61ca4d8dd992c763b47bebb9b5facb68a59ff0a594c2ff215aa4143b593ae9dc

max time kernel
219s
max time network
305s
platform
windows11-21h2_x64
resource
win11-20231128-en
resource tags

arch:x64arch:x86image:win11-20231128-enlocale:en-usos:windows11-21h2-x64system
submitted
28-11-2023 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

[email protected]
Size

14KB
MD5

19dbec50735b5f2a72d4199c4e184960
SHA1

6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256

a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512

aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP

192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Downloads MZ/PE file
Drops file in Drivers directory 1 IoCs

Processes:

MBSetup.exe

description ioc process

File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat MBSetup.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\mbamtestfile.dat	MBSetup.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MBSetup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MBSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	MBSetup.exe

Executes dropped EXE 2 IoCs

Processes:

MBSetup.exeMBAMInstallerService.exe

pid process

2908 MBSetup.exe
1868 MBAMInstallerService.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

[email protected]

description ioc process

File opened for modification \??\PhysicalDrive0 [email protected]

pid	process
2908	MBSetup.exe
1868	MBAMInstallerService.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	[email protected]

Drops file in Program Files directory 5 IoCs

Processes:

MBSetup.exeMBAMInstallerService.exe

description	ioc	process
File created	C:\Program Files (x86)\mbamtestfile.dat	MBSetup.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\87495b33-ecdc-4147-898f-72d476da5916	MBSetup.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	MBSetup.exe
File created	C:\Program Files\Malwarebytes\dc18ba788e0411ee8fdc664382544407	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\dc18e1b08e0411ee93a2664382544407	MBAMInstallerService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	Taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exemsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2419339351-1576266894-3530880589-1000\{1CC3430F-5ED7-410C-B3DC-BEBF872E9EB0}	msedge.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 894599.crdownload:SmartScreen msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 894599.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

[email protected][email protected][email protected][email protected][email protected]

pid	process
1040	[email protected]
1040	[email protected]
2384	[email protected]
2384	[email protected]
3456	[email protected]
3456	[email protected]
4908	[email protected]
4908	[email protected]
1620	[email protected]
1620	[email protected]
2384	[email protected]
2384	[email protected]
1040	[email protected]
1040	[email protected]
3456	[email protected]
3456	[email protected]
4908	[email protected]
4908	[email protected]
1040	[email protected]
1040	[email protected]
2384	[email protected]
2384	[email protected]
1620	[email protected]
1620	[email protected]
4908	[email protected]
3456	[email protected]
4908	[email protected]
3456	[email protected]
4908	[email protected]
4908	[email protected]
2384	[email protected]
2384	[email protected]
1620	[email protected]
1620	[email protected]
1040	[email protected]
1040	[email protected]
3456	[email protected]
3456	[email protected]
4908	[email protected]
4908	[email protected]
3456	[email protected]
3456	[email protected]
1040	[email protected]
1040	[email protected]
1620	[email protected]
1620	[email protected]
2384	[email protected]
2384	[email protected]
4908	[email protected]
4908	[email protected]
1040	[email protected]
1040	[email protected]
1620	[email protected]
1620	[email protected]
3456	[email protected]
3456	[email protected]
4908	[email protected]
4908	[email protected]
2384	[email protected]
2384	[email protected]
2384	[email protected]
2384	[email protected]
4908	[email protected]
4908	[email protected]

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 45 IoCs

Processes:

msedge.exemsedge.exe

pid	process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

Taskmgr.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	1788	Taskmgr.exe
Token: SeSystemProfilePrivilege	1788	Taskmgr.exe
Token: SeCreateGlobalPrivilege	1788	Taskmgr.exe
Token: 33	1788	Taskmgr.exe
Token: SeIncBasePriorityPrivilege	1788	Taskmgr.exe
Token: 33	716	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	716	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exeTaskmgr.exemsedge.exe

pid	process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exeTaskmgr.exemsedge.exe

pid	process
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe
1788	Taskmgr.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

[email protected]identity_helper.exeidentity_helper.exeMBSetup.exe

pid process

2524 [email protected]
3624 identity_helper.exe
1616 identity_helper.exe
2908 MBSetup.exe
2524 [email protected]

pid	process
2524	[email protected]
3624	identity_helper.exe
1616	identity_helper.exe
2908	MBSetup.exe
2524	[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

[email protected][email protected]msedge.exe

description	pid	process	target process
PID 2600 wrote to memory of 2384	2600	[email protected]	[email protected]
PID 2600 wrote to memory of 2384	2600	[email protected]	[email protected]
PID 2600 wrote to memory of 2384	2600	[email protected]	[email protected]
PID 2600 wrote to memory of 1040	2600	[email protected]	[email protected]
PID 2600 wrote to memory of 1040	2600	[email protected]	[email protected]
PID 2600 wrote to memory of 1040	2600	[email protected]	[email protected]
PID 2600 wrote to memory of 3456	2600	[email protected]	[email protected]
PID 2600 wrote to memory of 3456	2600	[email protected]	[email protected]
PID 2600 wrote to memory of 3456	2600	[email protected]	[email protected]
PID 2600 wrote to memory of 1620	2600	[email protected]	[email protected]
PID 2600 wrote to memory of 1620	2600	[email protected]	[email protected]
PID 2600 wrote to memory of 1620	2600	[email protected]	[email protected]
PID 2600 wrote to memory of 4908	2600	[email protected]	[email protected]
PID 2600 wrote to memory of 4908	2600	[email protected]	[email protected]
PID 2600 wrote to memory of 4908	2600	[email protected]	[email protected]
PID 2600 wrote to memory of 2524	2600	[email protected]	[email protected]
PID 2600 wrote to memory of 2524	2600	[email protected]	[email protected]
PID 2600 wrote to memory of 2524	2600	[email protected]	[email protected]
PID 2524 wrote to memory of 2532	2524	[email protected]	notepad.exe
PID 2524 wrote to memory of 2532	2524	[email protected]	notepad.exe
PID 2524 wrote to memory of 2532	2524	[email protected]	notepad.exe
PID 2524 wrote to memory of 1400	2524	[email protected]	msedge.exe
PID 2524 wrote to memory of 1400	2524	[email protected]	msedge.exe
PID 1400 wrote to memory of 3604	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 3604	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe
PID 1400 wrote to memory of 1500	1400	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\[email protected]
"C:\Users\Admin\AppData\Local\Temp\[email protected]"
1⤵
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2384
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1040
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3456
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1620
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4908
- C:\Users\Admin\AppData\Local\Temp\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\[email protected]" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:2532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=vinesauce+meme+collection
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffab7ea3cb8,0x7ffab7ea3cc8,0x7ffab7ea3cd8
      4⤵
      PID:3604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,1682894216598824031,4482431822098194211,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1892 /prefetch:2
      4⤵
      PID:1500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,1682894216598824031,4482431822098194211,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
      4⤵
      PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,1682894216598824031,4482431822098194211,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2568 /prefetch:8
      4⤵
      PID:3800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,1682894216598824031,4482431822098194211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,1682894216598824031,4482431822098194211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
      4⤵
      PID:4084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,1682894216598824031,4482431822098194211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
      4⤵
      PID:3628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,1682894216598824031,4482431822098194211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
      4⤵
      PID:4224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,1682894216598824031,4482431822098194211,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3208 /prefetch:8
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+2016
    3⤵
    - Enumerates system info in registry
    - NTFS ADS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffab7ea3cb8,0x7ffab7ea3cc8,0x7ffab7ea3cd8
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 /prefetch:3
      4⤵
      PID:4288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
      4⤵
      PID:3900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
      4⤵
      PID:2264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
      4⤵
      PID:2488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2008 /prefetch:2
      4⤵
      PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
      4⤵
      PID:1824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:1616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
      4⤵
      PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
      4⤵
      PID:2924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
      4⤵
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
      4⤵
      PID:2716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
      4⤵
      PID:3948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
      4⤵
      PID:3716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
      4⤵
      PID:3988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
      4⤵
      PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4800 /prefetch:8
      4⤵
      Modifies registry class
      PID:4024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5720 /prefetch:8
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
      4⤵
      PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
      4⤵
      PID:2972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
      4⤵
      PID:3128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
      4⤵
      PID:2840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
      4⤵
      PID:1432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
      4⤵
      PID:2036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1764 /prefetch:1
      4⤵
      PID:2040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6984 /prefetch:1
      4⤵
      PID:3176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7188 /prefetch:1
      4⤵
      PID:4552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6596 /prefetch:1
      4⤵
      PID:564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6840 /prefetch:1
      4⤵
      PID:1792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7724 /prefetch:1
      4⤵
      PID:660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7704 /prefetch:1
      4⤵
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7220 /prefetch:1
      4⤵
      PID:4192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
      4⤵
      PID:556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7768 /prefetch:1
      4⤵
      PID:2704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7640 /prefetch:1
      4⤵
      PID:5204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7804 /prefetch:1
      4⤵
      PID:5224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8012 /prefetch:1
      4⤵
      PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
      4⤵
      PID:1784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7924 /prefetch:1
      4⤵
      PID:5596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8232 /prefetch:1
      4⤵
      PID:5860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8624 /prefetch:8
      4⤵
      PID:1588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8
      4⤵
      PID:4916
  - - C:\Users\Admin\Downloads\MBSetup.exe
      "C:\Users\Admin\Downloads\MBSetup.exe"
      4⤵
      Drops file in Drivers directory
      Checks BIOS information in registry
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of SetWindowsHookEx
      PID:2908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6712 /prefetch:2
      4⤵
      PID:5088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8724 /prefetch:1
      4⤵
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8112 /prefetch:1
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8408 /prefetch:1
      4⤵
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8492 /prefetch:1
      4⤵
      PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8832 /prefetch:1
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
      4⤵
      PID:2832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8252 /prefetch:1
      4⤵
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6888 /prefetch:1
      4⤵
      PID:8312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
      4⤵
      PID:8400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
      4⤵
      PID:7520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,236430331208956873,4688164107500916008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7388 /prefetch:1
      4⤵
      PID:7756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
    3⤵
    PID:4324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffab7ea3cb8,0x7ffab7ea3cc8,0x7ffab7ea3cd8
      4⤵
      PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=skrillex+scay+onster+an+nice+sprites+midi
    3⤵
    PID:3352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffab7ea3cb8,0x7ffab7ea3cc8,0x7ffab7ea3cd8
      4⤵
      PID:1824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=bonzi+buddy+download+free
    3⤵
    PID:4008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x128,0x12c,0x130,0xfc,0x134,0x7ffab7ea3cb8,0x7ffab7ea3cc8,0x7ffab7ea3cd8
      4⤵
      PID:3104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://motherboard.vice.com/read/watch-this-malware-turn-a-computer-into-a-digital-hellscape
    3⤵
    PID:6068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffab7ea3cb8,0x7ffab7ea3cc8,0x7ffab7ea3cd8
      4⤵
      PID:6084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp
    3⤵
    PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffab7ea3cb8,0x7ffab7ea3cc8,0x7ffab7ea3cd8
      4⤵
      PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=dank+memz
    3⤵
    PID:6048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus.exe
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus.exe
    3⤵
    PID:8248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x11c,0x120,0x124,0x48,0x128,0x7ffab7ea3cb8,0x7ffab7ea3cc8,0x7ffab7ea3cd8
      4⤵
      PID:8264
- - C:\Windows\SysWOW64\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
    3⤵
    PID:6884
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
      4⤵
      PID:6860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=best+way+to+kill+yourself
    3⤵
    PID:7264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:896

C:\Windows\system32\launchtm.exe
launchtm.exe /2
1⤵
PID:1712
- C:\Windows\System32\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe" /2
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2112

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5684

C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1868
- C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
  "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected
  2⤵
  PID:6632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffab7ea3cb8,0x7ffab7ea3cc8,0x7ffab7ea3cd8
1⤵
PID:1728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffab7ea3cb8,0x7ffab7ea3cc8,0x7ffab7ea3cd8
1⤵
PID:3992

C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"
1⤵
PID:6568
- C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
  "C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"
  2⤵
  PID:8868

C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
"C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"
1⤵
PID:7244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffab7ea3cb8,0x7ffab7ea3cc8,0x7ffab7ea3cd8
1⤵
PID:7260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json

Filesize
592B

MD5
2387147f1adf2fdafb2e468a1cce0cab

SHA1
580b739bfff8a2b090299c3a5b276e5d24963555

SHA256
032a1224d81bcac338d9a3afbfd83f9ae00e79a80860288f51e0175c4d6bd154

SHA512
fd98ef552b3ab027baceac5757a641bab117c85b14f1e600465e5c7904e8ca0fef8d447145baea10e7207aa1636b36d5e53c9ea8f726ebc0c340bfc082978848

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json

Filesize
654B

MD5
4daa5ec255988a843e0fb3f6ca6e7d30

SHA1
a112c012fe1af0762260da498680048e3128c051

SHA256
296973e739f47479bd9996ad8685ae1a0126e889d59d546f9d0504fe93d8587c

SHA512
364d505f0a9c8330c9d40dfe9760a306346e2c54aaf214d6210c0fabc85ac2a47dc59adcb267960a4b620b30937419cd11e3fa288736ec7a97f9b8306fc3c5fc

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\ctlrvers.dat

Filesize
8B

MD5
8e160946d937c3d05c20d4b6956165ed

SHA1
d864c75c7df3ae41e1b9278fe2fc8df3e0ccb4f2

SHA256
002087a846ca9cc24db51eab7dca9d0e2708bb3ff595046ef6a5b881ea0a7517

SHA512
279cc6bd2b1200e147fb12162e31657535687ea0f937eaa0c579550f6a41874d272eff758c34726b330b5fada205e5501393bda39ed2aa37f0acadfdb3341532

