Analysis
-
max time kernel
768s -
max time network
780s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 18:27
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://rzr.to/hSeaa2
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
https://rzr.to/hSeaa2
Resource
win10v2004-20231215-en
General
-
Target
https://rzr.to/hSeaa2
Malware Config
Signatures
-
Detect ZGRat V1 2 IoCs
resource yara_rule behavioral2/files/0x000200000001e7ed-191.dat family_zgrat_v1 behavioral2/memory/5732-293-0x0000000005450000-0x000000000561E000-memory.dmp family_zgrat_v1 -
Downloads MZ/PE file
-
Modifies Windows Firewall 1 TTPs 2 IoCs
pid Process 1748 netsh.exe 6744 netsh.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation Barracuda X_FirmwareUpdater_v2.4.0_r4.exe Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation ramexpert_lite.tmp Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation fdm.exe Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation fdm.exe Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation Barracuda X_FirmwareUpdater_v2.4.0_r4.exe -
Executes dropped EXE 19 IoCs
pid Process 5408 Barracuda X_FirmwareUpdater_v2.4.0_r4.exe 5856 Barracuda X_FirmwareUpdater_v2.4.0_r4.exe 5960 BarracudaXCustomerFWU.exe 5344 Barracuda X_FirmwareUpdater_v2.4.0_r4.exe 5380 Barracuda X_FirmwareUpdater_v2.4.0_r4.exe 5732 BarracudaXCustomerFWU.exe 6408 ramexpert_lite.exe 6376 ramexpert_lite.tmp 5332 fdm_x64_setup.exe 7016 fdm_x64_setup.tmp 3804 RAMExpert.exe 7100 fdm.exe 6988 helperservice.exe 5900 importwizard.exe 6168 fdm5rhwin.exe 1244 fdm5rhwin.exe 2304 fdm.exe 5484 importwizard.exe 6544 fdm.exe -
Loads dropped DLL 64 IoCs
pid Process 5732 BarracudaXCustomerFWU.exe 5732 BarracudaXCustomerFWU.exe 5732 BarracudaXCustomerFWU.exe 5732 BarracudaXCustomerFWU.exe 5732 BarracudaXCustomerFWU.exe 5732 BarracudaXCustomerFWU.exe 3804 RAMExpert.exe 3804 RAMExpert.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 7100 fdm.exe 5900 importwizard.exe 5900 importwizard.exe 5900 importwizard.exe 5900 importwizard.exe 5900 importwizard.exe 5900 importwizard.exe 5900 importwizard.exe 5900 importwizard.exe 5900 importwizard.exe 5900 importwizard.exe 5900 importwizard.exe 5900 importwizard.exe 5900 importwizard.exe 5900 importwizard.exe 5900 importwizard.exe 5900 importwizard.exe 5900 importwizard.exe 6988 helperservice.exe 6988 helperservice.exe 6988 helperservice.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Free Download Manager = "\"C:\\Program Files\\Softdeluxe\\Free Download Manager\\fdm.exe\" --hidden" fdm.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: fdm.exe File opened (read-only) \??\F: fdm.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Controls\Material\is-MK1UL.tmp fdm_x64_setup.tmp File created C:\Program Files (x86)\KC Softwares\RAMExpert\unins000.dat ramexpert_lite.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\is-OSG69.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\is-MO927.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\imageformats\is-1LQA8.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\imageformats\is-BBT27.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Controls\Basic\is-HRAUL.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Controls\Fusion\impl\is-S0HKN.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Controls\Basic\is-LC3JH.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Controls\Fusion\is-E09CK.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Controls\Material\is-D9514.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Controls\Material\is-QD7ML.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Controls\Universal\is-BRE5P.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Dialogs\quickimpl\qml\is-6ND8T.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\NativeStyle\controls\is-3EJ15.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\translations\main\is-1GNOF.tmp fdm_x64_setup.tmp File created C:\Program Files (x86)\KC Softwares\RAMExpert\is-4JLB3.tmp ramexpert_lite.tmp File created C:\Program Files (x86)\KC Softwares\RAMExpert\unins000.msg ramexpert_lite.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Controls\Basic\is-IQPF0.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Controls\Fusion\is-99UUV.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Controls\Imagine\is-JGUCV.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Controls\Universal\is-E38GD.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Shapes\is-4K5QT.tmp fdm_x64_setup.tmp File created C:\Program Files (x86)\KC Softwares\RAMExpert\is-IDN9J.tmp ramexpert_lite.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Controls\Imagine\is-IIJVE.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\translations\main\is-JD8AE.