5a50aef12fd252e7750d7888839
SHA25661cf57314bf4f5504e418d50a9e08ab3bc523a4fb79281619466300ac3bbcea4
SHA5124b090d060ad3cef19966699071156875efea59e98edd7c6baa6730306af90727f70a0efcc82707f5c0ccbff8bfeea96c31a5444734797668739eb9296232b443
-
Filesize
5KB
MD56a9c102b8a53c0a68539f7dc03f56240
SHA1710be33b69d4c271f815b32b64c9c3441d688f13
SHA256f949885a5b2bfa3da60d9701e9266e0795d8b6d48ba6889c810be2d1a9bc2752
SHA51290e4505563e43f2ef326ea6713658601c3175a152cb1ac431448a4eb3f99b990b651a06fe76f949d3bc58587456dd9baf5b54b286b2559c9058857bd64712245
-
Filesize
5KB
MD5920343c0c6af6c3104ef19225ac48bf2
SHA18f7827e36554ab89547726306a17b9dc9ff71a0d
SHA2563b2b94581524360e5adca1536c6db42d8c6e30b474d567537433e683dd4574d0
SHA512dc65ff80429e614c1cc11b33dd6b3ea9df2418aa2eb7baafd489ce20dc6effb91f18b4fcf65e62cf9373a97cd7f56e75dbeb3f796b10c3005f2a225e0207b0f6
-
Filesize
7KB
MD57ef488cb0da669dbd0aa4f987ec1cb41
SHA19ec81b944c494ae62e860a3173ddc8371cd6f9a7
SHA256a4f90d20485bd88879afcfd00355b61c8b0d77d76418ad5749019209dca076b1
SHA512d95ccd2b754eaf7a25cb2213293d5849d4f680d5c20d21dadb201ec357d1d06ee2bf840de02d3f388ca5f3dd83bbdb805ef94ba327212944a1372c2af3a13ab8
-
Filesize
7KB
MD52acf39ba5ae8872e3234ac47416562fe
SHA1ff7b9055c91a2be012cf01e68b5e9761053cbb36
SHA2564242350da403bc328f2d1ef4c467a4d01115aaad9c4ba36ccad39b718ac45c31
SHA5123937e72e2ba9180aad7a9b90ca7f4fa0976976eb5cfecceab4a08e5b45a3c1c9645d64a7bb463cfa5bb6cd0d5df475de06f45cf8c2a98d16c80a973deae44bf8
-
Filesize
2KB
MD519a90227070065c0db14989f0ff64aca
SHA18905f982fdcb4d0d0e931b74b151766db89dcb8a
SHA2569ddbb80db15c1cb7737631cb93a69b78dd11cb02d753519b9467768341617cd5
SHA512ed213a59d806424065d44dab89d6aa9c5a54b6eae5951bf69a3a03f87b298ed2138c18f77a672ee14060cec8e19cbff09cfb4eec76ca955b139508836b5d0d5e
-
Filesize
2KB
MD59379febe2bb7bc7b18cf8c5d4d7ec2d5
SHA1f691ea0b2d12f84916a6e67ec77aa237515c07f0
SHA256f58f23fc093f335dc851294a8111c4260337d5e427c606f0de5072c6a38e06cd
SHA5124786d5dd864f8c234cd7e69bc4dbb8a63632e7a7bbb6568731796d35591f1e1842a9b1c0cb8b0a9c063f927aca875b02237c1aafc1287ca7c5451bd2de75377e
-
Filesize
6KB
MD509fffc0930e192cb5a130e94be18419d
SHA12ee97bc1414ade0e37e9f77d987c069f4351f8f5
SHA256567f5cc4a8092be5f4ae355cb7971fe913406f5a948ca731808812a18fec957f
SHA512b538921701cf3c711f4c8e8ab68e0b29364e63f84db387144bbe1dc1d82be05f29f14f9768c012a8d86f86843d58b22f55b217f27ea16a89ea1331f7c3309d08
-
Filesize
2KB
MD557597b108878905daa7def05065a91d0
SHA1809a8b04835af41bfc9a1991040ea1fbdc9378a1
SHA25644bffcf479835a736eb41613dacbbedbcf412ed6a64b1020590f76564c8df702
SHA512caa9e067f8409c61436ca7c7a234a68e86dfd1692d2eeca57cee7855fb37e8c12e52bde69f62b94c71c6e685951e63349063f11eb5a379bd655b85ef08ff77f9
-
Filesize
3KB
MD52d168284c339c325b3c8cb916e918e00
SHA1216facb7fb00c3e56f8f072e67114466681e53e9
SHA25699ee0055b33df88d9cf372c79a13c9f4c40cc40dddbe0fc62fe296f7acbd912c
SHA51278f553e149dd5e805cfd3ef8866623936ddac9fa67a264978a762fce95e904791712db2b96b47a553d87b3907e0661d0adbfab9f5c4e277064a6a02c4919acd9
-
Filesize
5KB
MD5e53d71bd3b80a649297abc67c5bb2645
SHA1a0b7d31be0cb98203ed20294729ce173553ba749
SHA2567da001130068f1f466766221f5231763a95eb865f62de39e5b886c5eab8c393e
SHA51226265a4489521a9a7f49c97c156cbe4c0c70ec1b03c4620952502ff480e437656665f97355d857ec61e4a823d67649d7f25c65faf098d015a59ba11e6d46a333
-
Filesize
2KB
MD5b600425271b368e32f30a15fd9dd8ce9
SHA1171f9bd81518c995dbdbe2b7a9d6badd3fee531d
SHA25674c2228955d14373766b053491c4f5276b2a279e0b219869f072e89422f98a4f
SHA51297fba4f28e681885a9bb81e25071f55c3eb4b5859b427217096019819a0835b9f1ab17bf2156351a199c1a70241bb33aa4dd7d3648ce82c84b566f9ddd3013d2
-
Filesize
8KB
MD536861318f1b7073d1e1ff9d9dbefa758
SHA1d51a84a031d5529d51f6015b78eb6afced2ce64b
SHA25674730c9e521f0878498b6f11a11ca93fa236622fe41f22dbb6291a62ab20d5a7
SHA5123a479dd8032e939b47ed736bb772939a55ba4b797bfd8fb692840a4ba0ab88f32865b46715c8cf8e26aa49eadc0020127ba18bf4799cc0ed2954376d3c8ac1d2
-
Filesize
7KB
MD559a1a621cf06dfa880647260acd4f469
SHA1eb4ef62b0b75afffdadee80b18210c3aed51f97a
SHA256136847fb23bf6238257ecd82fb877b9025b225de1e4f09c6e4901a484ef826ab
SHA512e746b75ef9c574b03e2cef6ca17a2e3eed48b0dbeb827f072da5041af06ce439f8d94170a8b50a6c2e0ea408fcd5e0967ba94741042f6bcb5ad4cfa0231ea7bc
-
Filesize
1KB
MD5c4d80f086936b71d8df4b7f15a02fdb2
SHA18cc7d76bad963c8fb468845c6a42c4402e9297a6
SHA2568d956eba113524d1ef5fcdfb47bdc00b8225db7c6a3848b32f70419d9222e700
SHA5120596c9079b27eaa7146394d6c0018182f55dd718336036bc25a892834f10375c1ab9bc1c886c5c21043945c7267eafd1607808484ed488433ee1ab04678443b2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a9fb9666-6896-4c59-82a5-d646966be79d.tmp
Filesize21KB
MD528fd651260a91d7a5c5eb0c021404cea
SHA18277e01f66d182c24cc4ecbec2e120899039e4d9
SHA256adaa648ae40443e8622fb8f52b2a18cead11efcd565d54da139d4101a1731e9c
SHA512eaf67d2a77ca57a3f4ae5abb8cfb41acae41ef64aaabc963f0051e04c0dff80023de569775a23c95934ecbd5d0a9856d482433546585ca74b6c40693bf5fb6d6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b275d0d6-6010-44f3-b803-37a2e512e1b8.tmp
Filesize15KB
MD5dd8ff63eee1f0a969e54e01846e495f5
SHA1b93586060c82ed8a2d1817ffb23fdf16f4952468
SHA256e10a3e21c131ac3dd35589f864a5f3b15ab4c07148733c824dbdc5a41b60b741
SHA5121e58b224808b1db8444b67d57dc7eb19095302edf5cafec051ce166a2b25b1015201e81559f0e3b11e5641b1d77eeaaf509c0169fa5eef070c597613e1fabc38
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c7ea98c2-f5cf-4210-9fa3-aa730b6966ef.tmp
Filesize1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
16B
MD5589c49f8a8e18ec6998a7a30b4958ebc
SHA1cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e
SHA25626d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8
SHA512e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2
-
Filesize
16B
MD560e3f691077715586b918375dd23c6b0
SHA1476d3eab15649c40c6aebfb6ac2366db50283d1b
SHA256e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee
SHA512d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f8239979-65d4-4408-b1f1-07e62cd392ba.tmp
Filesize2KB
MD509ec2e7434dc62af82b9ebd1afaaa769
SHA1599f36c11a0dfdea4e1ad17fdf44117f12f2fcbc
SHA2567f85e008302dc61faaa1b204799c995eeaad0ac050504c3b8fe0c3058e4711b9
SHA5126b02f2f5ca1b1b45b98280112f67b3bc9159341e1e24f02c7116a53027915f9afa574a783953ff435a18400454b4bad5ea9018a7acac163374ead4436d86a233
-
Filesize
78KB
MD51c36b34ca25de145fd87bcd3909c4cf3
SHA1cb6ee54ba622eb5e01e55713543920896c53c8a0
SHA256b1f7e86d8077ef3797db5394e476e2fc8df3b92113fd859920e2b32d350cad0c
SHA5128048edac81159e6522a4055fc14664cd823e78e5635e83045be66d0af402db6a4f1137975e69cc187233511815cf08b5c2e7ed9c37d5017cbe9cac798afd7704
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16360.16356.1\json\wallet\wallet-checkout-eligible-sites.json
Filesize499KB
MD5d8e3873ff6ef3896a95b8295e3bc1adf
SHA1e86d59201f29cd7b7591ccc2cb0832b2e60305d5
SHA25622b903d55f643e384f7a09c67a659da7a86fd409dd1c5439b712b9735d748baf
SHA51270ace9b563ff2f6b50415ec0f2e6824b369879e9a84699b78ff764d5ff7f91ce5521add770ed2740d582fd801fe2e12a5f68212b78ecd2d7fda849a516739786
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16360.16356.1\json\wallet\wallet-notification-config.json
Filesize726B
MD589af93724226aee6fcf672f1aee1a738
SHA12f188e2fb26cd1c3e3a669e78a4b439a8006cbe3