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\mb4uns.exe

Filesize
3.8MB

MD5
1c1ed125b4ba65d7499504b2c77a8b27

SHA1
4754ee30ac153247c8a0e5a264aa48c0f4c20ece

SHA256
0113b48553f2a67726a4eaf0fff5b5eda2853aadbae32be7a99629b8a6700196

SHA512
a51d3dc077b91b14e5c38083fc1186d5b5504cdbb5439942c39fc4d054aa05ad9bd1d913b7f8bae8d35971ee5f92e1f483cb39b6722a91a0976f96f79e39b512

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe

Filesize
22.9MB

MD5
b5aee6d83c6e863c1d6297f12046b08a

SHA1
73d29b270cbfd3c460fab0d928d20e9d04a4ef55

SHA256
8ea3e38765219ce853925d3e3a9d9dff9c651ea88cd14f86ce3e82caa56bba8c

SHA512
86075d0f152fccf329f34084aaac48be8e36f5dcee0bbb2be025dadc3ab5b9dfdf91f229e0490ba0f6bdea06b8c3e87ae6d5a7d31af02be13f349038171790dd

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe

Filesize
8.8MB

MD5
89a9601cef4288dc9f6cd0a655794e7d

SHA1
95663d19c77776ffc06935dbe8afa0f1fa50183b

SHA256
f196563e7dfca811272278881c31ec809eb7dd39f6d7032bbea0766da953e386

SHA512
dec0102a881499ecccfbe9c224cb3544217b7b48ddb7a5109a9387dead18b1359e63865a8ff406a000205dc742effb220a97e403f5c31cdb0340a9111cc9c882

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys

Filesize
233KB

MD5
764310ada7e8b6c20d4e0020c8bf8105

SHA1
fcf840985419355c7508e394b5fe8e112d9c6a08

SHA256
bf29f76c794067a4f04f794c2b3eab9b6f1a9943c0500cbfd94f619dbde68a38

SHA512
451b452207429f1ed84bd23008d1a8a5e98f757e47b0f8f21463eb9cfe93d4e10e8fd4a5e0b794b90925967c1cd133525fce30c00e5629ba61dcb948a5db5b4e

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.sys

Filesize
217KB

MD5
8daa2afcce65641472b57b91f2c1389a

SHA1
fc664a927c04b30ed9af629d4c100da41b30f503

SHA256
c303ad973ff82f7f9d256b3762dec7064c916c35aa57e7af50cf2248278ac1ff

SHA512
ce28db6214a60d0479c537e19cb748ec0468c35552e0e3d13c86240e3d5a57d1dd93d7522adda27f9073fa8908e450c72905601710ab9789e1cb628206c5d7b9

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\srvversion.dat

Filesize
9B

MD5
8422d5b676e9b2f9500c2c8abc05dd68

SHA1
5050fe433fdd3722c0cf9c3b610476c4677de6b3

SHA256
2abebd6c118af131c7c4ad0becfa2c983039aafe078f4857ada054645ac8c245

SHA512
2572439ac0fd204954bb03e62eac8b5ff8d4feb4ac4db5d46875b65367b76f3d64fcbf0d19a621d58af5884afb7e4851ee9f2d99595dfbbaa6ee94d5383eb728

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\uipkgver.dat

Filesize
6B

MD5
74c6677020fc6b6c867aab117078bf5f

SHA1
8c46db37dc0b39eb963d4144539c8b591e122400

SHA256
cdbb9bc874d71e154c71b68b1fe959913d286036dac11e226e5620c919ba9708

SHA512
3f9db8d9bb25322f8d8e750750bf92dbe6ac63d686eced65cddfcd61178cf0e947118a491058414d4d2cbb4892e39815565669aee0dfdda23aece72d278292d0

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\version.dat

Filesize
47B

MD5
f08c6c039cc618760afd3d9b78da762e

SHA1
58f9aa80e26f2afd400af691604db1ab0f6a2da5

SHA256
ecb0560a1a52412660f6371cb70d8398b038124b0fff88eb3f501d823b733ec9

SHA512
7a57e8748def4975dd6dea57eef9d00fc6d8760b4ce16023c3ca37aaf5fc829a764470a519505539c9aa13b9a94947822c7b91bcb95c74dfb5ca3fc24d675d61

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

Filesize
47KB

MD5
a2ff568e92d79f160d2623e5f0340e47

SHA1
3300d041ebadfe2e411942b7b6dd2d85ec3f3c52

SHA256
aa7c450578ff205c34c187d354f012de8cca05d0677b78e98a7ef5328cad3fa6

SHA512
238f94d5580ae5b4f13cf5a609c4f51047404c94fe21fbf3a0b527a879b2d56ea2493ee4626aec91f59a4d5b0bba4eb83960d91b6d8a26d7711fd6e8b547cb26

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

Filesize
47KB

MD5
a2ff568e92d79f160d2623e5f0340e47

SHA1
3300d041ebadfe2e411942b7b6dd2d85ec3f3c52

SHA256
aa7c450578ff205c34c187d354f012de8cca05d0677b78e98a7ef5328cad3fa6

SHA512
238f94d5580ae5b4f13cf5a609c4f51047404c94fe21fbf3a0b527a879b2d56ea2493ee4626aec91f59a4d5b0bba4eb83960d91b6d8a26d7711fd6e8b547cb26

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

Filesize
66KB

MD5
4ab521ab83ce06f4027fc1a3e050074e

SHA1
f617a1e5321ce90d44af90578186946f2ee60bf7

SHA256
bf590b98c11d95dc15098b38d134ea90758bc211d8a6874363fc1148c82f05a5

SHA512
2f91602d72ddef0bb757da8fb1bfdb21f212f74a979d1f2d7ab4625feca706a9ba52408f5846e3e50d83e334632a6c9f4f3f4f90e45deaba69a18f7f15ee2cea

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

Filesize
66KB

MD5
cd188b3559806e4f687a357cc78d98e5

SHA1
c3855c457c762d66ba12ce4d5ebbd02e3e78396d

SHA256
eb802811a0d160c459100e056080814b76c392df508cd1c936ebc1ffbfbc6910

SHA512
adee46d1d9fb218e3ef5063783a5f49a8421f3b3eba16afff5e2db2d747b57c3ad96a6ab527d80f5af5114e19d6aaa550d278cdec71db43e931637a18b2e7bfb

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json

Filesize
607B

MD5
0c75970250a6f6eecefaa77b0aaf493e

SHA1
7a85f6963e64b84b9d551965bcaee8bbe7e0fd0a

SHA256
c88da796a3440584e4e7484123bc97d2dfefb3bea4ae936696d779093716296a

SHA512
46fc23e45f377e909d24e54c8ad1cdaac26d5fa2cfb31c6eb086784c64a9110323e3b6782b0bba03a59cc4b3582b6cc4e441075fff1854467e28d9d31f2308a9

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json

Filesize
847B

MD5
8f592b9bb329122c2162c1a1893390fc

SHA1
9aed5c9b06bddb36f83a59ace6868702631a7c90

SHA256
e553f4db5a609b02330c32a8868328154cbb0e6ac236a40f8ece57a29ce7f093

SHA512
75384e57668430f4014d4f4038021726b48e140b0a7f3c015442a03d27f769773d27ada2ef3410352484ef8f652024fcc519375bae809442855e4b64a69fc340

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json

Filesize
846B

MD5
38076c1d337d285e190806a957be2c46

SHA1
f0bb40e1c22c28b4a879d635cc6108e3c58ce369

SHA256
3791d261a64b7900584770358c6df4d2a26efc26cabd0d9d710230126cd32384

SHA512
eef1610ea8c1888f3dbdae585c21c621df1c193504807b480a554daa7fa180977eb32ac23111431fd5e74c55b37fedafe83bc20fd4c877a990a83a32fce4870a

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

Filesize
825B

MD5
d9e654e51a6acb826baae6e2d318b0a7

SHA1
fc35660a497c29a4fb18b3359811a3b070494477

SHA256
44de9ff54e181b6506f7c582249f30aca1ad8c213967b5ef43ace3f043b7c194

SHA512
e4baae769c3d43d7ffc7e943e7f4ebc2e67b62ecc75eb98407012dfe1e2b4b8061eb6f3d62cc595b74f20c128da66a91d0a97201ec8019e20ac16561b8c17766

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json

Filesize
15KB

MD5
11fc04b48ede3a7535e9446470f36b5c

SHA1
a0372521b7d758f1d695296a97dd5363056b8a34

SHA256
9c754b4e187fe92408240d1a6fb18b37c233b65b9a1a503b150613b20c75d3a0

SHA512
6083b8b0dfd784c2cfae8fe1b0f591d2c9073494f1ac3c937865f4208d817406e6f4eb45ab9373c9cabb9a17d2ef7fd7da98c23f13d00618db91b6c5e44e5033

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json

Filesize
15KB

MD5
2bb1e6e702588498a2beb7449e100aeb

SHA1
25fa605ba81b2b40c1df785259a470c64969480d

SHA256
b0a79c0cc745ab86f7ef39c4e41b3343a4e28c5775a8ae3657aa4fc9271b25e1

SHA512
1b2bf4578da164d4fdf94d2f59403ae3e730eb6b82f4c298025bd84a88768f98d3050cac7e095bf275e2c11d5bcd35533c39f4af67c74ccdf78fa2fb476d2e21

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json

Filesize
15KB

MD5
a914547fbf42d3b7093bfec5f34db69b

SHA1
e56a4a2c4e201bda402c323d38fe2b009ecd87bc

SHA256
abffa08b7940e917f7a8533a2c73ce406eff1be9f949b6b4afe1b16f6b6783e6

SHA512
5bb92ebb8a9ee0c7cc06de6e622387c600ff40bed5751eaf94a4cdc91ae449712e7529b85a537da5687cffe198f5dae84ac5f2541746fbc84435bcc9769631ad

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json

Filesize
15KB

MD5
27c4ca08b766d3116b4f8dbbc971ec4c

SHA1
028b0a9cfe1553bab0e6c5a2acce5221580f7844

SHA256
88a587b079c11e2adb5bc523a5ef02fb57eb172e54e536268afc029e34c9008c

SHA512
7fd17d404e0ce1977a40fa76b9cfbb709c30758c3a5dfd4aec8d158a14ec2adfef7ea48a99dfaddfc8f6ee84bb13f823f11073631a96304f7338bc86c17e2b67

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.json

Filesize
11KB

MD5
bd1d0c825f30e1c2247eb0cd9d1479a1

SHA1
523b3afef206faa63a8db410851ad9b273f443ab

SHA256
954274dddc821767e91a5b8c42d4196d5236472a64e885ad732e7bb149e38360

SHA512
18352695b5f0eac445c05899674ce82188129d723af7c1285e4fff22dc1e2862042f8f5d3a370952a59bf5b59560bedb16afcd1871b01f614682161469f8ec26

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.json

Filesize
11KB

MD5
178c5d190fd332e32acd46621af2a7c9

SHA1
0878ac3eb8c347c6a87e343dd9d8f5af8b2eeed4

SHA256
2b5e662f0e56ffcec25eb92e5d8e02b48982b4b9335077ace50c78a4e6fe38c8

SHA512
59f9c2df1fca476a4023e59181c67cbf150e122227fcf97a7d7936bc6a9d869b02bd0c5987bedbcb63de55fbb568e75a7370344a2f03ebe74014e3e6f1bf563e

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json

Filesize
1KB

MD5
13d78f3042e117c95c7a13f1dc69aa31

SHA1
1f8f17139f314e56e4f241de93caa53ab3f9aa96

SHA256
8f917b86c5c71f740246c52c4ddf3bbb55cc0c0c587bf5c9bb602953a630c477

SHA512
dfb7d5d6c9597259582477e66afacfa4ef0c2201b9791dfc5ff6ec1cc4ecd295ca4ce1b2ed6ee9fd1746929bb189fc8704cd0df321c884628bd3eb683e9392a6

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json

Filesize
2KB

MD5
245b2ac7de25292721aa65be2d574d8c

SHA1
a64a4e0e98ce8eadc153eaa90adf145ea67e5e35

SHA256
ccb7bee43cfd9e7c8763fd94936ed9fb1fdad828a81837e153efb766c1532e74

SHA512
52a57dd15c298a84f0f4d040ed73440dd06a8e8fd4da23dba11413386e39f9d4cf2b3967977530580dd8682ef1161fb3788fc969d67c7b43f1190bfbb27a0f6a

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json

Filesize
903B

MD5
2f5569662a1612ce158e04a81f4c89a2

SHA1
7419ae12463091a7ee0bb609dbc431a20b867b84

SHA256
66d012cf2c069567a108873ff15a71636834fc43bb674ba874123f64176b5005

SHA512
07c67b4c6fb7f7b9a08d6c67f7eedb389e96b2f21aa0f5922b31aa9afdb5631b37c417349497168b6c9b894d21f89b2f0001ac293cef5f666fb83b3457fdbbf0

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

Filesize
1KB

MD5
3fcf3ff52b957a4674796c5f1624b2d2

SHA1
aa363418a8435517bbcaefd515095c9a69c33b8d

SHA256
0181b30d6f3e392084d93a728f643589d20e06a411ba95ae48802368dd3272dc

SHA512
1da520d3d5458cf06b78e3ed5972b4987f0886b678bf1ddb0d1f7f9b674badf44078d1973d589c18faa9ece4191c2ad86401c9fd1cac6c79ebedc1edabca87f9

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

Filesize
2KB

MD5
adbae81ec247c5468ff3e65c8a0ba147

SHA1
6c5fd52c93a1410d7b80d030dd56b21edd025cc5

SHA256
06c2754054f2a971494f5f40d262862f616317fcec59140de9b818e119e53497

SHA512
6daca6995a6695702d0ba312a6f3ad1dcd89553d730de545b1badb9088d8b7fee2d1f71f9b66d7381b0b469d7f6cdc7bc475d39cb5162060debc1dd2ab9f1017