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\translations\main\is-MLE7J.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\is-TNB86.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQml\Models\is-AL9AO.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Controls\Imagine\is-IRTEM.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Layouts\is-C3G28.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\translations\is-1JPLG.tmp fdm_x64_setup.tmp File created C:\Program Files (x86)\KC Softwares\RAMExpert\is-MS6LP.tmp ramexpert_lite.tmp File created C:\Program Files (x86)\KC Softwares\RAMExpert\is-IAMU0.tmp ramexpert_lite.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\is-3F7UQ.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\is-D3AM7.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Controls\Imagine\is-IQNBM.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Controls\Universal\is-216TU.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Dialogs\quickimpl\qml\is-90OF2.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\translations\is-L7A8U.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\translations\torrents\is-NFRO3.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\translations\torrents\is-VEIOS.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\Qt5Compat\GraphicalEffects\private\is-IJKAD.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Dialogs\quickimpl\qml\+Universal\is-A43U3.tmp fdm_x64_setup.tmp File opened for modification C:\Program Files (x86)\KC Softwares\RAMExpert\libssl-3.dll ramexpert_lite.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQml\is-SNFL7.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Controls\Imagine\is-6VDRJ.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Controls\Material\impl\is-RIGDP.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Controls\Universal\is-3E5J9.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\translations\is-P8UEG.tmp fdm_x64_setup.tmp File created C:\Program Files (x86)\KC Softwares\RAMExpert\is-OC1JQ.tmp ramexpert_lite.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\is-MU53N.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\is-M0SV2.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Controls\is-OJCB0.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Controls\Imagine\is-8BTK9.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Dialogs\quickimpl\qml\+Material\is-6N2HN.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Dialogs\quickimpl\qml\+Universal\is-EUM25.tmp fdm_x64_setup.tmp File created C:\Program Files (x86)\KC Softwares\RAMExpert\is-QBKV9.tmp ramexpert_lite.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\is-I7HT0.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\Qt5Compat\GraphicalEffects\private\is-54BDP.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Controls\Imagine\impl\is-JVBDI.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\QtQuick\Controls\Material\impl\is-OGHC5.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\translations\torrents\is-HR29S.tmp fdm_x64_setup.tmp File created C:\Program Files\Softdeluxe\Free Download Manager\is-RCKDV.tmp fdm_x64_setup.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
pid pid_target Process procid_target 5208 5960 WerFault.exe 125 5216 5856 WerFault.exe 124 4256 5380 WerFault.exe 131 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2304 schtasks.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_GPU_RENDERING fdm_x64_setup.tmp Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\fdm.exe = "1" fdm_x64_setup.tmp Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_GPU_RENDERING fdm_x64_setup.tmp Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\fdm.exe = "1" fdm_x64_setup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION fdm_x64_setup.tmp Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\fdm.exe = "11000" fdm_x64_setup.tmp Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION fdm_x64_setup.tmp Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\fdm.exe = "11000" fdm_x64_setup.tmp -