SHA256654aebc5ef8b3fe48e9d4cfd2634b7de5172c5aaf309136381347aab3850dd1d
SHA512e1c87caa76652377825301cda123ab59af7cf73d60e54a8f77fc1782333be21fbce146edcca1b992fc6613970c216282dfb96b9a9c0ba3e75fbfa7bb6cfb381b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16360.16356.1\json\wallet\wallet-tokenization-config.json
Filesize23KB
MD5634323483c6bf97f0d946912b3452604
SHA1bd41635b68e90db709cc328307ea19d561b9b92b
SHA256ccc9802d871b81d34ce2433865ff817dbed0dcd4d8b1b4c1746d03dab714e185
SHA512bd069f141bd0d65430365b088ca5d0f33bf96ea0d5d0b8236657a60964705366f852e7d9813d56571df00423668a023162f6c6ce4fa9b4cfad5bc4629db95db0
-
Filesize
120B
MD5a397e5983d4a1619e36143b4d804b870
SHA1aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA2569c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
SHA5124159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
-
Filesize
11B
MD5838a7b32aefb618130392bc7d006aa2e
SHA15159e0f18c9e68f0e75e2239875aa994847b8290
SHA256ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa
SHA5129e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9
-
Filesize
17KB
MD5fa53e830bee8c5efa07b2264393a6f80
SHA17a5b2f155a0238cfa5fd6fa4e9a00d043039f81b
SHA2568b69282c971e7b1dd9b4ef1ca1fc54ded4bb4eac2655945c9edd9fd85eeb9123
SHA5122a18157c70b6b0b125aaf7f1591b3a8b14f16ba54b9bec5cf4d9266b0f7ef1d575a7a4f0803c8ee036318d02440be0531cc5d887830ff643c4850a891beebacb
-
Filesize
11KB
MD516aeecb744c12e877952048589bf9d9f
SHA1cf102751e763cd87e97b1d3caff36bf7186b0287
SHA256218a802b9c669252b8c40ad72548a988f5fce5b147f2a3f6e03c57550eddbc13
SHA512026e328d14cf44eda8ac0351d80e417e3b5418af92e42d83467268a5012676496c1a9111dfb1be621e0710b499673cbb5be84ccd497fb6707f3ac44515c94a78
-
Filesize
113KB
MD58286fbdb8955c150b33530c6d18f3976
SHA1fc8b5507d983c00cdcb38f987c96bf9a009ae870
SHA256d5f7e077b368a42d2deae34ac49763f042986720c676e9e90c3e7025558539d7
SHA512aa03b2c85494e26ad83caf1efb1709d5b26fe91b525020f3eacd76ff125e125404c4697e8ac8b3ad61c0dcf44f4b234442f2efa3c75079bde270567a880591b6
-
Filesize
12KB
MD5ec051862eee4b97123743dd3dcb51bf2
SHA18258335f659657a68396687e75d37e07ee677b7a
SHA2565270aea6ae75ad8fbcd2d85a2091e1454bc47cb434fc1010f8c76aee3c548ff2
SHA512a37a23dc8e10b63bae66370e796bfc344f3ed6ce32484d778c4ed973096c727d537e5e1c93ccba628a99cf2543bdedad5530bde8c1f92c7bf89726ef6a55a9f3
-
Filesize
11KB
MD5b3afb5829661e8e007de9b8885b9c19b
SHA14ec8510a56a5a0a194c2e953ea145ff35c45906d
SHA2561fff8b519cdc396c201ec222330bda0888e5540dd8a0de930feef33108e44370
SHA512c988064917a0ab608d4d8283cc398a1f545645e275bd3dec1507af2b9d7a62300a39d86f317fc2981581fe76b57a4ef4c3a93fabb49522fce79aeb219cb2920c
-
Filesize
11KB
MD5f5d15a7f90597d7c0b5918001942c1b9
SHA1fd3612f311ffdcd4ff22837f8d3612964404fcfd
SHA2561508a257515116d793c8e9d2404b9ca45af629c5da2df6ff7a0b88d305bf497e
SHA512195fec3658c4c90b7371307108701df8223b0776da8e82e16303793c88e42954924f0f23c61cf0e69b5f75bad09a96d8fd70b08bbd4f16a9dea8fe7342aad942
-
Filesize
12KB
MD597201e7af7e839dc1f7d9f0e7e58bfb8
SHA10416b2833f5d27665c525a4fd7fe555639324ccb
SHA256bd19be6427f89f9eb88883abe40cec865a2996e6aba1a5c3432e1ed63cfe9bac
SHA512f9fc7c6ffd1f1c55e1089a5eb0e95c4fdb654d7c86d3b129cd5b84b3c9fc40a183e4387022235c13ad853936114b3329912289ad043ac8f42ab3a68a7adf8e5d
-
Filesize
12KB
MD559730123eb9028929771f9f49b686d2e
SHA172253bb5c7273c52cca229696e5038536d23535a
SHA256da389131c14484a7821fa894223b69ca4e459328571c1b38dbc344accc26ca9c
SHA512857f9e1b1b5fc25f985e3f609883a8c16433412aad82512e3ed25697874b8185bacf0a8f326de71e51652c1159662221c03649ac9cc86c0a4e4f52ca8a4f6284
-
Filesize
10KB
MD5a9594e8cd2cc39ccd0f1b623460e6b5d
SHA1ea278bc07247ee6b7e3a0b43e547009e16d67b7e
SHA25649078ee431acf722cba0d54e3e3b6f55bf8b2cc2d5a0766217e9524e2c9547b8
SHA512a188ded23c99409d32cef47893bdc10efc55062d0e43f9c67a2bb9d61cfc718ef83c6698ca3ebcfc2bb328d269b0f3df59601e587b07ff62a63c863fd6eaa884
-
Filesize
11KB
MD51ae7f3e69fe1e3ce1774a638ddb101db
SHA1eade71bb27230118ee228d318141913749ee27f8
SHA256c6aff0a7d57fdd633960d3faf58e16a0a5ecb2156de58ee6c32d2c2c882b6b2f
SHA51203b543f3a4ce33102fa714d2fd3c8941f39ed29192830ab453710a8320a47a741c4e0d878d3411842f27dc997f5f0f7d894261914c28508877e90854d0b5f438
-
Filesize
12KB
MD5f940d05bfc415e2ec87a0cc79b731b0f
SHA1eb1dbd5f0d408cbb5abfac12b496db3187ba6019
SHA256381cd20f116e51bd4fd8021bd9fa5b0408cde5acf2082ec724dd90327fa0ed0c
SHA512c569ed61011e43c9226e990ca03624c75a0dee747354602b46df816ab6a42bbcdf70a2c6c2fa440e189cf45b0c36405b115ad9c4b771cef5f2e8b3264561e8bf
-
Filesize
11KB
MD5fad89f6958022fb653ae98e2eb5c84af
SHA1b85ce4fa6e33bb79ea6882facb5458e668b42a20
SHA256310530e6c3b75df296c231c2030c45e6923b1e8c266a3a36fa0df312129dce9e
SHA51216ec04b1fc12a8ba3cc5ecab3e6b2f79c6628ec40de6e143b64ab04d96dc70b8261025e40bf9257fb9478a8da90cddc914eb217a5e6649d37979b6f1485f4ee7
-
Filesize
12KB
MD5d0b554c9c29786e68a390d85f735d93e
SHA1502d48c1f36923f859d53339b1115289f619d7a5
SHA25674ac425d4567074ef6f16eb2f5f744294a19de453db745ca1ef07e50cbe2e11d
SHA5120ec93990367af26f04970a0ccf07125355fa7289023b60406f3636c2cc585bd41ef97eb94c6f8df4ff17365dbead7f24685b099ba7a3bd898872ae2ab794de10
-
Filesize
10KB
MD5295e908129f0cefbfb1f59826730a3df
SHA12afa982945b8b557075729380a8b0cf81136d333
SHA2560ca8f8da077e6f9e9371a06e8422e691abfce475d4b5227a5da32a1f6390284b
SHA5123bb2cb10b08159b42a174bdba03a197d5a5c5b0eee579ee9f621ee7df8c5b33d47a10fa852cf734dc1ef59c9cf27b313c3787fd9d6c81c03dbcbe410cf249091
-
Filesize
8KB
MD5df3d0c24c13d6bb5ba1fea8aae9ece1e
SHA150b188f51a2ba56417302d3fb8badd31d082c7c8
SHA2561ccb203eba2efcfe9cb02d812c91e5c0d1ed29aea1668cab497c57b80a9d0a5a
SHA512e7817df45a9235a2ebd929f7e6b625f6f21025485a8cbb890fcfb6bc328669e64cd83cc96e108a4a4dae613c573f5a8df8106d9cdd46cf298182f54a4f7c1e85
-
Filesize
10KB
MD52478e75e6b18d5425b33c0f0de3eafc0
SHA1830d769fb5ef590048b9df46e50cb81ba50881df
SHA2562a28188e0f393c6d3a1e4f1c960d459ba8eb3fd6e7eb8f7945aa2c46e64779f7
SHA51297d7f3e8bbcace4495661f7661d8bd8dc130b3d075e9e5687b9b92cacf113c383ae4cdbb63785dc589ed9037fb3d02845f1a68dd4f230f1fdc6d28bcc365066e
-
Filesize
125KB
MD560cb210fbcea57b8fe7960a181fae083
SHA1fcc62ebd03bec2bfa84e55d6a1a89660d09ce1c6
SHA256cb26cdde3d8ce14fdf5c7adff4256ed1d2b30837f03896248b1fef5f1bef48fa
SHA51229c02bc48a176d5850c43c4ac75a75f138fe36357abac93934dd6ded0134c49e201f45da892c87f8acd483dccf9d8c4676d12f4feb5a4786f8134a340337e9d4
-
Filesize
3KB
MD517c10dbe88d84b9309e6d151923ce116
SHA19ad2553c061ddcc07e6f66ce4f9e30290c056bdf
SHA2563ad368c74c9bb5da4d4750866f16d361b0675a6b6dc4e06e2edd72488663450e
SHA512ad8ed3797941c9cad21ae2af03b77ce06a23931d9c059fe880935e2b07c08f85fc628e39873fb352c07714b4e44328799b264f4adb3513975add4e6b67e4a63c
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
9B
MD5b6f7a6b03164d4bf8e3531a5cf721d30
SHA1a2134120d4712c7c629cdceef9de6d6e48ca13fa
SHA2563d6f3f8f1456d7ce78dd9dfa8187318b38e731a658e513f561ee178766e74d39
SHA5124b473f45a5d45d420483ea1d9e93047794884f26781bbfe5370a554d260e80ad462e7eeb74d16025774935c3a80cbb2fd1293941ee3d7b64045b791b365f2b63
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Filesize2KB
MD5499d9e568b96e759959dc69635470211
SHA12462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA25698252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