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

Filesize
4KB

MD5
7719bed1942119689a5fa6dd6094516d

SHA1
e7c69ca6fa609ea36d0a8f1bf469fac6a0aec66c

SHA256
acee3ae304633f479945f9621ad454164824e27297ff361a83b850061aa1208b

SHA512
e670aa92823b769bb7b050ab4fc57cca939bfa99ef7332a57bef5c1a5ca7e5ffecb034f8636c96dea73c7722565f8b9d0c8e9a19cbb054de35570a09fcb36a38

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json

Filesize
11KB

MD5
13079021ca9a96e661e874cdd4182f6f

SHA1
15ee529d4a38fbbf50a758c4a00bece360003f1f

SHA256
0cdb40679592e834ed984af0a8b227f52c29408f3a5997a36ecba2e411cab08a

SHA512
98c9bcde0df2f5b4b1d23973c7ab3181234058d8b77716d63a4417ee68f3fd91f3ced141b013d8c8d5dcf7b5b17b15a90d53be486ec1de4cde26738d5459018f

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

Filesize
1KB

MD5
510fb365125aeae05863b9a3fccc94f4

SHA1
dac30639081ce3dfc1c604569711adc516636fa8

SHA256
e2f7ba63f1e58a61a04bf5ac7836d1e7821999aa89e50768fd9bcbdad938fc2d

SHA512
68d2d5680180cd4651e700000322b562299552a165b75f4ec673f5a42e0133d8204af3cc6edc99c02486cc702cec5e6a085778adc29a7b338f9579d78a4955f7

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

Filesize
1KB

MD5
510fb365125aeae05863b9a3fccc94f4

SHA1
dac30639081ce3dfc1c604569711adc516636fa8

SHA256
e2f7ba63f1e58a61a04bf5ac7836d1e7821999aa89e50768fd9bcbdad938fc2d

SHA512
68d2d5680180cd4651e700000322b562299552a165b75f4ec673f5a42e0133d8204af3cc6edc99c02486cc702cec5e6a085778adc29a7b338f9579d78a4955f7

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

Filesize
1KB

MD5
f6b55bd3893908ddd6ae16cb3607a9fb

SHA1
3a5659b5cfc969c5815912d60345cb7cbe88cf74

SHA256
9d4c2ee0cbf2615bbfc8b5377b4df6105c387a6b1ccdf7586a5c5007dca9efb6

SHA512
837cecda7c0ed03e90dfb1da035561aabee39dae0286ef224450a3bc85217389df1b285870e749ecea760ed7d3fd6ae52691a6c4d7b359dbe973d041e55b95d2

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

Filesize
1KB

MD5
c3b573ad8332772540ac208f66eb0fb6

SHA1
e53dadb718afa48ce7257589410c1fd88e075446

SHA256
1ccb892dd71c9eca6af6720e590f693fff0d9515e16e2b4b128c756d27cd0c54

SHA512
2b24bcd2ba982bb2a051a29c38ad9dd06710fcc54342e92821fe77d07e0fafde4454b5aa23cca95b308bc55ae096b0176cdbd5f44673bfd085fc16163c6f389f

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

Filesize
1KB

MD5
3ccaf1d2fc59d7bb9d7868395160e8b2

SHA1
4fe2fbef45dc7f03631b4642015c658cf9d7908c

SHA256
f3187dbc64e294a85b47ba01a79ab445c030ea5677fbf893d61e0d7898e334a6

SHA512
a994dde3abaeb9db31ddf84e2ce5aa67f0d747aae428114d88af917fa1b74c21493072256f42048daff9d212bfff76f423a2a264ac42adba6fa2728609a55cb8

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

Filesize
1KB

MD5
744b53b876adec0fb3b157a73f98dc24

SHA1
060d31449c258deec9cc1d98121663f6f2d132d6

SHA256
8f9b44996a012912dd2d10f220c10ce3006b092211b4df6ca00bfda9c7a04c42

SHA512
e3f2b782f866b09bcc98a967c9bf012a38e31a5411ad204a5c4bf6f066f6d3261c1217681652b628fdbc320c284a09161caea3b91047cd2274f76b3413f7bdb2

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

Filesize
1KB

MD5
744b53b876adec0fb3b157a73f98dc24

SHA1
060d31449c258deec9cc1d98121663f6f2d132d6

SHA256
8f9b44996a012912dd2d10f220c10ce3006b092211b4df6ca00bfda9c7a04c42

SHA512
e3f2b782f866b09bcc98a967c9bf012a38e31a5411ad204a5c4bf6f066f6d3261c1217681652b628fdbc320c284a09161caea3b91047cd2274f76b3413f7bdb2

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak

Filesize
1KB

MD5
744b53b876adec0fb3b157a73f98dc24

SHA1
060d31449c258deec9cc1d98121663f6f2d132d6

SHA256
8f9b44996a012912dd2d10f220c10ce3006b092211b4df6ca00bfda9c7a04c42

SHA512
e3f2b782f866b09bcc98a967c9bf012a38e31a5411ad204a5c4bf6f066f6d3261c1217681652b628fdbc320c284a09161caea3b91047cd2274f76b3413f7bdb2

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Actions.dll

Filesize
5.0MB

MD5
1eff53d95ecaf6bbfffe80d866d8e1dd

SHA1
d7ef7d7c77fd04b2c0eb8c16bb3cd08057f6742f

SHA256
6dd748f7ca56125cbe158fa3612f08e7312ef58ad5375e6b7ab5532cc16ca0ac

SHA512
c59b8e6f0b238a247e64b9c7bb42213dadac1dada63542830a6292361174c935c0c662b2d1aed3fb6100cc4993297b1eaf25e328f2b4613458c4ffca63b9f02d

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\BrowserSDKDLL.dll

Filesize
5.8MB

MD5
1ed53171d00f440f29a12f9beb84dac4

SHA1
4d9a1e3579b0999f1ab2fa818b588411e9ee920c

SHA256
e659e687a872050f9e65d78992d16bd9b393cf3f8e8c94e0e15fb42b7065327e

SHA512
17161cfc672d1b996b8af4ebac17f9a8a3807f38c9a23e2e5b4dadcd9a21c3a64faec9bf59147022a9df88b80f89300f1b537091289bd7a42806bd206a317e6e

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.nm

Filesize
336KB

MD5
d9c1dd1876bc2813d4c62bff8af70761

SHA1
09f800bd9195c3f1f06f4ba35287cd513fd81922

SHA256
b2073175a1a63c373b29312ce7a71d93af17b1fe107b85c22b9f7c9922f296b3

SHA512
e7839bbd74a1fadac29697bda91a3d1bbcb54a43ef578b9b2522bbe69befff6cde26b90371ad734d40fc7672a7811c07174a835beccc6bc34ece6bb2a155c8be

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.sr

Filesize
20.8MB

MD5
06e68ce0907c0fba38e17aadf00590da

SHA1
af348508a26e7f19363f7b4353a6cf68b49c105a

SHA256
1545a8dc329a1d1c6d77517ef1aa929aa074120045e90ed2027c8721d8b92367

SHA512
db59c7f900103ac241467e23f992698934f37e7d101eee95b898a3c39fc5b7c952457c5d07cab06eb565db0747bfecfdb174b1aac14eb5736797925b9d32206a

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\MBAMCore.dll

Filesize
6.6MB

MD5
f5326e215357788237b4c4e78248010b

SHA1
3fb03c85f0180dc60a9756b50b44e4a59f056be3

SHA256
0d0525e66bae8605c0afa6b877ceee4c9b75be15c5c47ba8961041b3bdb848de

SHA512
93f456a22d30fde2e5330573f6aa24b7b3ebc633fbb7171b135e4030c127b17c5e3cb2c9a56f62355070c9a6fde564144fe56e1674f5f0d905691e77854789ef

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\cfg.bin

Filesize
1KB

MD5
42dc081efeaeed00967fd339278d6c97

SHA1
6969f00e1bcb5423395fccc12584e46cabcda9db

SHA256
dbaf53794113e4172f5c78d4b1ffdc0a2f1d7a35e5d8e8893f0c2b5d1a3f4bb9

SHA512
7ca9cbbb9e9820d6fffe13709d42b90df1fe58060c7a8342c4d3ccb72fe063b3cfcae1797d4bfa897fcd4955bdb5e0fdd585a84c0f7b7479966df27c0245bd0c

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\clean.mbdb

Filesize
10KB

MD5
942cf3b533c8a655cd9d65898e929def

SHA1
24aad2f3d7fb519eac85128175821cb6f2a3bfc8

SHA256
a0dcb255872375b505fd833d48086e580005b26ac835117e90e0fbe71bbe0b94

SHA512
bd5c6dd05ea0c9f793c2903b5407fe039786da5e4a744a2eb1b3f952b93190c6ad587241ce8e1242dbf6c4717f1e5043bd81b3a612522aaf77f7593db7eda1e5

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dbmanifest2.dat

Filesize
924B

MD5
e621b8fc16f11319f24d73316fb1b518

SHA1
a2ed75206ff466a05f4d2b89a10c5a2f26c5ccf4

SHA256
7246da1dfb1efa92449bee13f3543defd94b074d0989a0c1da59117644d8bd5e

SHA512
bb6e517cef73ecc5d919a4e3bf045a840a4d6353a93eb4828201700698d90fe7c246cf12cb3d2cc1acd6e8fbd19aee6bf4c513d0d2e134166f6489b8fad4ad5d

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dynconfig.dat

Filesize
39KB

MD5
10f23e7c8c791b91c86cd966d67b7bc7

SHA1
3f596093b2bc33f7a2554818f8e41adbbd101961

SHA256
008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc

SHA512
2d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\exclusions.txt

Filesize
23KB

MD5
aef4eca7ee01bb1a146751c4d0510d2d

SHA1
5cf2273da41147126e5e1eabd3182f19304eea25

SHA256
9e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f

SHA512
d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\ig.exe

Filesize
1.8MB

MD5
8b8dce48722a187976860c198d8f4d65

SHA1
f9346d6f05b8f232552d26eaba71aa482e324f57

SHA256
66035f0d7b5b3dac02e855e764f2a561480edaa4fc7e83cbc3c34c082b391969

SHA512
3771dd731c0ff921d06daec013908fe64a10c8a526f517d359b0f3921c6626fd9af371d46751258134c698c3d1c001977d8b27f400c996344c78a5a530b199f8

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\mbdigsig2.dat

Filesize
514B

MD5
477d34da327ce93c3dabcd7074450505

SHA1
760d8151df4ee63dd32cc327aed1c84d9502e26b

SHA256
0c93db0e98d9ac63155565b26b0810f6db49bb9777272af97b4639efe6041787

SHA512
8d0f8b77a82d6c1e5e441ee6bb71d0d52af67cc958a2b272d49c66a84b3a47ca802865ca768dccfc288847ae94c3310765ded29991b66982121959c1b60e0984

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\prot.mbdb

Filesize
24B

MD5
546d9e30eadad8b22f5b3ffa875144bf

SHA1
3b323ffef009bfe0662c2bd30bb06af6dfc68e4d

SHA256
6089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f

SHA512
3478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rdefs.mbdb

Filesize
24B

MD5
2f7423ca7c6a0f1339980f3c8c7de9f8

SHA1
102c77faa28885354cfe6725d987bc23bc7108ba

SHA256
850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55

SHA512
e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rules.mbdb

Filesize
9.1MB

MD5
4480dcbe1a78435874d932cb726c7767

SHA1
0ef0b41b3573f04b9beb647e73edd3cf35d62e6e

SHA256
d1eef586f327a1afdb96e7b270288ebb9c26a8d871c82d94d9b29b147da1cb31

SHA512
9db54510649d194e88e4b101bfbf7c991856ec454383a6b4c7c5d13a330cf21e56ad1178808a22f1470eafaa674ee0cdde07ef8c3847e8a3d7e4b633390987e2

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\sample.dll

Filesize
528KB

MD5
0d964850f272eb25013c951e9d76c028

SHA1
e581fb83527b84c4e55912a9f88107e9ddadfe6c

SHA256
2974f71ff7763c6d4844dd67d139d137a85062fe8e8c111e75e7614ac8091b4e

SHA512
a7c0e6252091240e33af64ff47208ed4a7c8e5be113fa4f36497280a0523c41e1096112a5fcf5290d61e36d414f970e9aff07a3a5b0ff586028dc4fd6b881f9c

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\scan.mbdb

Filesize
1009KB

MD5
fb4d8f38b7647747d3dbde7a8966133a

SHA1
7a9b5b5e6544fce58086b28feaf3fddb774aaa68

SHA256
5c1e1fc1fe92930d4fbf51f715001a1be6e97ef9a794067a70d6ff9378cf5c39

SHA512
106a247d9d43a9b7d72f4d4add43c2ca39e9a8cd865614acafb9af32f7e4a561fb16d6fe7243695e6b9dc92c1a65b37f3c6df4fb95bccb12de96d254a50281df

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\tids.mbdb

Filesize
176KB

MD5
6bf59b6d4c82122cd4f7bb182b7eaed6

SHA1
4c4e0453365d1ee5a15f8ce8d3d83c4c27b2dcfd

SHA256
642dea3e930d451b877eae80f2b35b2b428863d6c1d353ab21be2bb21203399e

SHA512
209686c7d8349392e6442cf726bb8a605186d4b07fdc8593f36d4963325e0c863274003b13fc75fc1b6ebfa9e3d7fb4ccf6a0b0c672f737c4619aa92552cae40