Modifies registry class 18 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\fdm\URL Protocol fdm.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\fdm\DefaultIcon\ fdm.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\fdm\shell\ fdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\fdm\shell\ = "open" fdm.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\fdm\{17FF5AC0-1D17-4A53-A10F-85E3EFA3DF17}\ fdm.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\fdm fdm.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\fdm\{17FF5AC0-1D17-4A53-A10F-85E3EFA3DF17} fdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\fdm\{17FF5AC0-1D17-4A53-A10F-85E3EFA3DF17}\command fdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\fdm\shell\open\command\ = "\"C:\\Program Files\\Softdeluxe\\Free Download Manager\\fdm.exe\" \"%1\"" fdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\fdm\{17FF5AC0-1D17-4A53-A10F-85E3EFA3DF17}\icon fdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\fdm\DefaultIcon\ = "\"C:\\Program Files\\Softdeluxe\\Free Download Manager\\fdm.exe\", 1" fdm.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3073191680-435865314-2862784915-1000\{FEE0CF70-72E2-4D67-8C13-BA61BE587F7B} msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\fdm\Content Type fdm.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\fdm\shell\open\command\ fdm.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\fdm\shell fdm.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\fdm\ = "URL:fdm link" fdm.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\fdm\shell\open fdm.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\fdm\shell\open\command fdm.exe -
NTFS ADS 6 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\Barracuda X_FirmwareUpdater_v2.4.0_r4.exe\:SmartScreen:$DATA Barracuda X_FirmwareUpdater_v2.4.0_r4.exe File created C:\Users\Admin\AppData\Local\Temp\Barracuda X_FirmwareUpdater_v2.4.0_r4.exe\:SmartScreen:$DATA Barracuda X_FirmwareUpdater_v2.4.0_r4.exe File created C:\Users\Admin\AppData\Local\Temp\Barracuda X_FirmwareUpdater_v2.4.0_r4.exe\:SmartScreen:$DATA Barracuda X_FirmwareUpdater_v2.4.0_r4.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 29647.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 511031.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 617323.crdownload:SmartScreen msedge.exe -
Suspicious behavior: AddClipboardFormatListener 5 IoCs
pid Process 5368 WINWORD.EXE 5368 WINWORD.EXE 7100 fdm.exe 2304 fdm.exe 6544 fdm.exe -
Suspicious behavior: EnumeratesProcesses 53 IoCs
pid Process 4140 msedge.exe 4140 msedge.exe 2836 msedge.exe 2836 msedge.exe 1384 identity_helper.exe 1384 identity_helper.exe 5136 msedge.exe 5136 msedge.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 4008 msedge.exe 4008 msedge.exe 4008 msedge.exe 4008 msedge.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 5732 msedge.exe 5732 msedge.exe 3352 msedge.exe 3352 msedge.exe 2644 msedge.exe 2644 msedge.exe 6376 ramexpert_lite.tmp 6376 ramexpert_lite.tmp 6092 msedge.exe 6092 msedge.exe 6168 fdm5rhwin.exe 6168 fdm5rhwin.exe 1244 fdm5rhwin.exe 1244 fdm5rhwin.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3804 RAMExpert.exe 2304 fdm.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
pid Process 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 5408 Barracuda X_FirmwareUpdater_v2.4.0_r4.exe Token: SeDebugPrivilege 5856 Barracuda X_FirmwareUpdater_v2.4.0_r4.exe Token: SeDebugPrivilege 5344 Barracuda X_FirmwareUpdater_v2.4.0_r4.exe Token: SeDebugPrivilege 5380 Barracuda X_FirmwareUpdater_v2.4.0_r4.exe Token: SeDebugPrivilege 1136 taskmgr.exe Token: SeSystemProfilePrivilege 1136 taskmgr.exe Token: SeCreateGlobalPrivilege 1136 taskmgr.exe Token: 33 1136 taskmgr.exe Token: SeIncBasePriorityPrivilege 1136 taskmgr.exe Token: SeIncreaseQuotaPrivilege 7100 fdm.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 2836 msedge.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe 1136 taskmgr.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 5368 WINWORD.EXE 5368 WINWORD.EXE 5368 WINWORD.EXE 5368 WINWORD.EXE 5368 WINWORD.EXE 5368 WINWORD.EXE 5368 WINWORD.EXE 2304 fdm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2836 wrote to memory of 3792 2836 msedge.exe 88 PID 2836 wrote to memory of 3792 2836 msedge.exe 88 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 1984 2836 msedge.exe 90 PID 2836 wrote to memory of 4140 2836 msedge.exe 89 PID 2836 wrote to memory of 4140 2836 msedge.exe 89 PID 2836 wrote to memory of 4912 2836 msedge.exe 91 PID 2836 wrote to memory of 4912 2836 msedge.exe 91 PID 2836 wrote to memory of 4912 2836 msedge.exe 91 PID 2836 wrote to memory of 4912 2836 msedge.exe 91 PID 2836 wrote to memory of 4912 2836 msedge.exe 91 PID 2836 wrote to memory of 4912 2836 msedge.exe 91 PID 2836 wrote to memory of 4912 2836 msedge.exe 91 PID 2836 wrote to memory of 4912 2836 msedge.exe 91 PID 2836 wrote to memory of 4912 2836 msedge.exe 91 PID 2836 wrote to memory of 4912 2836 msedge.exe 91 PID 2836 wrote to memory of 4912 2836 msedge.exe 91 PID 2836 wrote to memory of 4912 2836 msedge.exe 91 PID 2836 wrote to memory of 4912 2836 msedge.exe 91 PID 2836 wrote to memory of 4912 2836 msedge.exe 91 PID 2836 wrote to memory of 4912 2836 msedge.exe 91 PID 2836 wrote to memory of 4912 2836 msedge.exe 91 PID 2836 wrote to memory of 