SHA5123a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
-
Filesize
896KB
MD500b02971a4c34f421585394577688e46
SHA13fc652467a879a93a913715f725b50cf11339cb6
SHA256e3c91ffac8d95f58c0d30201cf2b1034fe91cbb79a67efdbb83634ae52c51d98
SHA5120d76cd05a8af06d97e08ff78701b3afd695f1aaffaff11c7f8439efb448fdf341dd5d31c72b434c0ee64ed9b891d202ad98cba9b6f4b7baf672e747625316ccd
-
Filesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ob75hbeb.default-release\activity-stream.discovery_stream.json.tmp
Filesize21KB
MD567e30c3aa717e85cb4e0677c5a03830b
SHA1f329f74a3ee89590c9cf352fd394bacfe49a4865
SHA256e3ef7f9c8027fa91809f6b724fa6c038bd9fb061bf28146b467c2de818023c00
SHA512298d09f14fe3e1c2742ce4e65def15d7e7bb293d853db1ab11d33ecfd818d427111104b4808197bfe786894b0506da4446a91d8fc86c7ba507b78437b2fc402a
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ob75hbeb.default-release\cache2\entries\39966F26CA88F8CE2B9879F89FA1B9B78623D7C2
Filesize24KB
MD50cab5694b2c39886c2c759174408810c
SHA1e40172160228d0afd17c16e70036300843f5d119
SHA256a416f4e8f5852c75b0fdeb9d7a3795407c62e5dd907ca9242e12cf5a9a575c60
SHA5121a3e7b15722f4ebfd4d0c79dbb5c9796cc9e47c79a49836995535ab7e3ea4f8e59e0485996af2c23f0d9f4ef7e71649b0edac6e4dcda189ad5a0a670802695b5
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ob75hbeb.default-release\cache2\entries\3A99F3F867164017DC8AFA089A3AA9DA62096A39
Filesize101KB
MD57af556f434763a881c0e6b30cb5a8ade
SHA179b34c8e84a05d904d3249791aad074b33e97473
SHA256ab4b94a8ed488dae2b483cd3e86af22cc71d5dc3a4b4ed01b212c88502d61129
SHA5124af0fdfbe485c3d038b71bce745be4fd02c9aa971317736425264db44b06761f7eedbd6a51689549602eb947733bd10aeda09aa6cacf2c3479234a9ed177e44a
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ob75hbeb.default-release\cache2\entries\B3CCC6F47940A30986CDB55AABCE5925AC3B31CA
Filesize13KB
MD5e3529cbf698d3ac89b9aba396048b9b1
SHA174ea3c4134f0fd4f3da75c7b584637d2658d6d27
SHA2562f53cbbba6778bcffbc7c269502231dc311a355739bb783cf5c5b0e90c61b641
SHA512e95a8277d380528ba5b0baccbe99954b4249f0ff654251e62c374037f605cb53e19108414e9d5ba9e77547f73db5b7e439b019630b4dec0ca18ca18c65c71a2f
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ob75hbeb.default-release\cache2\entries\CFA7886BB16631ACE4537BC5C8565BDC525405D4
Filesize120KB
MD5a45155b3bb6c7a28dda5eac094a52f7d
SHA1895ef4dd9c3dc2ded0cf7a148c50b917eaf6ba1c
SHA25683a7348a29b47e6acc55f9cde809320e62cdb33a0b9e3277578d9143d908b912
SHA512037dab261dad88dfb3299aee23d40047d6323e63111e2f7f04e13bfd099e36ac4bacd98ba1fe0d6b064bb68584fef153c547dc75048dc3a3163a1ddf39ec330c
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ob75hbeb.default-release\cache2\entries\E0C18544C2B507D8221B9DFECF373824A3035668
Filesize109KB
MD5f66d6968a8da91e1069249f9b80140ff
SHA141a01c5cecb867e45c87658907443e771edcabaa
SHA256a85928ba8529e8b3c308bcc49dd459ae6eb93c5a7d4daed11fbee817b740dae7
SHA512f1bdf68aa898cc62192c7ab3748c9fdca766b8700596468ba207a1ab1fa09c686aab88551a919254a382ab43fa078358f6190a471b0e7f2ba55ef5eaf002ca01
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ob75hbeb.default-release\cache2\entries\E9D4422E9CBB6794E0466CF756905FCEB69EA6A4
Filesize113KB
MD56afeaa52ae9f19c2615cc768836cc8a5
SHA1b56e1c3b415a1618fdd7c5709e2f0c2f5c28bcb6
SHA256d582e1ffbce013c33fb72b130ada23261109712daefd906456ac978dfff6d58b
SHA5129803bf94fda04d9b3c23e1dc41138c3e670e1726b0fc607cbb2a42487714d917a554bedc65be066452b31f6ae5ddd1455b336185a7a49378361c9a1f53a4ff09
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
240B
MD5672c69f28060c5d07bf140a437f11de1
SHA1d7868554e98c24e819e7b0ff0c3f13b6470e52de
SHA2567389cdfe19e0d2de639965d01166aef1704a635e329887aed8ce21adc7f4bbeb
SHA512e63cabfa33a00a527cef516b780177b52fdc8e4c35306d8b3cf8877e6581431df46ec38ea246dcff37f880fb56dd7bb0153c3fc016b6b978dbf65c7bffee6a2d
-
Filesize
48B
MD51fe95e7f2429ba423a2844312c71a115
SHA12e6fb3da61a846c0a473dedcec9a55734993ff3d
SHA2560f0f9eeddd4f73a3ba9e3dacc9f07ad3c9439758d09ff0772b3f9771126da2f0
SHA512608b5040929582e05b7e2f365d005f7010eb112af61cc1e0fed6c0381b9b0229db34e2a1ce3f230fa1e99ae5246ba6cac661db802d11fff850698d19be613e99
-
Filesize
187B
MD553d78c860595d4a80df62723916e35fe
SHA196c1681e7f01646561cc34105635185105f16cdc
SHA256fadd70320bf4be1e31268c19fa82fe6e60b1fde0440fb37bda5d1cf50be56bd6
SHA5122b1c6e0460f0ac0de4ec51744f0a3ad64403286b9c0302cdf98cb85718205b389e0a7213418eaa84cc852a5018e71295952eeade136ffcce5e22cae9d123d5a8
-
Filesize
59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
1KB
MD5b4f8c805a46b9a1e80f189627b7e2bbf
SHA1da632417c4e5fdfe08c2b39cd4919a2358ea02b2
SHA256a7a0dd46042c80019605cfd0eedbe1b55a7c932f99c78b50b3b13d8d4fc88255
SHA512f0abf0c30953658af3f1490df0e51461215b8ce41139ebce998ccfd32de994e7c42a6e5b36aee1226152e95f9b8fcc31ea8a4f9dd15cf6e767ab3b3a0700c0c9
-
Filesize
1KB
MD53007a4dfb2a1016d5f7abe940853d988
SHA1f77b34652f843b5ea3b064c7f23e1eabd50a2a06
SHA2560c104084c87dfb0040de856617bf668aea1ad83c60e386374efa820aeb6498aa
SHA5128d214a9d089090c63ed4e4a75598049f82f50fab2b66c82f833fe28af658768c9bf4d064f2a5717ede4139115a006a0989cf1e4880b2007f5a6ca77e20bd897d
-
Filesize
88KB
MD5538fd28f7b013bd2f143fd07aba5d19b
SHA11c7dc1444612792f7229af2e1dcd6f86eec2d502
SHA256069a81303a634e8cdd8c76719d05a9446cd53957c0eae5e0e8c88c94feb0b640
SHA512bb6790e06701993a0d226a6c5a4ed390d47202dce67a0a05247855090abdc8e09c4740c1c20cf13bb4340040aefd98dd28c342fadc4d2ab50b288b7c2cdcd16d
-
Filesize
10KB
MD57aa0c0b17feed14023c4fb189aa6072d
SHA10b571b13f28afcd96915108042beb13a623a3cda
SHA25678ad07bcacbcb23c274d025f38746ff766fa4eba41ee1aa68c238e329837dc09
SHA5129c0e3d35eb32e8c1e907c6d1c45776235e31b979c8be05767e6802186eddb4d9ee337972a39e150dbe1c464e8ba391f401abc69fb41700da4e70e2ec624901e6
-
Filesize
165KB
MD59125ee7ae900fb0c62e39623696ef03a
SHA19263733dc8ff79062204cd9c73c7f8846f3e7fce
SHA25692b600273d902d68b5a6cd40dcc32858b0a0ed03551d47091ae87f8793a78886
SHA51223431f09372b43e871b05a420caf20ca286ec3d816007927ec67d4b77cccf4e1093f6d4e8ce127dc5bf8c947924e57612c2855469dc30a20dab983db73505156
-
Filesize
32KB
MD5868371404a71960ea4d9fcc3ae0d12d5
SHA132a153308ef92b9cffcce3ba0ad1514878b68dcd
SHA256523f4ebb278b1787be8cae3e650b1bc5ca0f0c005ec37b7aae7581d911620642
SHA512b96279f578ac4f307337b133660daf7c2e4a304ed4d6d37c778f61bcf5fabb30ade7a84790bd68efa2c98345fea231d9cc8bf9d8a173120a1ba64120541c0b35
-
Filesize
1.5MB
MD58b3b487e9dfd2852b5c8634b418e7c7e
SHA145ff4beb4125aed9fef91e88c03e93b8853ddeb8
SHA25661ab4d9e17954ad9885736ccd19a9a7e809105074b59d12ab78f4eefbe5d9581
SHA5122c041aeb5decf51134afbbf5583ed4a23d92ff5a7bcc35450a07f123b9950a57646522a5dcb34089e118ee353ecd1041e0eb020e55f9b9f8e67bb35cf519295d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
146KB
MD5cb6db1fed2da243529f80411f8b25aeb
SHA10ceaaa98c45ca42b8aeef24b001bfa3fff8eceb4
SHA256cb0aabe8bfff9c02d13f1a88c9fc01644134c3cba9421ff110140fbe35a918ca
SHA512743875f33ab5212759a0242159b08578921b79eacc31c9e1e14c795b6dfa47fe48904c081c7ee3252d72dbce315959354bcaace638afc11176faf7df45bac977
-
Filesize
150KB
MD53614a4be6b610f1daf6c801574f161fe
SHA16edee98c0084a94caa1fe0124b4c19f42b4e7de6
SHA25616e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b
SHA51206e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281
-
Filesize