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\wprot2.mbdb

Filesize
41.9MB

MD5
73d425b786b2e959a6395dd9eb419d7f

SHA1
714baea6a04325cf98659bfbef60d4c8e806531c

SHA256
df86db47728a040a839a1f1cc706977010c95459f8f00993aa9b06dd7d44da55

SHA512
a8267b648b5c668a58bd376d582616b240e9f88f60a7d6d0d0d7f2edf3f7b37fcf7cac41e7795d631d61ae7386dc3803ac385410335c2f74f30807ff7434ad40

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\pkgvers.dat

Filesize
74B

MD5
84ca7ff05060a539c32bb8ec45e3c14a

SHA1
7d39eb9218eab0ddf50cb5ee4e3b295bd531191d

SHA256
4a86e9436e2129378eb92ef60617045727a6e158add919c62fc5a14d294529ac

SHA512
d014762574e3ca40e7dfc9c3216bc395b2c31d519b9cbdc1944fe5a8a6bfeb18b24dd2e25971dc602fa586080f67ec591ee3110fbc4831ab8d75de6a61ef0327

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
342be62313dab4970ff22b7fea8d0873

SHA1
f73558f6b8e5f3f40c5051a538c8fe2e994cfd05

SHA256
0bc96704325f901d169745aacf06f19cd3bf24445dc9c8b1309f20d06d8fd6a7

SHA512
651b3dfc0bfb7b4f1b416c67827ba0ba8b3c34244f094683787888a522822dff6c7b9d8bbe7d605b2785bf3992999cefc5531e0eb19f72cb9c2dcb39d10b27c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d367e3215fca5de3d326dce68185ddc9

SHA1
20fa585da79a20c4d4871ed482b52ef50ff61bbf

SHA256
1f14dfe4cf2af421bad5bd5b225ae6a82eae6bff05eba6a129cbc61c24d0045a

SHA512
961b6f72894d4983dfc1d8533692eddeb9bc295dd6b9646c465dd5c5358d6e182039014c3f0a3acdaecd79d2de62870f1f1e7eac751685bdce3eb3027b8ca654

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
12f425113c9474c6731f47c735cfcf31

SHA1
f19180e6b024d3ca7dc4ef87da12beb933e962f9

SHA256
2c2c132aa28e41f38a2661514d8109bc1325b0e311571e82eefd319bb7b6b658

SHA512
62169f36f59ebdeface848e8d80b821620f0275e18d42d7074fcdf47ca0b578a65d998da3ac221a1a165a128e1ee9b24df4113a2e291af19f0540ef9891da3f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
342be62313dab4970ff22b7fea8d0873

SHA1
f73558f6b8e5f3f40c5051a538c8fe2e994cfd05

SHA256
0bc96704325f901d169745aacf06f19cd3bf24445dc9c8b1309f20d06d8fd6a7

SHA512
651b3dfc0bfb7b4f1b416c67827ba0ba8b3c34244f094683787888a522822dff6c7b9d8bbe7d605b2785bf3992999cefc5531e0eb19f72cb9c2dcb39d10b27c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5a69d250-4c2c-4203-bdf3-088ff6afb628.tmp

Filesize
12KB

MD5
a805477b16d51eb3c78362b3671640c5

SHA1
4282d34d2e47c92e6fea2be2ec5714f134875de0

SHA256
74bc5e8790dce6f9fdc91cb6defe58f32278cd619e389e528b0eb2135d40108c

SHA512
6711e70cd5339f845b93db58533d483b8ccffda7f0052c117385f1a40670f672b34a180676390724aa8a535eef5ceb0f4a44b19fddaaa44324a131fb634d71b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
c5f15224ce5738ffd0fe42091e4677e6

SHA1
74e18ec631ddb38262e12102035390cb9351290f

SHA256
2889bf3ba13fa93fd4557cf9efd5484702916244767bc88a36a71fd68cb2ff79

SHA512
e2ad64b827d1bf83131d51afdf106c8f3c4b5741fe926c8c9fbb300d1381c4e5afce5589b3e3a3d3da2f6c989fd9deb8c3130501e7823f10a90924cf9d834d0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
a1f3a6eefb62a3303fb144e4ba437be6

SHA1
6c2804a0776ef26fd4bcd987c2e2dbc0916631f7

SHA256
eb4cc9acc17eb343b4e07d6ce6a86f7e0726e05c201b2da6918e577145d01523

SHA512
37d0407452ef4929e3d31069f64ed297250e9bfc8dc4f6a20ce213409c3ebc79abde7fa20a67b7388ad91334a77f72c1b40afc10c2ff878dc3c02bdbfe370393

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
cae41cae085505d2512fa6d7dd2003b8

SHA1
0f73d513296027a99bfcd27021a807a62d509b10

SHA256
be02206636d330a07c701df1f2529bd32168734b1ed030ae7477461bdb5bf70b

SHA512
11cb486893fd8946bc9e4038629c13517af6578ebe72f497b8a9f58d1a2652392c3d6e1f329ab1512f4e1d065d7509da953c25c612e9c8997e5861a1e962e47a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
4.0MB

MD5
fdc425e2311575d327d964c066ee26af

SHA1
bf40b3d45aa7c497e82f8c2f30fafd4c6009bcee

SHA256
b4b46d90465e9d25c24a52ff579a0ce33e32a7d9ce2cae9b8ff5c94350552951

SHA512
9e9800bfdabcca49cd4e1e12d46c3cc6faec8ceb9e349fbf403f2c714a2cf9e4ef9b16f854ecf5b6525ed4d1a4c0bef2430699b43e02539ddd19017cc619484b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
20KB

MD5
923a543cc619ea568f91b723d9fb1ef0

SHA1
6f4ade25559645c741d7327c6e16521e43d7e1f9

SHA256
bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

SHA512
a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
332KB

MD5
2f712636e2bca4c7456027a2954c5bb2

SHA1
07239dcff3074aaa7b44960e205d73f54c6cba71

SHA256
98cc04a139be9cbf603ecbbfb630c1bb6bc76477515e39dcb3ce053a69218b3d

SHA512
abe4bd4f288cd8d423a4fcf935a9bfc72b567bace219854d46b94e4397fc42202e5ef4dc44e5dd97dc084641f4a9e2c17a36c64634336c80aca06cff7d479105

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
120KB

MD5
ca8243fbf01a8771fa3ec0993a5db294

SHA1
0945606a078b5eb7c4a4d76457c0d841c987eff7

SHA256
31ea60cdab5e4b29917dac9bfb20ec23c6e166a58f5bdbd5f8a60418595d39a8

SHA512
454dad0cb36e884043b8a76d32be8af495fbe9ed95c608bc6dfc2dbfe43d5312449f34260eac5fdad9eee4407bd80b9e7e29715005c23656b47892667073481c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
74KB

MD5
69f475048d055a7e3aa6693418381062

SHA1
40b6519e49658c9c9c93d9646efa6a86869baed7

SHA256
7bab15e1545c8f96d99da5c199afffa3f9d24e004622814de29a71c82852a667

SHA512
e34b628e943c4c4583a6eb0226d8d2562f16bd462fdc2591e924be63a39c317090faa4e71cf90ab22fc376dffd384a5528c0d224bea9ab2f176b4f120f259b12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
39KB

MD5
17b9bb9509fa8aa6e3ef890dc6cb9917

SHA1
81d4f55fe01ad0a40d0d798b102ca826e97c0de1

SHA256
b1e8315c3e639293576ca2ff44b6374643ec3d70faad0b74972bd3d0183d1efe

SHA512
0a22b4d514642116d483d522bf3a86ac3fa4ed7e9931a67e401cb98ced433316711416f49682ba3014dc0249356a65122e09465d84331574c59e62c293b0344c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
69KB

MD5
c33c3755c9bc5c370e51bd72a524da35

SHA1
7b4d2ef2b5e0188562afcd4c87060a809a7d2919

SHA256
e30aeba2b555fe999989e290128024451d7b1bccd13060ce16990a39937a3113

SHA512
7c656b1f7e9806208c87b1f22d27f07f400c5bdd3fd258056a4046c7999d4f83f6c473800b09e36450eff9ff9dd86d045eedead515aeb4bdb55e9d9889e90de5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
20KB

MD5
c6c201c282dcecc8619df2ab4822e8a0

SHA1
542dcc2e6c3e7ffa721ab233f43357edfac50785

SHA256
a6910521e89286df6f56763d2e074bb1127073029ca3ff5e55fde48c40f4f5f1

SHA512
5b1a877254462bcc6db356c6bb704c12d76c1e1476ccf22e0f95560f40681da0d8e137f83a58d01e7e4d791e22243f3f12e9f40260d19fd8b2bbf0410da80a73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
89KB

MD5
20b4214373f69aa87de9275e453f6b2d

SHA1
05d5a9980b96319015843eee1bd58c5e6673e0c2

SHA256
aa3989bee002801f726b171dcc39c806371112d0cfd4b4d1d4ae91495a419820

SHA512
c1e86e909473386b890d25d934de803f313a8d8572eb54984b97f3f9b2b88cbe2fb43a20f9c3361b53b040b3b61afb154b3ec99a60e35df8cf3563dabf335f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
1008KB

MD5
9d8cfaec22e61ca1b7cc22df63743709

SHA1
f88ffc0756ac9e7f5760076f741af490fcc8fc1a

SHA256
4e571a58acaa3f7fd70b6f4777a62cf09be98de4ae06ab86e8795c05f3b935cf

SHA512
41a35dcfccf501c7bee5b4febbb8a7cedf15c21921d4617dd48acf11af7e158b0ea92eb0476365a24eee760f66f6b32cbc17b8b3b247b89d4eb7a5ffa9199097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000055

Filesize
76KB

MD5
e39d1312fd390a270588b762ecfbb29d

SHA1
8bb24dd678e27fd26c416d05a459916e9f6133be

SHA256
51a7bfc2b29431647cb079fa1ff37d70c9dba721cdd31874f68e8ac4b2dbe908

SHA512
5ddc9b97714733926b201f68f9af19acbd2425f3c9933b8b6366355b93aca7ad046e785cf0c128bc77d99c23c111f2fa5564a7b11552a1fd57d207b095168394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000056

Filesize
553KB

MD5
24f2e5ee0f326645d91a4891a67041f0

SHA1
253a203d92fe15a606a353a2aa20bbd35786d34f

SHA256
7cf30d56a0499d7949f82361f7927058aca15b7d848212211a956b89b738fa8a

SHA512
adbf61775184ebab9a46f275d45b2c11bc57871f010449df76cebb8483f204397e14fd590bccdc2c1165e9382a204b807c5ffe6924ddf64be7bbb08a63fe1caf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000057

Filesize
239KB

MD5
9308fb583312277330f37e600cc7dbbf

SHA1
1613f6eb2b18a20a47a04ce1abb436b5e358e726

SHA256
bbb0dfb2b69bf3581e59e2270a4e778dcfc88a1da28e6dd2027ba46ad439297f

SHA512
29682913ed595fe3005ee73bfc1e35f7957bf28a011c21404b0b1a97f7c4742f4a9519619449b22f6bfc5bd4a24df3f054b0da72f218724701e90f137cb10b9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000a3

Filesize
251KB

MD5
1a4872a3d1355b5fe1cad0dada14181d

SHA1
92dabad7883208ee02d72282b37981e0ddf7e53e

SHA256
80b39742cc5c078a3b7033e10390acd56d236f5fb9d53e5d0b25f8dcc88bcc76

SHA512
ec3e1b755dbd54500b189453587978b6dc1f95e1ef32bfa67d81e97abe9b47ed734f4478bbc0cd77b99d4826aa55e2f235373ddd1bdd226311dc54fe8ef66062

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0933ac4f8a280559_0

Filesize
18KB

MD5
652ec915b7ad8c6379a9b966d2d470da

SHA1
28c09e5c9f73af79c104e0fa1f985de64eec53c3

SHA256
b5b1c4c32b239fa5471de580e0ec8cae05421b9790339393ec10f9bfd906639c

SHA512
79f1e1b1af9b6bfabb4cb4c45ce9437cc59c6f6d7caf4052a80d10288af4dd478d98fda7dbe37c45c06beb58b5e2cb878b8ce0f65a99f6d761a488a9af47f4df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\345ce62e0d8eec14_0

Filesize
388B

MD5
c0be0e4c847f76abc04940281ee87723

SHA1
3c3f79325fac68a6f8371ba09823c75147b5ae49

SHA256
6910d447063e6762633748b7ae054e0133ce3808dbfbd6ee6d829cea4acbaa09

SHA512
1072520954837264c722f73bd8cd8f7a71018f1ad542f6bec8d06c84ae8e9a68b4b36e3b9714d615285d5a9aedee502f7468eb8d142c84b589daf756835011f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\345ce62e0d8eec14_0

Filesize
340B

MD5
807df9a47c074dd8aa6915b99be783a9

SHA1
204f1fa7323e3746dd2942ff4ae9ecaf36ea6c15

SHA256
dfe8017f26cd1a148a543bd9d3c2e4ba0af5e544d275060b90ad10b55842054e

SHA512
d3c24ce4828b2091ba5b1268563522751f13fa6ff2516c967229f02957198299ba4c5bf222cd8a03853cbd791c1c1b54fe3e28c95ea41808ed5963f3e420e745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3f204ad73750ac8d_0

Filesize
222KB

MD5
e54fbb94a1a408bfe710604d5891938a

SHA1
714b024036104fe103b36079857101e3ce92a559

SHA256
0baea099938eefdc215150ee558361e1f116fc8708322f4ca8f998675ccc0d75

SHA512
3037e4351f731ed4429304a4e2202a15ae42853dd50b3b1b85eba718b46a683bc5ab7106de3e7ae7fc3cb4409a6d1b5ac19726921259f7880670938216877723

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\653e24a1d1a661e1_0

Filesize
1.2MB

MD5
99dd2d754828fc4e046a40ffea00ffc4

SHA1
76900f0cdf191e303989398efb53668eb60a8053

SHA256
254ce86aa95b24b8013e613da1288c0c060080b167387a7750699949ab6d2574

SHA512
852bd241e82b336e8f3a72485b23d1e1245f7acd8ef51804ce19bc77c14a8dde63a97c0020a42bdbf79f1b0d5798e3984252fd594d43bce02e19213eebe51d36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\656a4685739b5f79_0