4912 2836 msedge.exe 91 PID 2836 wrote to memory of 4912 2836 msedge.exe 91 PID 2836 wrote to memory of 4912 2836 msedge.exe 91 PID 2836 wrote to memory of 4912 2836 msedge.exe 91 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://rzr.to/hSeaa21⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c6af46f8,0x7ff9c6af4708,0x7ff9c6af47182⤵PID:3792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:22⤵PID:1984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:82⤵PID:4912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵PID:1756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:12⤵PID:3644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:12⤵PID:1644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:12⤵PID:1700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2616 /prefetch:12⤵PID:452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5300 /prefetch:82⤵PID:1044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:12⤵PID:2424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:12⤵PID:1028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:82⤵PID:1428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=180 /prefetch:82⤵PID:1232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:12⤵PID:2616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5136
-
-
C:\Users\Admin\Downloads\Barracuda X_FirmwareUpdater_v2.4.0_r4.exe"C:\Users\Admin\Downloads\Barracuda X_FirmwareUpdater_v2.4.0_r4.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\Barracuda X_FirmwareUpdater_v2.4.0_r4\BarracudaXCustomerFWU.exe"C:\Users\Admin\AppData\Local\Temp\Barracuda X_FirmwareUpdater_v2.4.0_r4\BarracudaXCustomerFWU.exe"3⤵
- Executes dropped EXE
PID:5960 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5960 -s 8444⤵
- Program crash
PID:5208
-
-
-
-
C:\Users\Admin\Downloads\Barracuda X_FirmwareUpdater_v2.4.0_r4.exe"C:\Users\Admin\Downloads\Barracuda X_FirmwareUpdater_v2.4.0_r4.exe"2⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
PID:5856 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5856 -s 8323⤵
- Program crash
PID:5216
-
-
-
C:\Users\Admin\Downloads\Barracuda X_FirmwareUpdater_v2.4.0_r4.exe"C:\Users\Admin\Downloads\Barracuda X_FirmwareUpdater_v2.4.0_r4.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
PID:5344 -
C:\Users\Admin\AppData\Local\Temp\Barracuda X_FirmwareUpdater_v2.4.0_r4\BarracudaXCustomerFWU.exe"C:\Users\Admin\AppData\Local\Temp\Barracuda X_FirmwareUpdater_v2.4.0_r4\BarracudaXCustomerFWU.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5732
-
-
-
C:\Users\Admin\Downloads\Barracuda X_FirmwareUpdater_v2.4.0_r4.exe"C:\Users\Admin\Downloads\Barracuda X_FirmwareUpdater_v2.4.0_r4.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5380 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5380 -s 8003⤵
- Program crash
PID:4256
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4936 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:12⤵PID:5880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:12⤵PID:4852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4936 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1704 /prefetch:82⤵PID:2140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:12⤵PID:1248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:12⤵PID:1700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2768 /prefetch:12⤵PID:4436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:12⤵PID:6116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:12⤵PID:3168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:12⤵PID:3804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:12⤵PID:1052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:12⤵PID:4184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:12⤵PID:1068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7328 /prefetch:12⤵PID:1856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7592 /prefetch:12⤵PID:5852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7460 /prefetch:12⤵PID:8
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7192 /prefetch:12⤵PID:5536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:12⤵PID:5484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8152 /prefetch:12⤵PID:2052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8020 /prefetch:12⤵PID:5632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7856 /prefetch:12⤵PID:5024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8388 /prefetch:12⤵PID:1132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8048 /prefetch:12⤵PID:644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8272 /prefetch:12⤵PID:5460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:12⤵PID:6088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6576 /prefetch:12⤵PID:1388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6976 /prefetch:12⤵PID:3864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7268 /prefetch:12⤵PID:5748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7456 /prefetch:12⤵PID:4280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2788 /prefetch:12⤵PID:5896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8948 /prefetch:12⤵PID:4656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7232 /prefetch:12⤵PID:3308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:12⤵PID:2456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:12⤵PID:3176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6916 /prefetch:12⤵PID:4488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7360 /prefetch:12⤵PID:3564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7432 /prefetch:12⤵PID:5136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7324 /prefetch:12⤵PID:3496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4060 /prefetch:82⤵PID:3372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:12⤵PID:2296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8000 /prefetch:12⤵PID:3504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8948 /prefetch:12⤵PID:2728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:12⤵PID:4260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7392 /prefetch:12⤵PID:3740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2280 /prefetch:12⤵PID:1784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:12⤵PID:4756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:12⤵PID:5748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:12⤵PID:5616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8180 /prefetch:12⤵PID:3520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2772 /prefetch:12⤵PID:404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7956 /prefetch:82⤵PID:4076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8648 /prefetch:12⤵PID:1384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:12⤵PID:4656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7000 /prefetch:12⤵PID:2368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6888 /prefetch:12⤵PID:3732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7356 /prefetch:12⤵PID:836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7864 /prefetch:12⤵PID:936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:12⤵PID:5872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:12⤵PID:1192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7384 /prefetch:12⤵PID:4948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8724 /prefetch:12⤵PID:4440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8112 /prefetch:12⤵PID:488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:12⤵PID:3852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1824 /prefetch:12⤵PID:5688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7604 /prefetch:12⤵PID:3760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8396 /prefetch:12⤵PID:3344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9628 /prefetch:12⤵PID:3976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9476 /prefetch:12⤵PID:5684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10116 /prefetch:12⤵PID:2460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9992 /prefetch:12⤵PID:972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9776 /prefetch:12⤵PID:2856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7428 /prefetch:12⤵PID:5956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9324 /prefetch:12⤵PID:5592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8496 /prefetch:12⤵PID:6096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8408 /prefetch:12⤵PID:3688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:12⤵PID:5168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8656 /prefetch:12⤵PID:2876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:12⤵PID:6612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:12⤵PID:6816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2728 /prefetch:12⤵PID:6808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8780 /prefetch:12⤵PID:7144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10644 /prefetch:12⤵PID:2632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8468 /prefetch:12⤵PID:1160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7500 /prefetch:12⤵PID:4552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9760 /prefetch:12⤵PID:5836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7696 /prefetch:12⤵PID:6512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10124 /prefetch:12⤵PID:6092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9644 /prefetch:12⤵PID:6636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8392 /prefetch:12⤵PID:4152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8904 /prefetch:12⤵PID:4196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10096 /prefetch:12⤵PID:5032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10292 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9996 /prefetch:82⤵PID:4532