9KB
MD50d45588070cf728359055f776af16ec4
SHA1c4375ceb2883dee74632e81addbfa4e8b0c6d84a
SHA256067c77d51df034b4a614f83803140fbf4cd2f8684b88ea8c8acdf163edad085a
SHA512751ebf4c43f100b41f799d0fbf8db118ea8751df029c1f4c4b0daeb0fef200ddf2e41c1c9c55c2dc94f2c841cf6acb7df355e98a2e5877a7797f0f1d41a7e415
-
Filesize
6KB
MD5c5b9fe538654a5a259cf64c2455c5426
SHA1db45505fa041af025de53a0580758f3694b9444a
SHA2567b51372117960e84d6f5eb3a26810cc044ff02283b3d656a0a456b0ab5cb8ea7
SHA512f0f8a5570c01b16e54f47502e867ffbaf162b44a847c0ffc8062d20e9492114229de5d9d2a836da256fd3f9fb493536bdbf148d5308695b16c0e98d20d8926aa
-
Filesize
4KB
MD5f0438a894f3a7e01a4aae8d1b5dd0289
SHA1b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA25630c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
-
Filesize
5KB
MD5cfbd5977d307b56832ca92ac0999efed
SHA1e602dbb36161976e055532693433e811a48bf61c
SHA2569f5f3345cf988a4c15872cab84efeea9791ae835a7d48296b12d4dfdbfaf9937
SHA5120c2a45a73bd7021852b69d30a297e7b67fd3f26f04b675151e256c97865186ba0e8ed28a7500af0d02f3c3842c8b4d7b81e6e13a0891d6667c87608457c5ca9b
-
Filesize
13KB
MD5826b388ae77158fb430eef40d09e20a4
SHA18e121819c77c950cb13767a0eeb76cf19e48eccb
SHA2560a2387d1acb456406dd83fba1f69cb48532f96a7aedf2e9e128229c66dbaa075
SHA5125c44c30861b8f2045d0ad3bef298f84a9404ce6b3fbaef8139cf603bff9cdc878b0f87d6184d52bcef7ce7d162148fd77d213c1f8fabefa49d5eed0d88222027
-
Filesize
20KB
MD5345b6faa62a50ba996a4fc52a17031c7
SHA17ee131c8c4f836e9c88764197da34a5a9dbe7d97
SHA256e994184f10c979ec8d3e0ba11d3c95322b0f846fe45d0a56afc2afb35cf92d9a
SHA5125eadf9edf82b83c2c051c6072b7d31a711bac17513dfb452c25f98cfec00fc54fef0e54c29e60d5de8813284bde440b4f7843c5cb07d2bd9014b0610e98a9347
-
Filesize
44KB
MD501e912f4dcc1962e4caf95cf06824bd6
SHA1ca38906b61417a495ab4a99f87fefd1fcea27b68
SHA2567de65937b8b6dcebe11e373630b32979dd51dd642f5024c398e235fc603683da
SHA512156b3efc5656164c06e60a7657829216ce17c607a3ac82858c82ba8c886919b3e36d54df101b5387e5eca967672d30aa0bd081ba9ed322f407e7df45cfa6511b
-
Filesize
18KB
MD5d3e82a3a0a0f6b3376aefbe411909ead
SHA17a819fb67e3f2847c667490d65723125850881c0
SHA2563383fc788e3e7c0bd856c225b1007bb334039cca9d1f6f193a1cb01e3b87629c
SHA512d933cc2bd25726cd99463e2b6c4fa4f84680f5051463231982fd1871d702a0d3e14a99593810260000861ae446ce3a623847f70953655e017cb03daedda0af7c
-
Filesize
326B
MD54da4fa1750d556b5e9e4f864802ed0d4
SHA1b4666e588b0656ad8a9d2b47b844562842b6fcc1
SHA25677c1667039733bb39327365e36895eb9c6b07d6d7aec52f00c52ea3361a40385
SHA5121fa57ace50897cb8731e22221e5abb65e33b1f39cb2a8235c9674714ca4fbd625a707ccdb9a7d23f82f59a72a9095b951b0f44651eaa9c2d045e068b502e5a6e
-
Filesize
323B
MD56e4aa7dcca913b01224ddd7c320f3916
SHA19d755a94c143d78a874c65cb39121a7d0ec4bb67
SHA2565457c4674c25e341a3ad3575c67a6e133d82124e7b6e3599a3c562c65713e9d2
SHA51278f84de152ae98f336a717cedef15a26bc6a0c8d9fa650f5ad3a08b9af36a74813e70ce2eef4a9af1ddf7dba69a42f4614b07c37340bfe1c141150984ae3c483
-
Filesize
13.5MB
MD51f35586fbff67d44bbd2ba58a1d84a68
SHA194e6c1e2b10af005323f495975a2555d80f91b09
SHA256859198284bfc123124021fbd2187a5b96c4f61e3e7fafff38565228713a91ce6
SHA51207829046c79aa5fe30df58c7b98fa75d2c10f37dbea898a87dda6202aec1b603dd9e7ad0e9788bb112c756dffa0e2d02f1053a723b9e6aaed140618a815214ca
-
Filesize
429KB
MD59f39e82bd01d49dfc12fab3a850d787e
SHA17d43e8a001904d6ce56c3f2ca638ac6cb5a3c576
SHA256b320b798daf29330581b135b62cdf554a670a09a6af8502935e9b1114ca5ae33
SHA51288f5488efe0e5f6fe3bc9210955cd27c54211a7c5bf3d0497ec8deca722db185d18573e07b005d141addb94d8166c9b101567306dc9217559feb3bd342145f20
-
Filesize
22KB
MD50815950e3ce15e6be784b641152cea80
SHA170e1bf60dae535dfb7472a06e392ec07b855f1db
SHA25644b0cb671a7eccbc5c4ede9a02d8fa88a9b7b47656d9150806ba51da2b2bb8ee
SHA5121cd16c6f774498b3b3ae525d39df9fa4a380d78cc8ea4bc43d3cabf3f7f5e0c5966c4e8b3b827cd1aece753230769584853e045120f7cd134bb1086fc969977f
-
Filesize
40B
MD5be5966dbaf7f7bd4385a75c164a5bf24
SHA1247dc70cac5ffda8f51802d84a6dea059b7f76c8
SHA2565001b0cf6f89254181dc9edcf1314ef8f0140d4d8198339934e4c3c13212b72e
SHA512f2e6e22ebe6f44e26fbdc1dd10d3af86d20591d8b08212e3f7d412cde01148e0b399b3f4b9c1e6b148028343271d49f9a98eeefca6ce997e110dd714c05185eb
-
Filesize
173KB
MD5dbb809c9ed271936f6842f22d0647bd0
SHA10276c592bacba0d2a3aacce241b3340c46a13f80
SHA256b40ed97fedcf048b92224e3c6cac62dd8286732e7a945cdddefc49d8cf5bd398
SHA5120e7edfcc08cb0969aac0e07461736a85e175ba8652c564924140f70d251dc0a7ab0da26a6d1411ce7070d45d6c7a95d0fa9f93165483cd6d3cd33d5d20d85f22
-
Filesize
264KB
MD598c547d13dbcbdfa5644ebec5c4c0b0d
SHA1ed2ad78288e008b291c76a6021385822bc0c3863
SHA256c36f2cc503ab38a5c20c522a4e8c833ac7b1cd691fdedb22099075ff88718b04
SHA51202cb33e6750bd38023a38900ac0ec7335852be790d3c11f6aaa255ad691bc1c3841fcdb78ecf15af0c9dda48504ea2bd7069f2e2e0428e8502078aa9eb554e08
-
Filesize
20KB
MD51e40d7a51057050a5fa5c1d260799624
SHA16de4575bde5ebbdb5e4b807aaac433a99558d558
SHA2566fe908ee73580f155bf01267817259281d9d1a39036b0aaf35ae98f0106e48b2
SHA51206694b46b4a6e579e94b8a5a00161d4d58689a0521b203c8da340b3186eead82b142a8fdf3027be2b863da5623dbf02f56373ceeef4eb7ae7667b8f992464d9f
-
Filesize
52KB
MD5c1dd4de6f5c15d6bbfe624ef0824e163
SHA1a0a956904d2644b279bb7e6c95cc14bd5048fd05
SHA25648ea954df72b56e6e7bbc8582cd6d4b9db03191b5d4206fe76956b843df851eb
SHA512bc24eb4e84d17a36677ead2c9cfe1b4a7949e4cf9b5722313599cd920d287f5c02e4b632a76a093fc7a33b6fad6268a33e44a6c933518509a21cba7bbaf621dd
-
Filesize
128KB
MD5cbe8b0d05b1fd1ef82e7718670401da4
SHA1243b0e8e46ebd7bb7cc3016c074152d6797af4b4
SHA2568a63b8b47433b1a3b86b6e0868c34153f8ed65f2e26e3b5cef1f6a7e047a9a7f
SHA51240e4e67f995058b86e7606f473271771f4075ad6a2b4dea759222fa32a8e8f81afeb6c634bd1d386def38fd07b148605967d018a90d3b5042072bbfbc86ea256
-
Filesize
19KB
MD52d4fb0e631a203dbaef6145f0cee60b9
SHA1bb82e6548c9813132a19741a73ae3804a33712a7
SHA2567c8b12216834a76c7c40188631db5d0c3ff09d437f52a3fc510b1baadd147558
SHA512246243d454828632b1c3bec945e70e96a01b1840489ed048671b0b837c3f1e4bfa6e702e69d51c22c641d35ad2a48a3224f59e23555e0e594379fc3884710f6e
-
Filesize
98KB
MD522a1e0a092410ba32693d49a5ac00ebc
SHA1213b3913759a9298f41a59f740ed70af407c6771
SHA2565491a875a61479a0dee5c9bd9c19fdb7c607c40f6ccae771d8b54fdb3e509560
SHA512950e0802836114c145cc551d8eb8e78935df5fdd047bd9a995f9b1e2c602f34d9c187c1986c5d76f90064af15ad71692ee2390b5c8a7372bdb0113f57d9f0129
-
Filesize
44KB
MD5398dd3a9d459e13010d7f3e67eb2c67a
SHA1d7d2f27a5c98e7fb125ca05b027c46dcf83612f6
SHA2564e88293eca6be20ab235e0b814a550ead53c456e75f255130f52f135973989ea
SHA5120f7976c1294159624bcbe4d593e81db6a8ff81820fcd03a5b4d86860aaf134bf0b881c757f452e05dfddcfa3719869aca546e41649185e747896e8be911aa4b5
-
Filesize
128KB
MD55dc0c0c9b1daf1e03d40a3f6f235a6c3
SHA1852205f962e8bc23c308b69b26cde7111692d1c6
SHA2561460fea0db5982ad37b075b0618ea1e723cd37a5e0b90e9addd05af4dfb69a76
SHA5126cdb3ba02bc00cbe1b349e72016e51a5f66e84789e2c263bd8ca3a7cbbd86c093cde265a6abdc5da0ea600aa91bf6041e805113cb04b60b7b0e15001126f4b13
-
Filesize
23KB
MD52cc01cb163cae4b5107b8baba1221b9f
SHA198f5b18d408af37364e72eb956d6e5f9d4fe2fc3
SHA256a5053ebcd1d5df944de7501e202e69721b58b53b756cdb8da92721b48f1e5f8a
SHA512fd1a99aba16572d35b4eadc4e7b58557644d26c328afb910dc9b5b4e36d9d36631cbcbd06a05d0f0956bcf80ba90c3cb09469c643344c709663dd278687b4203