Filesize
413B

MD5
ef75945df2f3f4c4da397d5b963be959

SHA1
3166977cf61906c92ac0e6fe89edaf4dd66a0226

SHA256
06c951021ad020645516b0b23cd383478d2c33538831fb1fc3646b2b3a3df91c

SHA512
ec5a65d6d21a8d26d4fa1dcf336dcf61d15b15007488f04c8af29ce91b5470928158fe9c842cd5388dfc6f3c05227426ad09ec8539a4fb833115f59a61551785

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\656a4685739b5f79_0

Filesize
365B

MD5
8728f1aee510cbb88e30e17ff1de4b09

SHA1
e2acfb441a4fdc766f7e60d56bc940decb9332dd

SHA256
e98af3e6484e5bd186707b5810454c879553c18536166a3c8e5b13faf1345fda

SHA512
18cec0a5b46352e1d368c4b8cf24494c95610a551ebdafe012336a807baf29682a23705cbf6a43bb44669e98d8bbc07033e3dfc8f904745d14f34d30497b4d7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\71eeb0ae6ae16573_0

Filesize
141KB

MD5
836c28731b4fa56b0bda0ec359523490

SHA1
6cdb0170895cfcfaaf71eff1471319d43dfb6a21

SHA256
ce2059ae5956ccb297e0f213109ae4c56625f43cecc71d21c7a42254f4141481

SHA512
6309abea9f792032be6639f50417e123b5310983eea0710702652156e3c3d7adcad4678c46cba8fe9074d7084dba7e1be71529a59595d950bbefbd62121515cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\776f393a30da1de8_0

Filesize
12KB

MD5
56ba271bb40360f625414b72cd85a2ee

SHA1
afc0beb18c8c27a340e5b2bf6517c90676a3c4dd

SHA256
e7a113a1659781516fce5a811f2d3062c566ffc05db80055daa65a3346234273

SHA512
266ce286fb2a5abcce20c1243e82477c9c15770521b6309d4b91b50939db8dcf2ca6d13e139a78479d36ec34f7b1e33348a7feb895f26eb877e6b5624773b3a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b766853aa40f924d_0

Filesize
3KB

MD5
19ea99162a133b7023fd8c09e7d3bbce

SHA1
dc5c19a3396c948e7ca706b5935f24cb08ca86ca

SHA256
ca9a41dc2c746718e588068aef6c2748858afee146dd039b353f5bd0f409a7e7

SHA512
c6859e21bfd8795f67903068fd15bf999de6a2e241070fff12182b31e511e3edf8b7f4068a20dc13c6d07715b37f86183676b3f88055853ddab93d598dd7a7a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\db6637555e1adb82_0

Filesize
2KB

MD5
0fb27bf22378be5b4c92b723e9c6f7ee

SHA1
d1338aed260400ef8b0471740b5624365fde410c

SHA256
db3da5a9d4a0e30c0a02954569c8e0b59d33523a8c0ac9cb7db762b565c42931

SHA512
0e2196521dc26f30950b85a47c0f3dbc2358b0451c7674369e7719923f66427647d91d9ee4ea21e9c4d60722e98eefd30198e11510e0d8c54fa8349a9cad6b6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\db6637555e1adb82_0

Filesize
2KB

MD5
46c72bd8788b794858c9242ad0a92f00

SHA1
ffde20bc44ce3372f2e55a83cc66a16e1c25ea54

SHA256
d0309741d89643bf6c72c1db01fcf6bb6a45d318c9bb2a80d18597d151d136b0

SHA512
d0f2cbdf1287e92f373d780981d6a1312386a4c6a9f31a4f183eb57fbd7c36ab6f1c661a3baab08fe00ffac600199f6b7bfd2ba562c5cf3b11085a09ccd1f476

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
090bb8a0ba9f39e06d01c551ee388d4a

SHA1
02d146cfce79b6c5e19da50996365846f8692a0b

SHA256
cec15c5eec4233575c9d06c25b03d0d8782362218064d433a4b4a71278f6c4bf

SHA512
d21f73e2f1b9c3b0276e80d3e5d1dd76a176425daab9c9959858f26f3f45684a8594288443092c5812e0ef2c7463fa6225461c55309b7345b49b54cb68fc0f24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
893f8c2e6968b2c96df6d6836580e388

SHA1
3fd6133e79e6f0dede289d47c0b6c8c88e0ea818

SHA256
110dfd7a860f0d7e82629773cedf6d7105c4736d82d28ec28b328c6b92f0f7a2

SHA512
9db37adbefba9faed866b6f5795c766b7d62891ea7bf6d18dc2669ff60b3d7677faabc09e146095d66f4c7d7f0ab5baeaba71b87a42f0b3cd8d914ad269b01ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
893f8c2e6968b2c96df6d6836580e388

SHA1
3fd6133e79e6f0dede289d47c0b6c8c88e0ea818

SHA256
110dfd7a860f0d7e82629773cedf6d7105c4736d82d28ec28b328c6b92f0f7a2

SHA512
9db37adbefba9faed866b6f5795c766b7d62891ea7bf6d18dc2669ff60b3d7677faabc09e146095d66f4c7d7f0ab5baeaba71b87a42f0b3cd8d914ad269b01ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
867b3d69a2cd138eccaa189c215335ff

SHA1
bb40250556d7b7d64d66d550469f55cd4fa0c7f1

SHA256
1423de29a77fa64c112ed2856a2f89eb69ee2c2fbb1aaa7628a80bd1500fd583

SHA512
dc715e7d34071984caa7b21232465d57b61953c22b143f9254ba9319f6f3c9123d25378fd3adf3ada659d296a01a8b8d8d938391f90556869f1def466d9c22f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
3508d32fcf80b51f2f25537e587fbfb5

SHA1
ca4f734f68878938d17a7db76c28458e44c4121a

SHA256
9cb6b697fba3fc516e23abb55cfffcf97ffef4c49792a53d4111e143f0201cf4

SHA512
2df278330e394c96b5ecc0ecc9b1669086a82e5d115d9eb339be62568f5ada9515836c8ad7aad3301146e893009abef729c79ababce83c4a528b05b8d5bf5d47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies-journal

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
319B

MD5
c5a5a4fea8f1ffebeebea9ef41a97914

SHA1
b561d5306132c97226e311045edf4c037e55555b

SHA256
b304b1344b99defdb07b5a9b214c18da6475f83e29881e2c7d87d98f6a690e9b

SHA512
fcc22c2237201f9388084fe50f428e489d03e3dbb3d62e37c740403621451dc0f14f86f48f489f9678bf891894a615441f76da008302d0dd4b5e1773d2b3f8c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
caba87fb51d9d334edf95ac1bb410663

SHA1
934a4a53108e4e1ccf6bee10253a6c6428b401a5

SHA256
abcbdc2dcfb8aba56443ad56bb374d3a4e207a3360e582cb92d30e02dce3e5fb

SHA512
a54b27419c17aadad0e581bd9af459c4a863bd1c39b654e4efed3f73fce39063c05725d97a14d4c4eb74591526d771fd1039e060e8a65373beb9bbe283ceb6e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons-journal

Filesize
6KB

MD5
6077746db99d30c5f7243692d9a73c3b

SHA1
61630a6bbc682d16cb7fa572bed8a0799e1974d2

SHA256
483b50943b060ef661e0998a3845be8fe3452f88735dbb43d1def4fec98b5c1c

SHA512
9bc95d7922eb09300330d524d17b0f44c5f2711b111d27905eaa6291be934f00c4437c04fad929fbe7bba87cce093ec58734266df02565ae5a397332ae41b90d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
dd98ee422d40f8df33fff2235bed0cce

SHA1
c723ef91a8fc73e04e9d1de197a3c0fbf2067ad0

SHA256
c2883915f964c44810093c2447bfb3c285a5285cf1effc8a59c64f26ea014768

SHA512
b7a51242e3029a6652e453d5c36c0911a0586c06ee39c0120f15f4caafce869b2b118aed42f330bb9e0babe6384ac80751b90e470885b64969968ac09038113a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
1KB

MD5
bbd186a12d2188fd1843bf702e85ff05

SHA1
a944913d9223f800b4e884157dcff02f330b384b

SHA256
0fdab06d1aaa6f4bdcfa232c1f606ca33a14baa0c55d5609653066b861300f90

SHA512
f832f70a00efd508737482ef1ff4e44576b0cb32716f1859cecd0624707a65e2f374e741859fdb9d63c5036506daff58d2017eb868838dccbf86226e7a34791a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Filesize
28KB

MD5
a67bcf4bba11bde9897fec37d238b5a9

SHA1
9b7a965767e3e37068d571430b8f9bbb4838d325

SHA256
b77e2e35b3fab299b3ad46c095c3edd7ad2e12cd3181c487561c5b121d00e211

SHA512
b615590d3070972eafb56844be0429798fa410a0bd7d9518b13227a18d8cbd55165936a53d40e1a838f5cd20ef2f9738840dcb809125aaa6b127a5a5aaa409e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG.old

Filesize
745B

MD5
c8b430d9bf45dbda978dd58a457f3333

SHA1
b90e8e23fce42f1f936bbe26f717ed6552488912

SHA256
1953b8833db81597defaf0065bd7e9bdf08fdbf3c7ae012b7c5729346b4b8f0b

SHA512
580b99d0325f7d935c70eda301bf85a8c45f2efb83beea9caa0d79c7c87bf6ec78b7f6dae93971c887d246f805138d93b28db612b9eca75c429b4eaf10364e1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG.old

Filesize
649B

MD5
765168fb3f8d18afb30e61cc2092e50a

SHA1
45546b11477fc32da80b3a0da1e741586e913d19

SHA256
12b89227f29cb25e16323f24e6c2c77698a1942928858d22902b14fbf09ca871

SHA512
64fd93a57d6202470514ae07416ac8834ba99384ef11526dba761a44d975f157751ae71d94c13ec1fa54bed421fd5acce72194aa2dbab8ffb3025c34ea5ff5fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
1KB

MD5
ecd8883b7c472d8d01d2e490b44efd71

SHA1
74ec85493796232fc6097f46ea08b1c538bf22ae

SHA256
b4f66f7b5db3375a82c6dab324a2fbaf3c9bec1536f1b5502bcef912cbd6bbee

SHA512
710ac21ead78bed25ff9cf41b906abe62cf2ec1a92f8477c7cb2104bfaa3801e4fb4617e817cb34be19497d2866461f98c0b9ed5c0fb0ca1bd7c9aecb1b35e62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
47fc5446551b61907bfcc9a904126104

SHA1
066afd16966333e6a6a9f0565cd5a6c0109d1d11

SHA256
051b8ba88b816d0cae553e325616747c05c61ab623a12726d6673902931011ed

SHA512
3a6398cee27e8069845b47d60487407bf7397abb4ed909ae734d390238fee06e3ea734a1b3f490c13ec8ce4f67876d0c3047c8f7585cb14d481d58147c6c97b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f3176e233ca29ffd67dff3c4288e8463

SHA1
3f7cec2a5438b5f488bca82c11e855bdcc15d9c9

SHA256
8dc510d07b8b8e80ab029e7351defd9ba5a3385f949c443fc2ebdcac2ffadd4f

SHA512
fe071f375a80d344647e629729e7d0864cf9ebf3b7d2dee3ef552753a04a19ff801fe0a9c3dfd060158964664dd56e9a29778e62cddcd2095d5b49bc764dddc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f3176e233ca29ffd67dff3c4288e8463

SHA1
3f7cec2a5438b5f488bca82c11e855bdcc15d9c9

SHA256
8dc510d07b8b8e80ab029e7351defd9ba5a3385f949c443fc2ebdcac2ffadd4f

SHA512
fe071f375a80d344647e629729e7d0864cf9ebf3b7d2dee3ef552753a04a19ff801fe0a9c3dfd060158964664dd56e9a29778e62cddcd2095d5b49bc764dddc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
4699925b5a7ba4b6a2541be24af12453

SHA1
35c960c61809556e3f5944cd3d6434db4bb65e49

SHA256
4658f2a4d756189d7d506cc42fc801dc3a5bd2f828c735ce5222c15e946aa7d7

SHA512
fdac756b3587b1646f25b629251d4b4cff295e066d7083aa529bd6a04f9d8316e5032aa7fa078c8950386941dfb90776e731a5f96725a82ba62e467cfab18f06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
1d9c97f9785858768797c6ff5587719d

SHA1
6d025a852dd9bcff828ae1f92d0dfc2672a3feff

SHA256
217bfc7c557d0b10e9f01ff02464567507e66b07e43247e46e907e825371bd67

SHA512
942975ee14c352df5a8abaef5a7e30c1d7aa059b1642a44608920ad378655c99d3f6a57d67c50b0b1d9c419c5192f862bd5c51bd46e1907aa8d9b934a8ba8e24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
c4387a0008df7d998224bb561800c459

SHA1
5df14c99ae2bb3c53f95218d9a287d4e027f5dd9

SHA256
ee706abd7cef6226350476d59caa3ad3bd02bfe3275e61dd1a5902132fc0a246

SHA512
68136e3ceb3437844467bf38776eb3b5fab1f550e77c815cc1a4ab69f2c3e50e9eb9a6b0d9462750905df7c9795540a99beb40c31a483288c0742a40996adf84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
126053fe92ba1676c73997f3918f3fc9