-
-
C:\Users\Admin\Downloads\ramexpert_lite.exe"C:\Users\Admin\Downloads\ramexpert_lite.exe"2⤵
- Executes dropped EXE
PID:6408 -
C:\Users\Admin\AppData\Local\Temp\is-UM796.tmp\ramexpert_lite.tmp"C:\Users\Admin\AppData\Local\Temp\is-UM796.tmp\ramexpert_lite.tmp" /SL5="$100222,3032595,886272,C:\Users\Admin\Downloads\ramexpert_lite.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:6376 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.kcsoftwares.com/?page=postinstall&sw=RAMExpert4⤵PID:3976
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9c6af46f8,0x7ff9c6af4708,0x7ff9c6af47185⤵PID:4196
-
-
-
C:\Program Files (x86)\KC Softwares\RAMExpert\RAMExpert.exe"C:\Program Files (x86)\KC Softwares\RAMExpert\RAMExpert.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:3804 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.kcsoftwares.com/sumo/drivers.php5⤵PID:392
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0xf8,0x124,0x120,0x128,0x7ff9c6af46f8,0x7ff9c6af4708,0x7ff9c6af47186⤵PID:4860
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:12⤵PID:3192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:12⤵PID:4308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8468 /prefetch:12⤵PID:1568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9752 /prefetch:12⤵PID:2732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8596 /prefetch:12⤵PID:5888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7340 /prefetch:12⤵PID:4652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10084 /prefetch:12⤵PID:672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7604 /prefetch:12⤵PID:6400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9264 /prefetch:12⤵PID:6420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6736 /prefetch:12⤵PID:5352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9484 /prefetch:12⤵PID:6888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9180 /prefetch:12⤵PID:7048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10320 /prefetch:12⤵PID:4280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=129 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9576 /prefetch:12⤵PID:3160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:6092
-
-
C:\Users\Admin\Downloads\fdm_x64_setup.exe"C:\Users\Admin\Downloads\fdm_x64_setup.exe"2⤵
- Executes dropped EXE
PID:5332 -
C:\Users\Admin\AppData\Local\Temp\is-P8ATC.tmp\fdm_x64_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-P8ATC.tmp\fdm_x64_setup.tmp" /SL5="$702C0,42260626,832512,C:\Users\Admin\Downloads\fdm_x64_setup.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies Internet Explorer settings
PID:7016 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /end /tn FreeDownloadManagerHelperService4⤵PID:6536
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /create /RU SYSTEM /tn FreeDownloadManagerHelperService /f /xml "C:\Program Files\Softdeluxe\Free Download Manager\service.xml"4⤵
- Creates scheduled task(s)
PID:2304
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /change /tn FreeDownloadManagerHelperService /tr "\"C:\Program Files\Softdeluxe\Free Download Manager\helperservice.exe"\"4⤵PID:4268
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /run /tn FreeDownloadManagerHelperService4⤵PID:4260
-
-
C:\Program Files\Softdeluxe\Free Download Manager\fdm.exe"C:\Program Files\Softdeluxe\Free Download Manager\fdm.exe" --install4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
PID:7100 -
C:\Program Files\Softdeluxe\Free Download Manager\importwizard.exe"C:\Program Files\Softdeluxe\Free Download Manager\importwizard" 3FE02402165644D986B63DE6638495E45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.freedownloadmanager.org/afterinstall.html?os=windows&osversion=10.0&osarchitecture=x86_64&architecture=x86_64&version=6.20.0.5510&uuid=3bd9b22b-2d4c-469f-9513-95f897de3bdb&locale=en_US&ac=1&au=15⤵PID:540
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c6af46f8,0x7ff9c6af4708,0x7ff9c6af47186⤵PID:6656
-
-
-
-
C:\Program Files\Softdeluxe\Free Download Manager\fdm5rhwin.exe"C:\Program Files\Softdeluxe\Free Download Manager\fdm5rhwin.exe" 21907CB0205CFF989F82C03684A01B86 phase14⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:6168
-
-
C:\Windows\system32\netsh.exe"netsh.exe" firewall add allowedprogram program="C:\Program Files\Softdeluxe\Free Download Manager\fdm.exe" name="Free Download Manager" ENABLE scope=ALL profile=ALL4⤵