-
Filesize
24B
MD554cb446f628b2ea4a5bce5769910512e
SHA1c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA5128f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
-
Filesize
384B
MD56924a1b3ecd425e1789c3ddd8c88fc35
SHA15eb1a6f9e004957b7424fd3532b634307f05fabd
SHA2566fb20b210a0008420fff84d5f6d8b8372afa215934d886e8def1306d2b2455ad
SHA512fdeb20b7bcb3ac42cff2525ceb38447d2b8651b9d0c56021e598f453de8e402f4dc76b25ee12e8881c5f66424c7e6107af42add64e715bb4b72ac1fe5061e823
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe6ad96c.TMP
Filesize48B
MD53e4fe7d3596bbeacf246dc2b494a4c38
SHA1f195a7a9c5c3ffeb3954a988895584b75c1fcc01
SHA2560fd6fe4b4385f9410609234991cca47ed3c1b007f4959fcaafa3ca139de25c22
SHA5125802c2d643bd142752e29a3a4b451ad918af30d63a47b8970d9a2582ff014d18da22d22e32e09a9611accdc014b718dd9a6e2c249d476c9b518b9b37e94ce38c
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Extensions\hbgjioklmpbdmemlmbkfckopochbgjpl\1.0.0_0\preferences_schema.json
Filesize7KB
MD5a192304f63ef26c80086f835cc4b7ada
SHA16963e90e752209132b728a938844c4c64dc94d43
SHA2564f72309f9378f04b3f1cb8f46b031ff513ac63e5056d96272f2bdc6d39dcddf9
SHA512be619909cd0c3465966a4018847310c1493bfdecad6f07bb28293f3dcea73dc377f5d52cca040d626368e17828eae28384fe51d20c4a71925c5f31eea8e18561
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Extensions\mccchmdkmjpgjlhckmbinjaioihkcnkc\1.0.1_0\_locales\en\messages.json
Filesize162B
MD5bf28ef9468e4e1cbc5f3e055adfa69e5
SHA1d5cff2ec3851f3fff649d688919f9f4f8511420e
SHA2560e86dc475bac19122a3134a18cf8af26b83831df3346bcf5093739ca2891b4b3
SHA5127b37e27f56b8ef1aeec6f25bbe7336ad0bec837af4390e47932adc67c9ed873c6b7cb5d643b39d0b6f383d79c7ee0ab8aa39e70f894ce8f2b90a884d1325c3f5
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\IndexedDB\chrome-extension_gbohaofhodnpniflcnancekmknlomeck_0.indexeddb.leveldb\000003.log
Filesize27KB
MD51c5a2c8f1c6b69a27071dadfdf11ed24
SHA1d42f328775811485ba4bbf41b19f7d549428f19d
SHA256c63fc2fd5456bca805548a4e80f9d9f1210fdb251de12d9fb2890c31f3e185f0
SHA5128bddbfc4b2d7e11188b4cd955fa93e90453df535c13b761c8dfe4fb4d7ed477701cacc5427176128883ab5ab574f55880146081b934557c6891334b476af2432
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\IndexedDB\chrome-extension_gbohaofhodnpniflcnancekmknlomeck_0.indexeddb.leveldb\LOG.old
Filesize444B
MD50204e005b0c2df1fa7b9c8eb071206d8
SHA13251dd3b67d22c40017704e4371d6f994c39ccaa
SHA256f9b1d809c59360bf00e0daaeff029523d5b91f4841980772ca86371f010fc5d7
SHA51295bc0759f2059f22cfa594d37b65336457f192963d5b97049234b501f30bdd3b6ba2bf8c8b54f83a3ea0cb89bb0a338ae13d46c00b7fa151b9485c281c4866f6
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\IndexedDB\chrome-extension_gbohaofhodnpniflcnancekmknlomeck_0.indexeddb.leveldb\LOG.old~RFe6d6ecc.TMP
Filesize403B
MD5246551ec70d8ec930030065152181fc8
SHA124b327b2206536779719f2e44604624fb9a16bf8
SHA2563b2bbcb6760e85656b875ffca0d8bbfa2ce8a08933d22461bb77ed73acd97224
SHA512e606d8193b9b7e748285a4768c78fe3663e0b254a46a4c1cc1bba6e487aa9c996bc3217a8ea2cea655b9126319ae92dd003d110f217ac3f7007e01cf59232292
-
Filesize
12KB
MD5a6759c3d6d8a884ee7d5bc19cf00e468
SHA17936a4ed9e243d360bf5aafaa04792132eb61ef7
SHA25620bea84ed0ec71501dfaa4c4150a4eb52c98681c14772241a114919ca7308d21
SHA5125bdaee00b45d3b07f5088f020e97c863a46c7a5a05aaaee210c2cb7ae281fbdcac031c24230e9ec8438f23e1ac5b674f4a3b649ec34fcfb350ffa9dab8c8c1e1
-
Filesize
3KB
MD58a1a940f9e3fbe0881963269066dc1e5
SHA1ac017897cf987827d4750752d629634a494b65ee
SHA2564fd12acfe6b3b711c68e793956096bdd3fcfc23cf52662c2e5a0f5bb358621d1
SHA512176a39b0df1205e0f6cf1e974143b25219cf3d09c0f50aab956c3a67139122827194b7f3dc6ed222432aea23f95e9fa98a529597c3814d5a53903bc6f059fddf
-
Filesize
3KB
MD531c4e6fff093ce61a2516605fb0f141a
SHA165312087a714776f0814c9e5ff36ee502385e6be
SHA256f2f24e60994cc31db440db28384c4f2015a498fd7b5195097beee586e85c4a51
SHA512c0b0f9a1927b155ec183cebdcd2fde08dd3fcf4a6740f4c8e044c0fa5329db2b10e27ca3825f52cb6bc22fb6f6bae6d9a6802575016ebb20f36e1d1ff5843ec7
-
Filesize
1KB
MD58e27a3894d5937c3b03f4625e161889c
SHA1891163e5fbee85c973bbce9389f045d308c4b755
SHA256e8afa947dc28c20fd84954966850d4623794b89d8fc9c06c16c1f77a4387ac62
SHA512fc33c52092fa449e9cc2bf654a8460cbd5b1651ed5dffe003060bfc3446f32a257d6e47078025ce829dd312343f361b1aa3420b54f9325978e3f014c25adf156
-
Filesize
1KB
MD5ce4c002f0b60e3cef4f5ef8f4c3fdf03
SHA11dd9e2cc8c799ab26a00b385910795c761ea3797
SHA2565874e8b6be82dd80e5cb44486886db931b1a60156fd1bfd3a5e9bc7412fdff0f
SHA512eba67f93b34dd56bb18eb706560a75e1de56efaab691170c924ec573560ce45e0c230d5443c6ae5af22c91a99392c004f14592be8f207d25e58d1c16cc39ceac
-
Filesize
1KB
MD5923adb74a6973a2b29178c3c77e73136
SHA17ab8a37ea774c1404b88510d768c903364c80e0d
SHA256bc4892cc211c1d2d9c0f856976c223ddedf2a979863e70985c3934e5dc04b954
SHA5127310bee6f6db6bbb21cd06afed3a8c62a847d3d6135dd293a15642c0818e5aa1a3cff57723fb27cb65e0f0b72e710cd21e7046fce13b69b96db4a5fbdcbf5dd6
-
Filesize
1KB
MD566bb06d06d599a68ae78063195a7a46e
SHA17bd5c1e338f7382bbfb00ed840eaa47930fd1419
SHA25659a49b410e3e5c77cf94a760168139795307e6fe7d0358b069b263edfb810a73
SHA512acbcd8edaef05e8f7762db7dde875419a78fada8303f7151cb6738aefc46f185aa49dac515a3656525641942e7cb55fb76f159ea329e32a0fc55a69d9e44ce1c
-
Filesize
3KB
MD545826f22cd224165f54c938dd3fa6330
SHA1d5f6d5a36a266fad3c0a9766ddfcb06fe1ca65de
SHA25623bcd105049a78c2e1de6d20228cb0045d7faee5c22435aceb9c74fbea01e9cc
SHA5126ecb1ad1eabf1107e060efeda0f6c6dea547811aa4069ba32faeb15f8b5a57e9450210c0f27152c049e024a8a1b67191c6250bbf3f308322e1a17b8ed1cc7837
-
Filesize
6KB
MD5b26c8fa378212262d187be41d18e92d2
SHA1e9893136652241ea106fa7aa879d1246d1352ea3
SHA256c6cb6c35431fd7a91f77e26bcf2691563581f59a1198ca9604f713af9e25a3e3
SHA512ec139e9b75bb7729f1d51e40b49136d70fcd9d5db7490722197f89ba37adf626679563b422475071210364dbdecb464ffea606d7f5bcb911bdb8d79bc3091aa2
-
Filesize
1KB
MD50e94e120aa595153d44d88581f116106
SHA1561121babbd6973499ab8670a8ba5c207603ca17
SHA25681d0ce2c7184f87fe4bf5344735c834a22016cdbc4e1fc0f9e62cbc4c09175b1
SHA51290c5ac02ed202401d67d5863d272718611312536646a21e398d24d435f71b3dd100604bdf6e098a83accc8dd4665646c001b457ab2a95cfd038cf3819a863213
-
Filesize
6KB
MD59ee82502f0c39bd47cab78a55965cb5c
SHA1220a54379532a447154223414cbc350e458cdc2d
SHA256da88a1b8fd2f164658932975ab2587cc13ce65b269f25c345283a4d5bcd0e4cc
SHA512295c9e196d8cca967329b773d8317a32b7e0f0126608be628ed016577ed4d621f29e34a34043a33953ceeb10cad49d4b9467001c1a183a467ca16c2d08e5887f
-
Filesize
6KB
MD58b74628b2d578b463664137ca69bee9d
SHA1330abadcf923bcae3a82d73578d73ce9f97590cf
SHA256ad5f81693fcb54b3fe8d16695d14581f4948d6953a396bb3f422882d2aa07391
SHA51201ff2e17abad03561a18ae3227490292aa9248a3a55ea005637d811d7da67a26d9b89433d31f14e13891bcb79878905be10abad9f8d38f3b78305a1c5d323ce4
-
Filesize
6KB
MD57e596bd783a4d68a22fb42ced6e56dd5
SHA1539c90b6eac1ae98c252eda3313e268b4045ee41
SHA25696be95c44d48e523ebb63228ac5bfda41e4551d7a8b37f884276fdbd77de33b7
SHA5122bcd599373302858df97320a080bbd9350acfb8b84018c7e36232cffa5e2083a239b4ea57da276b7756df29d25e190158579bfa5e7297b6266bd00ca90c25638
-
Filesize
6KB
MD5651f4a52f9cdcc0f45645aab16a3959d
SHA1d8322bf69f47c253f045b70e8f7c64fa874a7c50