SHA1
5f0a2e2e0eddbcc4311246909f8488b1f5fa03cc

SHA256
28961d263c4478b9109bf10c1354dd4e2060a3efd766e5708201f18b52123071

SHA512
f315d77ecd0045b828a64d3d0a87ee384c58ac4a12fa6b658fcbb75685b909752921b287b90d56e0b4504584f22f138c431e1b5660c4f7423f2e9da5a7d49dc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
4a836e78091385ff5f54b3c3c14a094c

SHA1
d2b467f42ac0b41c2fcba7b136f31e5652c24a73

SHA256
8dff19c299ee3b4d9e2cdfca71154bfe166fabb20c8bba73255e4fa6d9e9c51e

SHA512
b58f95f055923134c52ce28c60f549c36a8bdd465e9ead88746cd89ace5e3876c76983c590f6cbb75dcc7d53396275ca918d361dac861c87bbdff68cfc87ea0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
49fb615d67818dfb53e85da04c8c83fe

SHA1
adde1fca419aa468e59724f73ecde78e64628911

SHA256
45e0ad1d3a66e6d888611018a5fd089fbbcbf0521093f0037118ba7431ec7eb6

SHA512
5a1a5f1d272259869d059c91b7d6f375d463425a2a8be9e23681bbdb268fd1cbfd55626b5ec1be4e26cede63f07a3c5fc20979cf048fd4633ef2c40c38dfa782

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
6b96c0fc5347256a869dd4fd6ebd0ed8

SHA1
514e44cbbb3a0bb271895c8008a2008d6e5756a5

SHA256
8b58c894db0ade8540bce2f0a113972b298b7d4237867a4a2a14ad69641053e4

SHA512
487094e06156fd7dc55a135d6d68955c2bddcbeacaa4148f24f0e30f92667da77628095c75779a27850dbb480b703d733d7d0783c52ad34d5d6b0869263677f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
48d67cd6dcedbbcee19d3e6bc93b6743

SHA1
e9771c652ee952f9b8261edb2ba3345f94e109a5

SHA256
38f7846cd239f22a1480aaeed673d6738730d08a65de2fd795a0751291843d8e

SHA512
5c75ecb89aefd6cf86a9bee55d2cd5b167faab476c7551caa086524cbc80d2a1d67b99f4ac8caf41f25ff5ee168be5312aab8a255ce5b8b140a3f436485bb185

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
ddde8bc6039513c6df9464bf03105860

SHA1
c17a8ee7eab0d56ff09c27046bbcd97bd671950e

SHA256
417a9a88b749f92e0cbb50097d317f3659779f5c30f78d7982ef757640b62b74

SHA512
c1a3b2312a8165882dfb23180c115518dd5a35773be3ef56fd4a5b6fc133c250cc4f06f56a6e2afbd7d3901c43c60e6dc9e3e6f82c34377e92453b73a88ef2a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
3b258aed2e05bd21fd0706a7ef9da593

SHA1
b76ac21194e916cb441400ec2662047d6a325d44

SHA256
cf553539e29a175f7bf45d3c27d3a7a5b6e9d6aa5c6a57adc584c2f39a5bbaa3

SHA512
d7b75e169eb7c56457dc63608e767a79deef2aa667cc3f232e4300b0af65cf43c24aa4061ec0b9168ff97d208f7e84465e18d004ce67ce71380f52acec18665d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
72b2080bddcd462199c58a0dcb3eea2a

SHA1
ee1765824370b5989fb4f4f14b46ff9e8cf3cb41

SHA256
290e88256eead395e6df6d833fc23ac35371c3c64b5901804b13c0a103745732

SHA512
2b05d47af1891c83036896f6793152bfbba96db2c7b8136d69889453652643a9675cd753c2fcb10477de5f0c01dd176d7f99b0b7bfeaad666dc293d2a98c5da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
5ebfea51eebbaddb1f72f52dd1cb1771

SHA1
b2a0cc25f43221233ea9addb9c1440199eb38cf9

SHA256
05da1e6ca171e6188f5240b977a9833ba09741a0977f6ac9f157d48993af82a8

SHA512
062c25e1fdd1e584bdab93b4b67622742d18f44664b5db3cfee4efd113955a6f0b4a3508144d4d4eb96dcf2f43efbc4ec90dfde051389faa77976815c693d9e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
c3e8bd0dc39b8ad906561e1356b9b77a

SHA1
0db612a5860d08e137a631c0c06f029a48453111

SHA256
4cb6f461b24d0f7b9686b1369ecf354391310fff298eb9c875ffc77e98a55919

SHA512
9589692aef48d28bda81a9b0ca39b32f7e85227e56a67bfbdfe329392eb78f749518cad467e92fb541afc441ec806880f685a5a2375437df7d7dfb6b3404ea8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bdc9da1a2b7e26faa774a8bd32f9716a

SHA1
8de00a1af24674d46b31215978802db27b21525f

SHA256
819bdca17e479ba0c9062e7d571d56c910a1cb5a965928becbf9065397256258

SHA512
02b0fc59c9d1d61047c42715459f0d7ce44e58be649005938dcf14e7b7a1db64a8f74b7b7631bb2aeaa3c3fb0197016724853fc8403255f3bce771b8e26e3e07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bdc9da1a2b7e26faa774a8bd32f9716a

SHA1
8de00a1af24674d46b31215978802db27b21525f

SHA256
819bdca17e479ba0c9062e7d571d56c910a1cb5a965928becbf9065397256258

SHA512
02b0fc59c9d1d61047c42715459f0d7ce44e58be649005938dcf14e7b7a1db64a8f74b7b7631bb2aeaa3c3fb0197016724853fc8403255f3bce771b8e26e3e07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
383e2bd5ec4b941eb411c60cebc5475d

SHA1
4bf41791b9b6719fc75506fdd8a033c4876532cd

SHA256
e8bc5842f87f7d2fb87b9fdaa8a0eeb4b68f3bacddb9bbe6197f8db0f64ca29f

SHA512
3d8eaa67a0addfbcd46fefed3d5eda7c35659e6b69ebd1dedf38b83900bb73587eb2df3f7e9cdef65b214f3202647d015ab93c226ad5920ad0f8da345f47d7d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c9efe0a62cfea9977d2606ad2bb3f55b

SHA1
90ce74839bc0ef0e48847d29abbea7f4722ddb02

SHA256
03d50df21d5352a1754fa628c0f5e5ecc07da67e97dff72d742a3699c7133eee

SHA512
35f362a2f16723457ca8898c28ff4d2e311ee134a5608955d4712a691fb2d4cf7fd5469f05635bc2fe180dc2ae2091d9854f66eae60d56b22da45772eb1ce8b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9accfedfaa5a901d3be14e7fe34b94f6

SHA1
7d7d01a01f22336c0d9a6a732c93e1b43bcd1175

SHA256
44eec12ca9e97a309aec7ad6a7243df9bad175dd968e70fde6ecb75274921fd6

SHA512
7c5316fa0bdfc6988999a061262e46ea5786d212d4d8a50e42f677212f4af996817e93fa9486ad3ff491fdd9c00bd981a1ac9fc17518a8a8bc78c9bcb89fb0ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
562b5f991881817e94c25ec32af997b2

SHA1
401f31e20808466228284509fc433508b456fd1a

SHA256
ea6d96c28784fa786f6dad59b3289439649648b0b45d071c83666d926183b00a

SHA512
f21822e016e4db4ab1826f0b80d559c683293c6fbe177ab147fa0ba550c6dd8d0b91a96dfdc7ce0f7c42ed449807ecde2f6977a463573a26876ace0dafad18e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Reporting and NEL

Filesize
36KB

MD5
2b14f7806e325d5b1dc5bc4f7eef1455

SHA1
505229dd2c804fc8ff1c1f4a9732c64ebcfa367b

SHA256
b93a7910678e159516083f9294c634ad5f0dac23af2dec010ca235c228d195ca

SHA512
d4a02e20c2cb7303cb59d9e0e966399e7cf165258222b8ada909123aab109d4fba741764b9932ac78008583dfcaf7642138ad125e78b06e71df31074f71d3006

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
818206845bf29e2261535e8e86b564fc

SHA1
ed9d67d0690f1858ed7cddba5f4053e478f81e4a

SHA256
a2ad8689d5688ddc3688eccc422f96a11eb67ed5fd51ec131c76b8f45c24b1c9

SHA512
e551037025c0c952da1ca2944b97419d06b6c4c035777f9be1fc5c5d2ae24e0237f0a08b81543d55bd2daf50cee9b7f355a0b3a84cfaab89f7607c25e505e087

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
818206845bf29e2261535e8e86b564fc

SHA1
ed9d67d0690f1858ed7cddba5f4053e478f81e4a

SHA256
a2ad8689d5688ddc3688eccc422f96a11eb67ed5fd51ec131c76b8f45c24b1c9

SHA512
e551037025c0c952da1ca2944b97419d06b6c4c035777f9be1fc5c5d2ae24e0237f0a08b81543d55bd2daf50cee9b7f355a0b3a84cfaab89f7607c25e505e087

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\1bc81134f37c937ebe8da56a55436620b13935d7\index.txt

Filesize
92B

MD5
4fc00f9b3e6ea72ad66d5c47aa191bc1

SHA1
ab19c029e10021fb687b3a36131f785535dc5140

SHA256
e5822ed7ba13957fef12bad9d4d5897a728adac8da75a4787ff73f89c943e8f8

SHA512
005e9bf052105be9f0f2e2181d3030f9146538d477be8ccfea9c872891efbdac2068210b1e6e2c0a40e2fddc4a56cca0c8f090ae4880ad63750a9203d1124833

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\1bc81134f37c937ebe8da56a55436620b13935d7\index.txt

Filesize
85B

MD5
93244460241780d3c6721a12ad83db0b

SHA1
96341b943fd9d5d7624ec9bb89e0d73566897a12

SHA256
34375a2bc13fb3e9b7e41b598bfb4c9d646fe6afecdfccf0351048ef1b189333

SHA512
0554c4ad1bea610a9984a6b54d3bd2e09ab4cd251a3406ca578fb80f9b9791c4df5ec3222196bfc1df3b63ea306b362cd9e570c9a5518728602dd396438353b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6325faa2-2f85-4960-8b27-a3c1194fb889\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
26B

MD5
2892eee3e20e19a9ba77be6913508a54

SHA1
7c4ef82faa28393c739c517d706ac6919a8ffc49

SHA256
4f110831bb434c728a6895190323d159df6d531be8c4bb7109864eeb7c989ff2

SHA512
b13a336db33299ab3405e13811e3ed9e5a18542e5d835f2b7130a6ff4c22f74272002fc43e7d9f94ac3aa6a4d53518f87f25d90c29e0d286b6470667ea9336ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
90B

MD5
d26e85cf5413a9cbeb71abf311730eeb

SHA1
f38d150f334e79f75b654c1dbddb53977b085676

SHA256
b2c7c9600f2086020f8cdcbcc50bad04457d93b91d10fb437c24d7007cadcb99

SHA512
68d7bcc23f89c54c96c7413a8aba8b6d672f428e3c2f008dfa42e0ca1a0f0ee7cc7ac14602d6d7a3e939711b9be0b900dcbd1f34789ada8066323f33939b8728

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
90B

MD5
828f6eacb06791b2619dc9bdf6aaf786

SHA1
aa907fd1f5f3a1355eb6372bf0c24e50d63feedf

SHA256
a56ae39b7739130f33dc5ae36140bd9707be8dfcba4cab2dd6d7864d332eacaf

SHA512
46001e8e56d63a6c4d6da225c2aa64317a4e2cbe59ad3586afb82f662c6fe83cf51f374938c4cf4768abc40fe33fb5be06e7061b8263136de964bdc44970fa0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp

Filesize
90B

MD5
21972064dd03184c695315dec904f115

SHA1
45a699dbbc4fd6a2574924eefedc5333f4ebcf6f

SHA256
b59842eea4c602416151b093ba70976e5e82384378353bf81677fb634efd3e7d

SHA512
bbf8b91f09e430248bade466b430764f697f475d5ce932d774222ee7d1e8d12d88417756f2c92c5b93d3fda2cf609cb8782fc747acda0186e0e59bd86b94767b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe582e00.TMP

Filesize
90B

MD5
8f2c85757da7f83b9023470238570baa

SHA1
f3b710edc771ebe936adf4bd717bc071c98f974c

SHA256
9b9cd5a1dc8d84cea71c7bc8d205b357f0936a04f2274b09da3d529a508ae7ec

SHA512
49692878dba8a19ca33907fa02abc18b91b4ced714f44b8010e75ae10e5297b43d42b7851658a38bcc4d9cfd2d042ee609a7edbb7c98d8650ad20c6b8ba9c029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
2KB

MD5
35faee687f8db8fe0c5ec93c9581f1fb

SHA1
16bac2dc3b6c497328e424d04c2c55cce347ee6b

SHA256
e69f8fa2265358b17ffc15aaf15fa0b767c0b57fc42b1b9c6cc3333093833da4

SHA512
f49986dab172fa8e748b53a9cbff56d6885bea1245c4f60d567d37bfaa73ed8c518a6ce49d36442fb35d78fbd4f2aadcf9a081ba6b7b472dcfa7a289de5043e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
319B

MD5
fac80d1d2be3bbfac516976f479d46de

SHA1
d364ad45d2be5e98563e60777d116614328a4f5a

SHA256
44f07f07a618d5b8bb528afdb06cfd9598d85e096325848c65e5ab70af51f78a

SHA512
a536ec7f372ffcfc00ccfd8b8bcd6bf325f03a8427d9928af09245a5086cb55568a7b3e36255cbbb71a4f2fd46c43ae51aaf64b4809f04a7b94b0d7abebda2b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13345659639959221

Filesize
3KB

MD5
bad3f59eae2abd42f69773c5db4ee564

SHA1
609f6bb0f3a2688a3b1161be34039a4921f47414

SHA256
d9f13c7a1675089f030fd9ee15f92c5a9a91823f0167f8f1a31cea449603c6a8

SHA512
b026643714b3e75f34963e1f84890079f9729568159b18cc7f5e4c8ebda0d1c79428260fe92363502c5c863e141d0d12b8054442268d82bd37bc1782cf111cd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13345659640229221