- Modifies Windows Firewall
PID:1748
-
-
C:\Program Files\Softdeluxe\Free Download Manager\fdm5rhwin.exe"C:\Program Files\Softdeluxe\Free Download Manager\fdm5rhwin.exe" 21907CB0205CFF989F82C03684A01B86 phase24⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1244
-
-
C:\Windows\system32\netsh.exe"netsh.exe" firewall add allowedprogram program="C:\Program Files\Softdeluxe\Free Download Manager\fdm.exe" name="Free Download Manager" ENABLE scope=ALL profile=CURRENT4⤵
- Modifies Windows Firewall
PID:6744
-
-
C:\Program Files\Softdeluxe\Free Download Manager\fdm.exe"C:\Program Files\Softdeluxe\Free Download Manager\fdm.exe" --byinstaller4⤵
- Checks computer location settings
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2304 -
C:\Program Files\Softdeluxe\Free Download Manager\importwizard.exe"C:\Program Files\Softdeluxe\Free Download Manager\importwizard" 3FE02402165644D986B63DE6638495E4 --printFdm5Setting=ExpectingUpdateToVersion5⤵
- Executes dropped EXE
PID:5484
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:12⤵PID:5112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,618355634114584065,7416623796703505011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=132 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10516 /prefetch:12⤵PID:6872
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1384
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5856 -ip 58561⤵PID:6120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5960 -ip 59601⤵PID:5132
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5380 -ip 53801⤵PID:5480
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1136
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultc075f2feh203ah4aa9h8107hf4260b87269f1⤵PID:5696
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff9c6af46f8,0x7ff9c6af4708,0x7ff9c6af47182⤵PID:5128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,2030331544266334487,14213514532812670802,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:22⤵PID:5716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,2030331544266334487,14213514532812670802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5732
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1604
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:6076
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultd7c01233h070ch4784h800ah5b8235378b511⤵PID:6032
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9c6af46f8,0x7ff9c6af4708,0x7ff9c6af47182⤵PID:3244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,10516114137665424905,12103346103491601809,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:5544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,10516114137665424905,12103346103491601809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:32⤵PID:1496
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵PID:5848
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\These.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5368
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:6096
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5560
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x49c 0x50c1⤵PID:5708
-
C:\Program Files\Softdeluxe\Free Download Manager\helperservice.exe"C:\Program Files\Softdeluxe\Free Download Manager\helperservice.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6988
-
C:\Program Files\Softdeluxe\Free Download Manager\fdm.exe"C:\Program Files\Softdeluxe\Free Download Manager\fdm.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:6544
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD58d714515862e267b9c39896e03aaaca4
SHA1f771a34bcc4061adc82c1151e65e0f20d2c87d14
SHA256db6c6aa4ace6a2cb863d104426158c56cfee0a68667f8274871bfc60d5f01904
SHA512f81720f102ec43f238585ac6fbd0231fc722b82b6068fcde3feb1bd9f36d7ac84985500e22470591a95914365be591d54d98cc7e95f8c0760711cd73e6e1768a
-
Filesize
3.1MB
MD5fa2e39b1ab845e01201aba503bfed842
SHA1d6f73937239e3b7ebe48584a543e72912db6d5e2
SHA256384dd0ccc9d8abf3459275d0064cc1dbf2a24429f94ecf966611cb6c65674811
SHA512ab3db8cb7903038687bcbefdb8c55365d7c4dc72a5f2ad9ae1514944fbc8b6adc67267e6121b8d16cd6fac6a22d8c60829579897fd308f0274e95d560629769a
-
Filesize
1KB
MD563340c8fcb71734ce4bbac29a86821b5
SHA10cfd02b3e95fa482cbd4bd83b0f2d9214acc9709
SHA25678b5fc58e6d881d16351e92d32b8cadea6b14fbf8c20c1bc7e56d02946467ae8
SHA512fe035bb77a32d0fe9d4983d90c65d4c2600a019ac20743dbec409f29ffbfbecd8bca2d15abfffb2e71b77e3c105e248627a176942cdf9d7b98ed9113e6f73ba0
-
Filesize
215B
MD52006d4b7d0da455aa4c7414653c0018a
SHA16685b8360b97799aa4d6b18789bf84a343e9e891
SHA256a96c7bf5832767bdc9d91e2290a3920aec3abfbf2e3814bce38b49483f16f84a
SHA512703804e6fab0cf44317b7292c547a1348e2e7395e4b71367c32c3b097bcfb3344d3296179bf4ba33a4c752ae58a3873af57d8cdef35a34564205356bb4e6fd84