SHA2565e320d7c6e5a88a37cf2437b410a68cc3025e2a5b1e66cf6c6889584c56d069b
SHA512fcce4ca54a7839eb290e59c267c1a91f6b2ef6ea737804b267045aa4c2e81486e688042c9d296e076557d248617eb665e2b7fc5ff9adae90190edbc5ecaf7027
-
Filesize
1KB
MD5e516e7f5339b0220d39e6646ad299336
SHA15205f2a10d36e21d53f12e207ee87641e2f9ea98
SHA256ffaa4e71f8360643c3600a03f40de6a7bd229f154ac9247d4d66eda989119888
SHA512cc2c934325009b9f0796d6fc9f8ae8d3b59a7d51f96b13b6ff98bacc4684b896fbf51c0f7e9ecaccdb403bc245f2b8a014c33853ed503a9e121e4a75da58c7b4
-
Filesize
14KB
MD51666e3421606f74591e5f20ce7d1d54e
SHA1c9c87a3261d68e5ed7929e9d0e395d8242a2c032
SHA256fada748484284fcbbc9f393118fad89b6dd9c70deacc0e90904785654d05f413
SHA512cf18a6bdbda1219316240ecb18120e5607f9300ffb116e482bcd841a7ab36168ebc33b48a6b94b36063ca2b2f639bf0c0c0ac4547cf67153c0b4782e25ec0b98
-
Filesize
13KB
MD5ba377b49819c3403d12ebc78f8622b4d
SHA1715c61d17d1ed4e70f8cfc66e048eb38d0ad8ac2
SHA25652c947d9aa4bd062568d70b14a442cbf5e6feee584ca0672c204ccff4d00f847
SHA5126d679cedfba670e610b382d7b7d9feaad0dcd7f2ec945045d96c09cb9fb6bb3d6459d919259bb7de1a9c522a26a1aff1f726ec795bfa44782d4603ad2c292ea4
-
Filesize
13KB
MD5e21a0d021f42955e85d9dfee8c44720c
SHA1f5d882990934444b36a3f89e90ab9aa4a5017ee9
SHA256784040e67fd381a58c2d502dd307aaaffda3db312faad77c7c712bdb81e279b0
SHA512500eca393bd9b6281912b91badd43dce7d444eeb55abaae367dd37c08e6d92411c83ed5e8cc86ce40b6c39e85c89421bb3b07bc98be2ac753af3c40a2e822251
-
Filesize
6KB
MD527484c2b3618f51f752d27e7130e49d6
SHA127e6684812c8ca2c4379c190ea20e1df1f608637
SHA256f8efcc80d1b3637efeb71e641795675c408ea783193ef9c5ed0068cc023e0801
SHA51217e2138ebadd5332e1c9bfcf8df3b3937f85bf272e26a5d5d0402e685adb1a19b3d2037c7052d56df7fd835be4dd6690b1ef7f4b1450df8bc68a31946dfcfe09
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize96B
MD5f5c5ed4a7829c521514706e887697a8d
SHA1a2cc6f850b085eadf7d0a15a74a1765333c4ddcf
SHA256c5df2f74276c497a8f51f20c1822f0dcc58745093e9f4c9787efa1ecefc7076a
SHA512d4610e7d5368471ea519ef76ed51740e3641e313632648b53bc12359cb1c239f189b9eae23ab6f8e5f29ee5e8456ff653d3a88ae2fb3b2d5ff207590eb8a71c8
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe6ae35e.TMP
Filesize48B
MD56c122a5b57817b1a7ddcaff7203366af
SHA1e3083e9d111e83f358331276486a953c51e5322a
SHA25642c6fdee3f269d4d733f57f906afc81d409493dfe575a2171ab7c3cb29a52861
SHA5129765dcc490aa38e48fe66bd3aded4791873c50e920a72cd74db9467a01f5dcbbe42fdb3bfa9c4e3403d40a7b1e47226c5e1434b92eb2c1264a82b8faf33fb9ae
-
Filesize
33KB
MD57c50eb40abbc9ab2e4808604d97f2625
SHA141319dcfe8fb96a98b2285adab46c4aa3722c13a
SHA25672c127baa5cce75493e0bfa9f07a3ac60b880b2def02ead34641a7491dccadbe
SHA512f96bda9f401e7d1dda10f491e84789cdc4e889cf6a5976768a0459d7f41122c96e0f02d8b8e63f2a46f0043741578c7ecfe913d03716c902b1c0b2e2385d2b59
-
Filesize
8KB
MD50fe69b64431cab737452832dc7d5cf17
SHA137f3b45acb106b4ab79ba6d7c3545f75d0e0a65b
SHA25618ea4ab35a51f589113da4f945c1e901c0932aafcf763949865df68d41ee1d57
SHA5129e4040c042800561108a27c58687ebd15dfdd0f9f95ab42d5af12ee212bba0f7ef8cea04e8c16431e36748421896b327215d957508ed12023c3e201fb6f9ef9a
-
Filesize
4KB
MD58b0a4c6f867e59eab553e09c70d1cb41
SHA14c72201f01fc41c491d4d2c8b8d04c775276fef2
SHA2568550d5b7b4a9120a5358a9a1d63b407dc7e701e32c164f31e8c6e0ed907930bf
SHA5125a9ccda22193404affa452efb946345c1230b78bab89a350e063e8eac38eca816114e93c426601b1a83ddb7aca4ae1ad4e4966590870b78a02a53a5d0d2c7d57
-
Filesize
103KB
MD55cb7676f1d79e10feab69b622aff67ce
SHA10a93eeef5809b56d36b5b46b6d8a0a7870b36437
SHA2567efb4186b1e357c4fd1cf1bc2e183c0a4a3ff81f69a7aefb038ccbaf0fb6be3c
SHA5126692bec93d8cb236ef624c0e1c5d76dbe9193961fb0a9898f298095cedbc0919b1a2861c97788f15e86153503d7d4aefe04cb7d9cda2bc320782945f50276d64
-
Filesize
98KB
MD51c4cd6a8fc7d744ba5336f8a89a20a0b
SHA114b1fed4a808ea07404b1be024407c2d515d6b22
SHA2565051feb734e480c654f0ccf684030c2836b25fe6102631ece48dbb5edc4912fd
SHA5123596f1d4157ae0eabb883cfd4ee75cf58e6dfc1afaee96df8b999b5373b4b2b7ba6c3b3ac769d31207f853ba081b2abb10ab4019fc63b47db5af611d4adc1e26
-
Filesize
99KB
MD5af936964232da7b954b761fa3677be3d
SHA147b79bf1010055aea6c750bdf7c2e62817b02ad8
SHA256a358c1a110f71f7c4b413d5e5d34bb326192924038dfa42cbafb82976775eabd
SHA512ac902253edcb31368a4b3862502922d227b31429125e430b9f93e5bfb72a0108b08c4331c3be8a19b5af2cfa58f4c36820211f99d0f05e4618f3c8d192b87b1d
-
Filesize
95KB
MD591725754833889e80f27ebdc63b86db1
SHA13c3ebd73228a427c121af94d7155fb9848619302
SHA256c3dcee3989dc1d4f8b5e0365dfbdf133e64278d6978f48b3ce3de044e54d4b47
SHA512c672bf92617015d2b527f77183c3299c0d1e29a74fbc784174f8d311af491b1577331d35b717bc4fc09c85a0e93090f50c949123d52cd187bcb178c9abf0bbbb
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize11KB
MD5be905f7d7cf856352a8626ff9d20e73c
SHA15e4762cab62347cbe4a741dc8f01b03e4a638fce
SHA256d76cc36d910eef9f281ac9c67d5b3c31ec434f948af2016bb0393d0c676adcdf
SHA512c9df52a8455e09128e2766011c21700fff71fc2c5649c32ac1a7043e7802a6e17d956e036e72415197c3a0c67ae7e7fadd64bef8419270edd128d749ab50e609
-
Filesize
2KB
MD57a7e68b1db0a90be5f871e8a5a08dd00
SHA18bd244d34baf50688d6828b22d97627965075137
SHA25653da9899285376e5a0a02feb9e7379d650cfdf48eb23ca9b8aac58fcdc51e127
SHA512b83ec82af00f58b92a4ef43f0a3e0c5fecf528f87a1207decb2295368077cd9390053dcc29fe3c51f4d4da28fdd86c52333bd89593f12be158017de04e3f3360
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ob75hbeb.default-release\extensions.json.tmp
Filesize47KB
MD56248eed9a076d639b5efd381d8c53f7a
SHA123ff0508121b12a116bd80d0c47d1920490b5b0b
SHA25622c75bb4b47d2fc8ebf549f561e3d750e077d21ce99aef9b7ae8825039420e7b
SHA51245a9b7822b63f3bc1d609dd5ad55ae6347c3fc44d24535837589c31daf8d81378d733981ab6d773ba2609894f0ef6239dbedf8482a5098625f77d2d74685daa9
-
Filesize
7KB
MD544df66210ace35ca6df0a9e9930f3721
SHA16c60c0f4fb315f5f0338b4850b6712ad54a32d22
SHA256ab42864a6c085b179ed3bf06dceb0a833a90866f246492e23e48ac4d99b0abc5
SHA512b1ad9508ea54862109129e05828ef369fc7523f501c57dc97f6045894e78f0696cfafa539f21c2ff96a013130a7c15f3e04adbcc68d9420700d37b563d3588aa
-
Filesize
7KB
MD567d002738784d3155f17238da84abbf2
SHA11b81f0226e1896d89c752e018b1ee439b3bf2070
SHA256c00b60d4dd7b20144c200859d19e03147e758a175b79608492a70dd736553362
SHA512bc5f360d6198feda1252f82a331d2ddaa709d1ae5adb622c9f5423057896b452c202d990bdd23b438ef19e0babae880d91b87e5cb1e9ed95750fb3180e069a34
-
Filesize
6KB
MD565680349df983df593287e7ae478eb27
SHA1fe44aead6cc70a29377d54b21aff8d056026af8a
SHA2567072a91b69a3a6a891194386f8cb279c1046f80b4f43df8e5cd6a57ac80da5b6
SHA512bdacee43a4d355f723b1a15972b07383914b9d78ba8f41c515dd4e1ba9d517a94fa0c9342c8d27b77346b5805add5ca7596138ff63c6ed979a40bbb9cbbb3c8d
-
Filesize
7KB
MD5e1de532c0a24f31bd59c5faacdeae81b
SHA15859a4b5aa96d1394b737fd98e23be89494f9b09
SHA256e52f5a76c7e8aff6030a49337dc1628443ab83d741bd4c735faf08adb4c759d0
SHA512f2d86365d0ecb2a990ada259996c471fae8fb2c2fc8523b942b3a03d0183b647950e585f41c6898bd4c2cdab13e6b047a13da5f8b009e8369779a2166be2b238
-
Filesize
7KB
MD50a91d247427d403f4777a7fceea473dc
SHA111e4abd99e2970aef44ca1e8397bf19063eeb815
SHA2566cb9d5132a41c4054feb4ce7f1cc6ad4b1b591a814f501ea801a9c4a36f12e6b
SHA5120bf5bd714b931e8ee9f0bd57de7c8fc1f66d955aca7141bc271913dbc12c3772eebc1079c88735976d463a5ea176a2ae18b9899796b7a632cac928bfc41529d1
-
Filesize
6KB