Filesize
3KB

MD5
2a7e9266ce855c7f81e222fd4df9cb85

SHA1
a19fbf40a22557e9bec775e38cbb58aa8469dd03

SHA256
768aaa2270c369438c871b33d610f8756b38976ab9bc4130a3509cca33f4f4b8

SHA512
1bf78fee676fba7ac022217edfc7172dfe65fc2fb2e721a77fa269f398265f86631e62b82820129be3a337727f3b9d4d5b8d6014da451a24bd9381c1b952acde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
9ab4caaa505da6dc4dccc9256895f740

SHA1
4ca1430c52f154ebec794a6a6c1c0b8cabf4862f

SHA256
ba9b876337bd53818c08f6ae30e10807056cd7885330f871533198cdf799934c

SHA512
c85a9da98f5da7138824bd474c18bc29f81f885ff2e9943a08f263cef76205389bd04d477f129d76acf1b1c8cb53e4c1c1b5fd58b0b2d6d1a926a9bd4413d766

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
97bad43aac6d91868a2b5fa5a60d620b

SHA1
c604d5e707bba5ac3bb7028b1ec10f6832eb4fc5

SHA256
3fee0cd33e1a45d733595f549ff391472564d72f45caa50346a18359720790b3

SHA512
c40d3eddeea3b86e3188f18122b3cf206ae9999887744968738a74d82276440b6832d80443efcef5a3d9c3c01d06748a6be8189429c6bab27ca580202cb41be4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
82a02b9a2d45dc56506fc4ef9a3f4a41

SHA1
7fabb36d21414fac909e781f67114fbb5061d105

SHA256
b4f23f46da89379f343fb13492962cbdcaf900900de6df022521555263247feb

SHA512
b41a4ac62c0936dff9b296506497c029b6e280d385540a6ec5e225d388e6e8a67c225fb4ca03d15b16a0c92d9825014794a76af1b8241de58712f9c48e274f7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
020a867963aef98f19d713e0b71f4670

SHA1
ef80c996687f330954ca10ffb49a7b47d79f4580

SHA256
2a64266ef18e71e0077f2ca057672a7afa64e221a1465139abaaede2e0cdecb3

SHA512
a0983d808b0d6cf60f09d8a90540b4b75ef96a647a43d4fb436b880cabfe7f8ae2a74fde6fa2e1964640af2ea1ad890a73ff8c69ee325ddea38b96301b8fd650

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
df65209daab0ace7247b0287ac573bbf

SHA1
732bfd671afb83c99beb8631cb9eb735c7522a38

SHA256
eb34451a7181703edf99c5b61114e7f038885bf714b718709ec9e16ac9ed326e

SHA512
63a15ab364861641e030f9a9a36d3f6c71d14e9aa604725cc7e31dac0d5b183a535878269aeb27c4503dfc9caffe568d08b05c3fffe731c251fe546674af5f06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
bfd13186a58328db83cef79fe1c97691

SHA1
538f6d84ab916321da928d444aab013a7f81da2f

SHA256
1691f2fa5155321316bdda00fa34bf60f899f331e4c4db8025b904001b87ab8d

SHA512
e0064bde967c4ee99b7d015dcb205e853ca75151b822882c27daaa94db4e5ef72370196dfd739251a82cb27a1c6f1b494961ff0a5bd18c794b7f0fcb132bb15b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
9ab0834bdf6434dcd8ff6f8e37a63a4d

SHA1
03c6a01c3e57c1abbbd070c0b4c68cc8464568ac

SHA256
2b1c27166611664219803e12aa939d91cdba9f0f5561b56eb6a341a29f683acf

SHA512
351883cbf40a1516b5a5ceb6091987d005d72b5d22dd8e7743c2d8de8d47fbac3edea95905f105957f7a1a784b28acfcfcab4441f51c8df7981e509314950ac0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
13462576b36acfb15fe7445310292f12

SHA1
d3052a483a7202b1eab60d8acd18a5aea164d80d

SHA256
728a767f4dbb910d129e3fdd870b41f3ad9ad71334bf02ebf648d25750a25bd3

SHA512
b1682b9068b71a3ff736fd48acf749388f3af9b53d6cad9db57ea4282ebdddbce44f5b8a4a6e642eade07d1457d0ace8e020080a7684105880a1b01be997b240

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
d5be4e3cea75ee96833cfdb96eb18dc1

SHA1
7d1ba50e13a6590cb07f139f47bb3e2b7371217c

SHA256
c7c4e6b3d980ede89b1ed7ec369ab28f71204fe6c60640848937ba25e71e403c

SHA512
efd460670a3bcdacedf3de15c6d039e7f019c7a717fc434c6522db76f86fe48e9988fcc058830867b5e55f785a81814d8fdfd879b7109391a69263a42d5ceaf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
bd8304ebffbaa86c7d67e3e1d3a785ad

SHA1
5dc6d22efedc8769b99ecf3919d1794ed0f7d7ae

SHA256
536670c3f9ebf2675fdf24ba8d3cc0916495e039c183844d2431d914d2f654b0

SHA512
1bb8f810b047d1af4e25526fe6a462a95f4b7b8db966fc1adb10034ef134a0edfe781828ef78d13a43b56fc787b9dae851edc1b16c2266d9241f04038000113f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
a6a355656d355dcf170a7b460659a403

SHA1
9a4d2214e256b9f07c57f9bee48a5aad5e747522

SHA256
da47e44cc139b7d390689487a09a3da9781d9693b739c89fdc45a0f6db7c4a6b

SHA512
d5b0f7f34b0edb497bd9b7808b9df9d4ac7bf205c396567f6a98ff1c32e849ab253be7c9d36731589f92ea68405a205f4053f865f83a8d640726654c89c0132c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
a8203884a1e8e83e2e6b592ec7d6273d

SHA1
2b76eeae50005810fa76c5838dff7652fdef4723

SHA256
1aa32bfb2e2f9419e2319bb33105d7cba39cf62e03485e2f212a020cece07533

SHA512
09a2179715984a160aeeae268e0500502dfb3efc8c82863dccc0606e98eccba243849554d6cd9adb3bcba1cbc68b985b2c667be0dab099a4a5fa92e04e72a163

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
75a86dff26d1ff0f493c2b4dd43b9339

SHA1
e68bcb9c80b0072eab18ecd6ec15292a32e159ae

SHA256
4079b3429a7e2a6c10380b05b652979990819f22d2a80f8b634819b6550eb95c

SHA512
5d6e9febd585952899829fe7f47c9f81e8d40790775bab32b2a1e65bbb04bd819bd1b6a9acfa9effb3317951769706beeddb271b79b8e84b8014eaef686adc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
513fd37bb4d84bd1c6aef16192bc203a

SHA1
8bc8edb7a86bb5c35fe883443832b2956ee60e22

SHA256
2f60e6da081afa81b80007b110bd0a4db37bf16c7672926917d09c9393624f6d

SHA512
974fbf1b8c74fef47d8a0a3d1bfe1e23e6ddd3b8b242ff772babf1198c0a96a7dcea84a8196c5f880685dbaae86e41a77fca4c0551329ff7880fe603656957fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
47741753a16a627306a6b71d6cb34c6a

SHA1
fe9a8e09f3187cd9f2af4afc3d6f42ad95b4a6b7

SHA256
7af4627a913dc7ed1e137c15d3bb1b65c25f4ca36a1510aa2e80c468a7a65eb8

SHA512
841c827b3c496c421823a5ed62e7ca06e85842548d56325230e75e6cc39a3c03bd324db55d872061e0f917009c3e6a38c6a2d80b1c08346eb3dfb8e1b988aa50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
3f9fab997dc01a796da123e227ed5867

SHA1
c6707bad35a620a86a8f1e1df029a24cd38c068c

SHA256
495e62d7adc29d99eb0c65d0ca6f2528dd12b4002e89c62defa8625827c90a52

SHA512
281d67e16fab816c326527c9829566ec6e915ed5232c7974380786e90dd923c051ff375d7eb68de2d7b49da6ccee86f55ed74243961932ac4e2d9f4c5b6fc3ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
07444bd41c5a56757cc08de72e1cd4cb

SHA1
581f84c88a952abc97c9ef03597f57a96f7d9ccc

SHA256
09e610ac53ed881a4296fdc378dc456cc6c5256ccae957329147a0cfd7439d95

SHA512
cd2b69849f28c2db82af6fce1258917460e41bb1157449514687d7e0c2e5eed864d3ab4878ac81893ba5cd44ca6023e0a0ea8bb995b838b0b8b6c6c4162bb6c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
02ee3e3b65ce0ed093e48312ba69c572

SHA1
d3eb5e61f56aa3e0a357dd6c6d9fb326f81bce4e

SHA256
a6850fcab8f0ac4ad2b69e4e2555a2979db1e52c1e4e94074e861dd898276be5

SHA512
98ce8f07eb3484519837a3f887fac2ec29a26bf4088609253b9f281903563fefd230e88185fad6ef84f2ac57f0ae066695c21ae46a7577fcef5452aa22edde23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
ab37504d9e128e8b2d7ce76423e6571e

SHA1
e569f31e86c5ca87555df2392a9cdca67f4f492e

SHA256
aa4439899e96602d466eb5b0140c1fa8c03c2efb1f78e3d662f3323eb28925b1

SHA512
e086ba7c1513f350ce4fc4fc52e72ddfd57424fa6e5baa9ca0b874f491a1e8282c5c7719eb2d05fb02d33ce8a6fb9d4d503f711bb082f4b154927839a2c0d9bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
2fb498672e2e410f1fdd9703f8cddaca

SHA1
293232ba5e8bd6e33cab2e322025a7bae91b282a

SHA256
018f490e23fe95d603859db7c8e66cd47707a9f25a7039e7cff50ed6fb3ec98e

SHA512
40e1642f5981f74dfcc5cce354873bbb37ae607704933b2134db40add2f2e351a133de3caff76ec697e03e9973aca42ea5c21e7227ccbde0352816975b9961e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
ba7b33105693cfec619485ca619099ce

SHA1
f068e6d171047a61fd3499c410986a60698071da

SHA256
238e1ed567095df00b553ddb128c3b51f4ed35505499423b1a6c4fa7b019c2cf

SHA512
997c58bec8b786e3f089e2a49b8f9044110024d5e05207f5d8e865827c5e1399d7c739b30d44f81929bdf457ec1d741b610e3305a4c59099e1e77d34e2e63d45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000001

Filesize
16KB

MD5
80012647668475a8fb5b738a711cc207

SHA1
da1e6a6806e501931da49507d087f18ca1cccfc0

SHA256
3e72c1c40d80d6be468f4febfc1c44a85085075d081eeb36e16bb4f1c2725835

SHA512
83bf46b67b03170f6d749977c4186481f366e5376da0317dae13b69bb4a46015975df56689abc78912741f6f84b13d966deef8c35d85a4b1ca427bfd3b64f927

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bf06d0e8c770d611d6220c5d0e78a4be

SHA1
3d06a5f2dd6ce24519cc6bd922e1417e155bffc7

SHA256
fb7e6f9574090866eaded6577425546358d8753fc3b733cb55e8fe2e17fb277f

SHA512
160c81f3cd40c2ef438645d558c6d7193a2772a657d3f90a564f6146b5336ff66f8f3db651321aa527cf7ebdbd39843957cea391bfc4912b6bd204bfb2161a86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
64ec35cf58782cda5e72329d88fd9669

SHA1
c8ab5501d9c448b15b30f5bb4ee35d4cae53de7e

SHA256
a24d0917c7485f0340ddcfefa4dfebc317150813781d007379475408f029dd38

SHA512
e6cafdc32aa2439fe0107785a0945d1a90c42d59ee21fdd90e536d7dc5c2981356c818be06cb507def4b8477580d126de9f4403e114720dfafff2d2f83dd1bb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8946d4824786083d9d39ddd84494e1b2

SHA1
6296131e2247d2c3607427007b6be48a643e2400

SHA256
962dc9bf00af802087702a0dcc363f52ba8884098dd7bf0d7fd38e334bb6adf6

SHA512
fe21732fe23f901d981198260931309c20093d17cb492f06908272d463a3223dd78520a5481f4d871178cb0837158b77721e9f62b4171528527bec0eb09c6a5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3012eb24545e57023a2f28d45f3cf7f9

SHA1
6ae22ab0ef9ba5efce34d7ac089ff130c73d9d5a

SHA256
edf53c1c813c57196f5042664b88d2ae6f384753fd0237d786766f541cb247f5

SHA512
11b4d99db547c0faff693fceed5e3020d0bdfbca412e13658f69b353bf67138a786a2e9808bf709a347d4d97d3c60481fac8d71ed2e2881254057bf1f40164be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
64ec35cf58782cda5e72329d88fd9669

SHA1
c8ab5501d9c448b15b30f5bb4ee35d4cae53de7e

SHA256
a24d0917c7485f0340ddcfefa4dfebc317150813781d007379475408f029dd38

SHA512
e6cafdc32aa2439fe0107785a0945d1a90c42d59ee21fdd90e536d7dc5c2981356c818be06cb507def4b8477580d126de9f4403e114720dfafff2d2f83dd1bb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a4e06fc60c7e57da471c5f6fae527d27

SHA1
e993a08a66d07ba99b28f0947e0d2659ff12d073

SHA256
a73f286235145c454f6ce5a6ea37853a8bc840b4c7818fa348ca1a61dd8c755a

SHA512
0ee8efcc715653e545cdd9b2ee6c9dfe003f0c86bc8caad02920126fbf170a347408e12e05879f611100c289b5ab916a1a6d6b62aff503f0d28019829607caf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2c6d88852e9ce6e3721b6f3b65e3f992

SHA1
a72182ff12669760dd6434f039d73c4f0c061f20

SHA256
69e9fa185228cf2ecdeab209730da13c7a3308930ecfa8b459fcc4d73e159281

SHA512
4e95bb48b351546d557dc26a8336f40ea29b65384314cfeeb931a093b691b46d151c0443b31308151e309336dec13352b3cfe4abc3c7351d46dc1700032163ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
ad35af6fbcce9444afdc1a0f51fbbbd5

SHA1
f5ac170e222b34ef0d026c332a0871019d999d0c

SHA256
bcdc70065b1750788c997f5729aceb0aa7d7a4aa94d25817c9555b41452a5551

SHA512
c83563dd98c071f5fed407733e031b25940d2a4f248f04bdb557664c69b4f2a08b488e512a478cc8d9f95853e6fb3379d2d053dd5e63e9ba7da756ce60a2dbde

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
1fdddac06b53844b73c9cedfb3a16306

SHA1
2bb02ade153bef8e70c01aa94812a539cc51a04b

SHA256
9f8291222e97208c6da958a886c3b0f9f1ffcbae28a3c44ef9ad64d53f057bf0

SHA512
a59f15630dc97567d4c559ec097400b5f1597b03b34cef7ba44ae38a29d5c04360caadf1421eacc9c16bcb91a15d5af8f0fd7b0b227cb3f3a7d333259b0df3f0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
ac921d8210fe17df47d4224561ee615f

SHA1
cb31ae1dd031fa086a61915506956caa5b945fba

SHA256
68d451bd9462f4b830eb3a6240ef9cda76083f5e4261eff12f2f153fc013aa9b

SHA512
5d846e7aeff8506f8e3486793288ed1ec07ca142ad1942023d0642150e472f56340061e44a158b928e4116838b333e6365858044f26b0bb3c497afea3aa4ada1

Download Submit
C:\Users\Admin\Downloads\MBSetup.exe

Filesize
2.5MB

MD5
1e885823577394ea61ea89438ffe2954

SHA1
e53e96f7374790bdad8a614949b398b055c3a27b

SHA256
7c0b9bceed390f7f28135431c09ac51469ee8e2b8095fb36a37315d811d9ba9c

SHA512
73f600833dad0047b6444110d722dc95237b38bb486abc7fc8e4f59b69e2154c885fb46d65f488d5139a0b6e76ebde33ea72711c7f58436650ef992fb8995627

Download Submit
C:\Windows\Temp\MBInstallTempdc18e1b18e0411ee9a88664382544407\ctlrpkg\mbae64.sys

Filesize
154KB

MD5
95515708f41a7e283d6725506f56f6f2

SHA1
9afc20a19db3d2a75b6915d8d9af602c5218735e

SHA256
321058a27d7462e55e39d253ad5d8b19a9acf754666400f82fe0542f33e733c6

SHA512
d9230901adeecb13b1f92287abe9317cdac458348885b96ef6500960793a7586c76ae374df053be948a35b44abe934aa853975a6ccd3788f93909903cc718c08

Download Submit
C:\Windows\Temp\MBInstallTempdc18e1b18e0411ee9a88664382544407\servicepkg\MBAMService.exe

Filesize
8.9MB

MD5
e4472f208d356ea4f562294ad8b82d93

SHA1
b34bbadc349e722ef8b211f9205a610fed1f4a32

SHA256
822957744702afdd6a571616da66f6c97a693d3a9e4b0c008f7f1614649a04d7

SHA512
012c99ca3eb23f49ae916d2d7d62ff428b34ba0340cb6d9c3f80f292e115437f58b3a6bfcffb862f6e1caffa2a12b69bb3e7a56445ccf132cc48a6556290fc9d

Download Submit
C:\Windows\Temp\MBInstallTempdc18e1b18e0411ee9a88664382544407\servicepkg\mbamelam.cat

Filesize
10KB

MD5
60608328775d6acf03eaab38407e5b7c

SHA1
9f63644893517286753f63ad6d01bc8bfacf79b1

SHA256
3ed5a1668713ef80c2b5599b599f1434ad6648999f335cf69757ea3183c70c59

SHA512
9f65212121b8a5d1a0625c3baa14ef04a33b091d26f543324333e38dcdb903e02ccc4d009e22c2e85d2f61d954e0b994c2896e52f685003a6ef34758f8a650c7

Download Submit
C:\Windows\Temp\MBInstallTempdc18e1b18e0411ee9a88664382544407\servicepkg\mbamelam.inf

Filesize
2KB

MD5
c481ad4dd1d91860335787aa61177932

SHA1
81633414c5bf5832a8584fb0740bc09596b9b66d

SHA256
793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3

SHA512
d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830

Download Submit
C:\Windows\Temp\MBInstallTempdc18e1b18e0411ee9a88664382544407\servicepkg\mbamelam.sys

Filesize
20KB

MD5
9e77c51e14fa9a323ee1635dc74ecc07

SHA1
a78bde0bd73260ce7af9cdc441af9db54d1637c2

SHA256
b5619d758ae6a65c1663f065e53e6b68a00511e7d7accb3e07ed94bfd0b1ede0

SHA512
a12ccf92bead694f5d3cba7ff7e731a2f862198efc338efc7f33a882fe0eb7499fb3fb533538d0a823e80631a7ca162962fbdfd78e401e3255672910b7140186

Download Submit
C:\Windows\Temp\MBInstallTempdc18e1b18e0411ee9a88664382544407\servicepkg\mbshlext.dll

Filesize
2.7MB

MD5
b7e5071b317550d93258f7e1e13e7b6f

SHA1
2d08d78a5c29cf724bc523530d1a9014642bbc60

SHA256
467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064

SHA512
9c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54

Download Submit
C:\Windows\Temp\MBInstallTempdc18e1b18e0411ee9a88664382544407\uipkg\QtQuick\Controls.2\HorizontalHeaderView.qml

Filesize
1KB

MD5
d8c9674c0e9bddbd8aa59a9d343cf462

SHA1
490aa022ac31ddce86d5b62f913b23fbb0de27c2

SHA256
1ef333b5fb4d8075973f312ef787237240b9f49f3f9185fb21202883f900e7d7

SHA512
0b86ec673133f6400c38b79f9ba4f7b37ce5afdab1a2e34acbf75019e2590cc26b26d323ddc1567c91375053c9c8593be0615389db8eb1a8d1eb084ad4200b82

Download Submit
C:\Windows\Temp\MBInstallTempdc18e1b18e0411ee9a88664382544407\uipkg\QtQuick\Controls.2\Imagine\VerticalHeaderView.qml

Filesize
1KB

MD5
829769b2741d92df3c5d837eee64f297

SHA1
f61c91436ca3420c4e9b94833839fd9c14024b69

SHA256
489c02f8716e7a1de61834b3d8bbb61bce91ca4a33a6b62342b4c851d93e51e0

SHA512
4061c271db37523b9dea9a9973226d91337e1809d4e7767e57ac938d35d77a302363ed92ab4be18c35ba589f528194ad71c93a8507449bf74dd035acf7cdb521

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
\??\pipe\LOCAL\crashpad_1036_VMBSKOFWXXNHUTFO

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_1400_NGMPPMMFJJVEPOIQ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1788-249-0x00000198255F0000-0x00000198255F1000-memory.dmp

Filesize
4KB

Download
memory/1788-246-0x00000198255F0000-0x00000198255F1000-memory.dmp

Filesize
4KB

Download
memory/1788-239-0x00000198255F0000-0x00000198255F1000-memory.dmp

Filesize
4KB

Download
memory/1788-248-0x00000198255F0000-0x00000198255F1000-memory.dmp

Filesize
4KB

Download
memory/1788-247-0x00000198255F0000-0x00000198255F1000-memory.dmp

Filesize
4KB

Download
memory/1788-250-0x00000198255F0000-0x00000198255F1000-memory.dmp

Filesize
4KB

Download
memory/1788-251-0x00000198255F0000-0x00000198255F1000-memory.dmp

Filesize
4KB

Download
memory/1788-245-0x00000198255F0000-0x00000198255F1000-memory.dmp

Filesize
4KB

Download
memory/1788-241-0x00000198255F0000-0x00000198255F1000-memory.dmp

Filesize
4KB

Download
memory/1788-240-0x00000198255F0000-0x00000198255F1000-memory.dmp

Filesize
4KB

Download
memory/7244-6083-0x00007FFA9D1D0000-0x00007FFA9D5EE000-memory.dmp

Filesize
4.1MB

Download
memory/7244-6612-0x0000026C22BB0000-0x0000026C22BB1000-memory.dmp

Filesize
4KB

Download
memory/7244-6082-0x00007FF6520E0000-0x00007FF6537A4000-memory.dmp

Filesize
22.8MB

Download
memory/7244-6087-0x0000026C197C0000-0x0000026C197D0000-memory.dmp

Filesize
64KB

Download
memory/7244-6596-0x0000026C21420000-0x0000026C21421000-memory.dmp

Filesize
4KB

Download
memory/7244-6597-0x0000026C21420000-0x0000026C21421000-memory.dmp

Filesize
4KB

Download
memory/7244-6602-0x0000026C22BB0000-0x0000026C22BB1000-memory.dmp

Filesize
4KB

Download
memory/7244-6604-0x0000026C21430000-0x0000026C21431000-memory.dmp

Filesize
4KB

Download
memory/7244-6605-0x0000026C21440000-0x0000026C21442000-memory.dmp

Filesize
8KB

Download
memory/7244-6588-0x0000026C22BB0000-0x0000026C22BB1000-memory.dmp

Filesize
4KB

Download
memory/7244-6589-0x0000026C22BB0000-0x0000026C22BB1000-memory.dmp

Filesize
4KB

Download
memory/7244-6590-0x0000026C22BB0000-0x0000026C22BB1000-memory.dmp

Filesize
4KB

Download
memory/7244-6591-0x0000026C22BB0000-0x0000026C22BB1000-memory.dmp

Filesize
4KB

Download
memory/7244-6592-0x0000026C22BB0000-0x0000026C22BB1000-memory.dmp

Filesize
4KB

Download
memory/7244-6593-0x0000026C22BB0000-0x0000026C22BB1000-memory.dmp

Filesize
4KB

Download
memory/7244-6594-0x0000026C22BB0000-0x0000026C22BB1000-memory.dmp

Filesize
4KB

Download
memory/7244-6600-0x0000026C21420000-0x0000026C21421000-memory.dmp

Filesize
4KB

Download
memory/7244-6599-0x0000026C21420000-0x0000026C21421000-memory.dmp

Filesize
4KB

Download
memory/7244-6598-0x0000026C21420000-0x0000026C21421000-memory.dmp

Filesize
4KB

Download
memory/7244-6601-0x0000026C22BB0000-0x0000026C22BB1000-memory.dmp

Filesize
4KB

Download
memory/7244-6607-0x0000026C21440000-0x0000026C21442000-memory.dmp

Filesize
8KB

Download
memory/7244-6084-0x00007FFA9CC60000-0x00007FFA9D1CB000-memory.dmp

Filesize
5.4MB

Download
memory/7244-6613-0x0000026C21430000-0x0000026C21431000-memory.dmp

Filesize
4KB

Download
memory/7244-6614-0x0000026C22BB0000-0x0000026C22BB1000-memory.dmp

Filesize
4KB

Download
memory/7244-6615-0x0000026C21440000-0x0000026C21442000-memory.dmp

Filesize
8KB

Download
memory/7244-6621-0x0000026C21470000-0x0000026C21471000-memory.dmp

Filesize
4KB

Download
memory/7244-6624-0x0000026C21450000-0x0000026C21452000-memory.dmp

Filesize
8KB

Download
memory/7244-6625-0x0000026C21470000-0x0000026C21471000-memory.dmp

Filesize
4KB

Download
memory/7244-6626-0x0000026C21470000-0x0000026C21471000-memory.dmp

Filesize
4KB

Download
memory/7244-6627-0x0000026C21430000-0x0000026C21431000-memory.dmp

Filesize
4KB

Download
memory/7244-6623-0x0000026C21470000-0x0000026C21471000-memory.dmp

Filesize
4KB

Download
memory/7244-6622-0x0000026C21460000-0x0000026C21461000-memory.dmp

Filesize
4KB

Download
memory/7244-6619-0x0000026C21460000-0x0000026C21461000-memory.dmp

Filesize
4KB

Download
memory/7244-6617-0x0000026C21450000-0x0000026C21452000-memory.dmp

Filesize
8KB

Download
memory/7244-6616-0x0000026C21430000-0x0000026C21431000-memory.dmp

Filesize
4KB

Download
memory/7244-6611-0x0000026C22BB0000-0x0000026C22BB1000-memory.dmp

Filesize
4KB

Download
memory/7244-6610-0x0000026C21440000-0x0000026C21442000-memory.dmp

Filesize
8KB

Download
memory/7244-6609-0x0000026C21450000-0x0000026C21452000-memory.dmp

Filesize
8KB

Download
memory/7244-6606-0x0000026C21440000-0x0000026C21442000-memory.dmp

Filesize
8KB

Download
memory/8868-5893-0x00007FFA9D1D0000-0x00007FFA9D5EE000-memory.dmp

Filesize
4.1MB

Download
memory/8868-5892-0x00007FFA9CC60000-0x00007FFA9D1CB000-memory.dmp

Filesize
5.4MB

Download
memory/8868-5894-0x000001E32A320000-0x000001E32A330000-memory.dmp

Filesize
64KB

Download
memory/8868-5895-0x000001E32C7C0000-0x000001E32CC00000-memory.dmp

Filesize
4.2MB

Download
memory/8868-5897-0x000001E32C370000-0x000001E32C570000-memory.dmp

Filesize
2.0MB

Download