MD55fa7e69b45f4275a904178a8b44fc548
SHA1e0fea6acd27bbe30f370a19553171f201b71e8e1
SHA2562ee4e1ae120594bf40065c0e20d112edc46876e533f86ae878f5ec26a0283546
SHA512b6bd8898ec20e4d5970b2c0111aed8f8a3f6a4f0aa2990485c8f5aede5716273fab69bea39261fe29878ac4f9b88f7ccdf76e692a22cfc74d91a21541a534f59
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ob75hbeb.default-release\sessionCheckpoints.json.tmp
Filesize212B
MD529ce37dc02c78bbe2e5284d350fae004
SHA1bab97d5908ea6592aef6b46cee1ded6f34693fa2
SHA2561bfee61e2f346959c53aa41add4b02d2b05c86c9f19ffefe1018f4a964bf4693
SHA51253a9eb746e193c088210d8eaa6218d988f3a67ee4cb21844d682ff0178db040932404f5ce2f3cf8b4576313ba0ec33c04ca288c3412bfa5df7dd8230cc2068bb
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ob75hbeb.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD587a32429809a6e97ed65ad1448bb7499
SHA11160a5bb93f525adf3c89a608cb64f407e1094b9
SHA256716c81db5e70c77210a01e7100b7c7903990d13ab5a9d6ef52552f1cf45c8a8b
SHA51214358fd144f49ccbc658d826fe7384b9d5812bf07884fe11450574c79aa6d9fceb0cb6dc95bff509646154e3dadcef77593916cacd90fd98c85383dd3ec76b63
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ob75hbeb.default-release\sessionstore-backups\recovery.jsonlz4
Filesize3KB
MD53f2d5f5a90813892f2b8d2b6d02ba81c
SHA1ba2d15663f4f7536d058b9fd8f7571db9a0b25fb
SHA25608037df8ac8d22a9769157d5720dbfba9fb15a6df9c0a187fbf4ef0b28f66a3c
SHA512a3ce65b435efdde8449622ed1e18698b9018b5712e6bd9817a132a767eb971eb4acd7660aad98731aa00eb99db748195502c24312f9c4144ad7a5d08bd2e03ad
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ob75hbeb.default-release\sessionstore-backups\recovery.jsonlz4
Filesize13KB
MD52aa928fd37d8a13d60d5a8206e689376
SHA113bec03402a0e438ff9b4a76f1151c929c4613bd
SHA2563ec59ebb210ff4c3274f2bdec205f4f1f47984b8f065dbfe0814811a4773ddd4
SHA512096bcb97d6f98fabdfc16e97cffec5be6f950b4d21066d38a94be4d4fd13e749c683226328b2d166b5bde57dfeeab692cda7f307df349c29e831feaf6fa5d030
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ob75hbeb.default-release\sessionstore-backups\recovery.jsonlz4
Filesize12KB
MD597de6c09d4b1ddf9cadc27dabe04fb7b
SHA161fca1bbd66491e3a88ce54f17b8b9dada9a4cb0
SHA256b5bcd7f488a74054abc989abf2fb4f80844403758bcf7aeeb7126dafb4a565fe
SHA5120a79be895693257547d22adeaf45dd2f6564ad090185f1709b75cd7f9ab26a91ebd00c7ad1ce336760c1b6373a2205aa6eab83deccf796ad5d3417f0f76a10a4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ob75hbeb.default-release\sessionstore-backups\recovery.jsonlz4
Filesize21KB
MD5b3a0a39ec4cde1eda08275aa5742b2bd
SHA1ea857dae09e69cc498d72ef9d789120189f6c27f
SHA2561fa24f4d56686dc5b99b54f7344ac466658360bdea7900ca46d668e800928f91
SHA51271a4088462e625d99966aa652aabebdf46c92b8b4e7a82c3b43c0dd1a7a5bb637baed506878bb313eedf438028f976232cde3455c9d96150a16a0e55235e452a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ob75hbeb.default-release\sessionstore-backups\recovery.jsonlz4
Filesize15KB
MD5082ae53a4a1045fb10a54d2efa28aa07
SHA1cb81cb010edf2dee3d3e016687adc0f0e0f4d421
SHA256619ab83b99178813af62c54cb48594ba4cde59e1d2824e8744dfb38accf9765d
SHA512ef6c931281a351a1493a304d48404d58d095046966fda4e98b9f7753055080a22db4315cd3fb269256237667707dceb6acc11b36764e598f1972fce64a3721b3
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ob75hbeb.default-release\sessionstore.jsonlz4
Filesize22KB
MD587762f241c13cc3c7da3a9f6d329f357
SHA19cd585c9c0317c74316cabe52369dd49c5420a63
SHA256628cb5c91d7b19d417795a4e05d286c64e8c4fcedabb82bf553fc856c366ad9a
SHA5125afe1fa751289b1a607661177595fc5b054477d9679b5c0d109d5fdf781ded28fe4719b8396f6b47b173104c8f90eead1cbafe7fa2141a9f5eb2befcb4066668
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ob75hbeb.default-release\storage\default\moz-extension+++649c7b77-bfbc-4d12-926e-5ec3cb85e8dc^userContextId=4294967295\idb\3647222921wleabcEoxlt-eengsairo.sqlite
Filesize48KB
MD5aa803927158c2b945b75c538923d2bb1
SHA1086458ab7fde92b27678b45c905df789d550b15b
SHA256d8102ba023cbd02848822da1bfd1189be09d7a121aeb78c66d3fd48602120cae
SHA51236e181edf79eac42bfda210bce91399809431fba5ce94bee3ffa6d62e533e8dcc0e852a564e7d89fbea10e1e550c69aa7578cac1376df7eee6908c1e995f8124
-
Filesize
197KB
MD5f9965dde3877430d47dee197bce126d6
SHA1ce1817b9e1f36685b02f580cdaa869f893c25bb7
SHA2562bb3a739c9d189f5e9b7568ffeea6976bab05d3d4502b55ffd01630d3333842e
SHA512060f670ae5b28c1f2d9c2fdc2f30b1d7257ae2c1045c0712fc861934058795ed77fa45929b67d4b6d971d546743c59b96b6f1b2afb9dc0fcc44e8475c9b8f997
-
Filesize
483KB
MD5a5776724da76e34f334d9022ce1ef677
SHA163862b84b02f8f8a7132cf401a059049037d450c
SHA2561fce25692d51ecbbe575f212248e5459feed0693aa0cf8211f0f2f9cf4c7e910
SHA51290f7017062f1a5a0e9fb143bd8462bc64e616a442a17ade077c5fb962c17d529ab85e1747bb068eb290ca105ef26d8a48171d470fe87695e37b2dffbada4d3cd
-
Filesize
412KB
MD546d0df4fabcd5909855b791bad860613
SHA1bf8c9a6bfcee0bce18e7c217e13d31a77fde0df2
SHA256924134f4c14855f13a97bcc67ac31d4555fdbd808bb0f8a25163a87d19eca13d
SHA51286a68a865795825958afecade08aeca3a8e8d1271827a91b6c53bf66e7544d2cdc3f254f3041fea9959a5751e783eb5d25b2b4031d2bb5e773ee04e94eaf482d
-
Filesize
430KB
MD5863b5009fe2e34207d5139d834007938
SHA18890362bc435f7c2fb726ab14c5f489f0cb82490
SHA25603484530362851cbb73379e96d482d92eca8daab586db38d927483c50644f89c
SHA512bcb4a8cb2c0bc00f47bd5786deaea6d51b2fb87a2cc6d7de39f12fd9f17c74134569e43a5e537b6c09081f43682b1ed7a365b8a27afb4ad37f0dffede3c73641
-
Filesize
698KB
MD5e3017f0efc2fc70be6a5998ac8035816
SHA1aadb2f23fa4b6259d3f89c1c7f1d713f07e0f235
SHA25633450e1aefae37be658179595e238d57fcb5c114e2aacc783044972e86efe362
SHA512fde41b0c8dde1913bcefa98b566a91f0731c606f2eebfcd8377aa4facd21a2bb80801ad6370425d1b92da05b9dbedc6965197605f9067f67306466fde733224f
-
Filesize
358KB
MD51bd4d3a126f59d9dd0a65bbbdd027645
SHA1b9993ee05355b2dcd9f44ee016a5a7058ac6a275
SHA256c6e5e1e1418db8b512178616b64265646ee1e1f6b31d2d4c0ade9de8f4805370
SHA5125a280aa2278b58792e0bce96d50bd8795f8b44819850ab7122c5e2e901c766e364c7c6b3cec54805d1496d368dc88498f29c28b6676a7d36979d79ffba3c3c4d
-
Filesize
215KB
MD56b8cff90cb981af86f737bb2752828ac
SHA168c9cab8776e420df7f011290961ca7e4af43c2c
SHA256af4f600cb5a68db3278d91d752d800b005540292a7da04a92afadd6344333204
SHA512d4691d189297daa4d28f6b84c749da37f932d34d5beb7401ea2094789ce9552492438d5a97002f2fc0f5c6a3854cf93fe252527f74d488464eceab68b4dee66e
-
Filesize
394KB
MD59d78cb721a9b44f21f52f919722092ce
SHA108c843c80765a682ec6fa97e3a43ff8ca66a9f1d
SHA25667cb37f6990a8d00ce08fe4c551d37769687b47475d0e5b2f1023d0516450e8d
SHA512cee368cc609943c325b93a6d644b1df8d73eb2a1cb8e4304e3fb916f5f589b42d4b97b1476e07cb781662b7da9a3939972b989f7595e64fda579b177b15ba977
-
Filesize
322KB
MD585f5a6ae415ec581c2af64ec1d409815
SHA1abdd27f150d9ab9ee1edaf98b2678351be71b0a1
SHA2569f635149499f98bd2997d1ecc03cbdbede86d0b9ded3fa5d6cadd40d1a3b5a0c
SHA512a0af8850b44bc60cccdf494d14e011e0b9689502bded0171483141175df562f861f9bf108df1bf63ad81c23a34af60e35c55b4d52a4e2aa77bd1f2be59ed9cfb
-
Filesize
465KB
MD524bbd047b4aa8527268c5fd96f00a321
SHA1f20cd4daef99cb60f88037fd4b6ed0e8c5099566
SHA2564ef5921751e8d5a88e6f643f065a5453274a6b17d818a167adc831fec88d2ff2
SHA512e6b7a52a0ba414362ecbe7a4f26fd2e8f167db9d2adcb681f5c33d87e5aa457f346b94a3497085b4ffc3193b6ff1077472678a8d4622fc76f34dc92320b4c8b9
-
Filesize
286KB
MD57992a94ac90aab65d4b6cfbce4cc648f
SHA17f938f5407dede7c208a129290c7d4544986f4be
SHA256898c970e710b8a9d1b5aa7c0a10f83d9995605478b577e9ac53cb8bf27c37b68
SHA512707ab07383950d4280662532fb805988761a8ba54397e6c97fcc1bea4209e5726e7d36686d295d84fb9df45d4fb3c3ae53aa7df7f94790a5dd75f0565e962b73
-
Filesize
376KB
MD5fd85a9a6a7efccc2076ceced8ebe9dd6
SHA1f72f54ab4333cd7832c7014ac8e15d16013d4775
SHA256bf55f35e81546365492369738ae16cf85aa1cdeee5c2f153bbc6b474b69ef64a
SHA512560d28aad5dc54b5ba611b9d628db14c9f628bda26d6b953b279f75cf7cabf88f3f38abb8b2acfcd14bb3361cdf5487aefbfa2d70f18fd2deb7c3232a7e8c890
-
Filesize
232KB
MD57b23d5ce3a9e602b38965b2291591428
SHA1cd781679dc7b79ab0d5298c6d22fad8264eadcea
SHA25637b8c4c4319e7ad0b008b87426d7210863128292f683f61ee989e441d87d6ac3
SHA512fc7e92daee28b7db693d01049108e9b608d95750d5fb282bf72b98dd9981ac69a16d8178eaa3928197f9bcd68e46909014fcb269fe8bda71cc42f76b024d2aff
-
Filesize
179KB
MD5059adcf43fa6c3f371a6b7375c62e091
SHA14dba1d6eaa16718496b8e571699f432aca308b78
SHA256fd977d268b2577218b68cb1daa84758dec4339ecb9f93871e1ddf3394703d5d6
SHA5124b9c9cce8cfcbed94824df5441940b23317075bfdd9815842078fa08566e936a7d057e3ea4d4115280b8c00652c5e57826de07bce0fd98d7a5a77bb1f3c0c8bd
-
Filesize
340KB
MD5b50f913f364050f7b5ef2c7443c21b57
SHA1717f71aebe15526bf723ccabd7ff7dfec3ecca15
SHA256517332911fa192f1183fca830bcfc7e533458243e3da65cf59c282e058975da2
SHA512bb0fcce1e93af935ae59d6849e932e978b433e35d6e6b6a4aeb8c931298ce72d3375c7b904d807470808ef47e29d3db62b06e66d114ab9e2e8cacc34af53b09a
-
Filesize
304KB
MD50ec920b5efcd146a93983e6e43666600
SHA1ac45597ca2266c7535086ed8e350780a137782be
SHA256712b10df1690bba6d7db28ce0a5d3d534b26b9cbbb0a0309f98a8a360b76b509
SHA5128006a85ea4872cad99dd4c811acfe74a1785fee839c224d6d93d522bfad66515bc1f27ae9ed336cbbe842f89f5af9443d99362f11a36f06fdb43fbaec984c3a6
-
Filesize
250KB
MD51a34cc9cd7ed7486fb227fe2355818c5
SHA1dffb9cc3be83d7b602dd6bcf8f34d972c7e14843
SHA25657482135263b91a2ceccaefd94ce9906d43798d8bf0e3aa44278f553de63bbd8
SHA51227fdf80b0733f49b3e20b5c6534b8edbfa66f269f49e94510683150b5c431425e29eeebbc5cf6daa57efc7b1dfccf7a24548e9d4c9dddfc1d4607b81aee816ad
-
Filesize
501KB
MD5bf280a0d6566a1f44d0771840a01cc5d
SHA190a8b556b3480ec359e7d9fb848cdf9bfcd01829
SHA256e7e57089c05aa55e3af78993d6f467d99a8f252614df9ee9065686145dd6b208
SHA512748a6e99072c48cdb0d4f9bad93079af6bf517d8f509b199aec8069d5f3a30be10966ae00c47af7ddb7ed9f04bb11c35aa8bd9a86cdb0138c5bd0941041aaaeb
-
Filesize
268KB
MD58070dc07fed8b2f0ae8fa3e9536209c6
SHA119f8fb92afc7c538504b7b9d4b296cbe1510f4f6
SHA2560a192d20b7ac81afe0d99e13106af418295000a1990ccb7ed82dae3380011eab
SHA512a325411111f814edc13ca923ced7d391851c00efe6542d2d0aa587573863dad57f3bd7b3183235c8083df26c4a6ed7b7ab2055353e32e33403e40ba3723423bc
-
Filesize
447KB
MD5c01dacf2766eff0d6c5ac3c0a7d98fdd
SHA13f27974b9e78f5fe9e33959e780a1c288f2b19c3
SHA256ca9a92d6ddc28fc80dd883ba0ed782245e95de89dbb950501c0b1fc778404e60
SHA512580ef589915e54b0beb662ef2dccb28d11aedff3c8420c19f6a14259199cb74e225b96c8a99a5ff6beb51cedb48089f1983652bc9b3d79b4a22ad2993cec1afa
-
Filesize
10.8MB
MD51ce6f3cd44221e64daf43d0de7f26a1a
SHA181dc72e6da9d675a30e0743feb325ffe784053e4
SHA256fd811045e190171ba8a0bd60dd094aed485108d92531cc2b0b76c90ea0f11cc7
SHA512f43ea903a5fce5942c0edbc07a72f5f6b2621c1ada9b0900aeed3b4ac9f3cc69e6d10a4cbd8d3a02eb926644e1adfdda8b412a9969e7ae562c4b986391ce131d
-
Filesize
764KB
MD5aed655395747a6602479f6032d3c099f
SHA15fcbd5735ed0e4a013667652f4c1382abb45203a
SHA2563d6123dc6ffbd1a11d73229988203052809bd17617b24a034c1122c8f4983db4
SHA5121a3db9e195e9e504a0a6c24557f1e141f90a73a89a853b8ad3ab2248d8e3fd97ba1ae78b93ad33005590ef0a44c5237e608b66a9c9fffde39e4730c226d91637
-
Filesize
1010KB
MD5a69d796ab71f88742ebc5317ff46015a
SHA1e0161537372941371751cfc3defe9041b03251c1
SHA256204259fc2caf158eb9bfae76aa4204dde93a18643f5cbb578d8f93260f11593d
SHA512c948df9b292b6e4340e1329bdc467fb8ba9d4d8d08256d761efcd451d50c9432dc08ad4fa030f6a65d4abb7ab7ecf266b93421e16e14c655391a13e6c88745d4
-
Filesize
2.2MB
MD570f3bc193dfa56b78f3e6e4f800f701f
SHA11e5598f2de49fed2e81f3dd8630c7346a2b89487
SHA2563b616cb0beaacffb53884b5ba0453312d2577db598d2a877a3b251125fb281a1
SHA5123ffa815fea2fe37c4fde71f70695697d2b21d6d86a53eea31a1bc1256b5777b44ff400954a0cd0653f1179e4b2e63e24e50b70204d2e9a4b8bf3abf8ede040d1
-
Filesize
7B
MD54047530ecbc0170039e76fe1657bdb01
SHA132db7d5e662ebccdd1d71de285f907e3a1c68ac5
SHA25682254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750
SHA5128f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e
-
Filesize
1022KB
MD57824f9fe91f447b1fae5c8d20de9326c
SHA1433eaef6e433d53825dd87ebfb461820d3c16cab
SHA25668df73ec0db405ca31e0eb03a2cfd490445f36141db1abf12892ce9f1d829698
SHA512062310b99f385d6c05fa789606aabacf0e6d1475d2b250153d9becddcf00d6429f9c5ee2383362b30b52c927a3f787d0d6290a869892d4a28ba5a34b6118ffaf
-
Filesize
2.9MB
MD50592ca25cf22e8d5daabacd1130d38f6
SHA10a59fd8723de4cb9bf6c3272a5db7771e575eff9
SHA2563b8991f1eebfc46988db25fe0ded11c3c08df81ae2ca1baf9103ba8259cafc99
SHA5121be2c9f7ff9fc9cab5e5a784b281585d89070413722cb4584e91d4a4b57e628643871ee672049c32a8b2399c8358f1c6d7df20af1b3c39aa9b669902b71a91cc
-
Filesize
695KB
MD57fb4ced621ecaadd4e3b5ffb65f8e62f
SHA10d99561dee8a482387ef4c35e173ef677734c3b4
SHA2563808423799ffaa1fb31b3744ed0d8caee92e4960e3ee751e31aef5186909136b
SHA5120a8a954cea5f4df988641b0e683dcef42f07291e3933e5a69ec7f1972552d42ea7b1a9f0ebf22edddee021ea7ec3df0d3387b0a58f05ff622b64ef22e9c27bff
-
Filesize
190KB
MD510b82dc9d9a29bc4af224981f0e1c6fe
SHA1bc33b2eeac62916eb9ee93a3f1ed6a0eb7611187
SHA25600cd644354032257a39ff710ddd03e9fb98348f5323dec31ca670c903d68274c
SHA512a3c67a858ce7889506572e2448b5d1e936c6d6ada2a04736b1f6cfe12b9ae46e9ee8c925778cda273db54000854f1ec4a544bcf2255770b978c7c6e9e24a1664
-
Filesize
796KB
MD518693249f3a283e83b8179e692ffbba9
SHA1546c0d89f8c8096d22c6f6be7e843cf5ce08e220
SHA2563d828bcccc628e7096856337b178da5608a6c3db99383374e6c49d50a1895e64
SHA5121ab246fea99daf75831f26930d458a05ff0efd5f9c71c9c4396681a065fcf9f5c04af774df34ad55e140b71d41e42254ee2d9dabbb18009800bdfc62170a8c39
-
C:\Users\Admin\Wavesor Software\SWUpdater\Install\{D9BEC43C-1473-4760-BDB8-6B047258E9C4}\WaveInstaller-v1.3.15.3.exe
Filesize87.7MB
MD5e035968354e797d1a5a8ee85b33536fa
SHA1cb980b4be6cff81542589a9d7d0835d5a5b62c74
SHA256d005126d3981d353ee5efa5f2bf08933959ebc344da0e36e7401f37e74bf92e3
SHA5124e57742a62ce6ef812e5064929a7d2ecbcc2ac77e6fdb2770cbc71f7ea286d7d2581a9c49eeded7fea5fbc6b632217667f45b23653df5c9b2a328439a02defcf
-
Filesize
108KB
MD557428456c6e6c2ea328c864681db5df3
SHA12dc7329e0b346c435b6ea5cf44a3d0a076f8d398
SHA256ee87747102eba8844939352740d0bb6c4a67f10c2656961cb2722cd42ba99f40
SHA51240fb34fce07f094fdaf78c499a21c3f534f0c8ae1246b6cf382ea7e63fa08b4de56e6c81eb8fadce8a2e508ae5d03831590a06ffda3d46026fb894e4997f31b0
-
Filesize
3.9MB
MD56228b1d6a0e117f7ff73e43d4d436dfc
SHA156776f15acfe1a2d470adbc1251135dd63ea2d35
SHA256acc2b3ea399c41fa52b2a0df89bceaedb857767367b8034c14c6aa8b8f01b2ef
SHA51222455940afd92fcff64d2fd9d99a534ecae316f11cb2a22e481bb4f2c1107a4e3bfcda3ba6de19c38c54f5e39913b7fc197ecb5d8af80236dd2b2f73bc529724
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e