-
Filesize
7.1MB
MD5d196125ef7b84019dd830be5fa1f4bf5
SHA15571646807a2f54c6e96e832e373d8d8d55d3f09
SHA2565c7f8211967d840b974bb91e69e5c16ef508882533545949a9330442be0008fc
SHA512ad26682b1ce0fa4cc09cc760ca91e2873c81f4e3f71b868e28dc73c97b91056475876acbf4b5d1132762e3af4be2dabf5aae34ed3ed15a0edc6733162f4e4644
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Barracuda X_FirmwareUpdater_v2.4.0_r4.exe.log
Filesize429B
MD52647d7d1f2268a06298ef5d6858c4097
SHA15772b8bd2a700f1cdf09486831159f8d02b3eda9
SHA256fd06fe97d865543d9fe0231887af9772e3f6491755d4f78a5fc33fb85ccfb165
SHA51209f754162094cf71c6fcaccba130ad429fef49d505c50f88f0f5bafe7473d26581cdda275f2177a26279d4455d53f5359024e24b1888e90656c40ff0f397c9f2
-
Filesize
152B
MD579a2955fb9b7549b94b54e6ef89216a0
SHA15344266d2896429b18800b4d2594020271177e0e
SHA256a47aaed5195f18b2cee081ea1e112004e4c6aca3df11650683e2b360e18c4786
SHA5129ce925d0321a5992de0d925e840f27db90816d16bca6df0a6b69f7df0fa84e9ee4df883be72929517cb03d1b1e4cb94cb7603316469b048a20a926075bb6efcb
-
Filesize
152B
MD5ac9f30591cfd1878c9676c64f9bb6db3
SHA141f872fff124774904c73e79ab6c34de86399276
SHA256ffaaa6d6ce0550c17b6c3b709ae368da88a09cc063972fe9755e58b67f9a3bb4
SHA5122dbfd74471986fdfe58e31a5e143dc572dd3c5da89e04347d0e633330059fecb5ea1094598cca4dbd78ee357a0d04909a30010f2ae621c368822d5abf6255ef4
-
Filesize
152B
MD517242c1a46a0066b1f588997595e4bb9
SHA1808cac0b7a961ef0e1d7a44747b507145329b9e0
SHA2568da28210cdd4437fe75c91aa7935dd2e882c78d424e55248d32191f995546d27
SHA5127eaed44f05d814628e5a4b361c11351064fe67581442b3ec11cfca3229737a7f99c59acc39b1275dc852b8b03bb1ef2b63f73ce676ee8b46443e46ebc923bfbd
-
Filesize
152B
MD5efc9c7501d0a6db520763baad1e05ce8
SHA160b5e190124b54ff7234bb2e36071d9c8db8545f
SHA2567af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a
SHA512bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0649f7f7-d1a0-4409-bb86-75f2839c5282.tmp
Filesize22KB
MD5e2b6143e3df6e60b969767939a06417c
SHA13c6c9ab0011254908c7baa1579ac850c1bb69464
SHA2564f64413500db528d23c5a2cd6ee372e363c755df14175fbc1048acc6b802f544
SHA512d399ad4b3135d18176d1a478d0f0e03111ee40ff25b33bd782f1a39914d92c84a92c9f3e794a6d5ebb9baa326d6fe58d8be1c23fd7c6a54b1e203189cff3d36f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\54c36adf-508c-4810-b171-90f8bc3fd879.tmp
Filesize9KB
MD5f04812784c3bbe39225fe639216ab65c
SHA1189d71c2bde0133f14b412d5456bb18ed14c8bf9
SHA2560c6ff07bb882032c85adc0c32ace699cb240961b7351d01d0d01ea0e16277f4d
SHA5125fc53531880b36f70c17f435fa01b2477c375fd975f61336cb4a2475450849c1ac7c4679c6cdc64d550ba49c5ebb37b798ef2a38733b7b68b6d7c97589d9f2ba
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5706b608-3711-43ce-be11-d975ebcb30db.tmp
Filesize9KB
MD5928a7e1ada5c68bba048147e03994a7d
SHA13b7238a57168e731daad70c30c587563cd59109f
SHA256a26d7dd86a1590046d05916cbe01c9e24e499413454a908ac2d3842771aeeee4
SHA512808463b4c8aee29c0ea203f523eed0e2f65c051fb12b3129175af26a7af7fe85f05dd052c3868c2533ed1c52c967fed9c6ca1b679a13e4d49e90e5e134cf49c4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7ff5c483-2210-45d4-99d1-342a50902aa0.tmp
Filesize13KB
MD56aa9caf76d63208db3fed2a0ec027c1f
SHA1e26d57191d952197f1158ae8b341057dbf27d79f
SHA25678a5deb79e8dc5225d2b10e1d271f68782351bd50be891d7a5e2a5decb67671a
SHA512a07559cec652ca8643c8b973d61272d0cd5bca95862539fc2bf439feda1dd63e17ca0d15172cf959df34181a3e6ceb8991704a8262f7e772ce49529fe517f291
-
Filesize
67KB
MD5bea64c447b0f2a1012d0ede8e09e700d
SHA103c4e014a1ed074ed2611b5889ed79b6f1ed8aa6
SHA25634dcdd7a5b57897d1eb1a2620ae5bc31d4b5d80e761e62fb8cd3c2a3b907241f
SHA512ac1c4b495b990d8fad333f54d3e61d5573efb7a0c7c584659cea48be8d4857461bb011b1f2a4966cd714bb9252cc1750e8e53f2203418ca19fcc8143fdea6b76
-
Filesize
62KB
MD5c3c0eb5e044497577bec91b5970f6d30
SHA1d833f81cf21f68d43ba64a6c28892945adc317a6
SHA256eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb
SHA51283d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38
-
Filesize
23KB
MD5f5e4e5b531d3b25b47092dce99642441
SHA1aa2f45608e88d54a0124117bbe797e736d5917cc
SHA25668f22a4a65c1b4f9e24b3a19182dedbbef4fe0a217c66c34f6103dc94da7411e
SHA512ec8d8f17bd6920a591b7fb062d01fbebc021efb09a50145e4fb2b68fa9bf08444abaec3d7e18777635ba76efde976e0806859ec21fd497f6876a7406a66a090f
-
Filesize
19KB
MD576a3f1e9a452564e0f8dce6c0ee111e8
SHA111c3d925cbc1a52d53584fd8606f8f713aa59114
SHA256381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c
SHA512a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274
-
Filesize
65KB
MD556d57bc655526551f217536f19195495
SHA128b430886d1220855a805d78dc5d6414aeee6995
SHA256f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
SHA5127814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
-
Filesize
89KB
MD520b4214373f69aa87de9275e453f6b2d
SHA105d5a9980b96319015843eee1bd58c5e6673e0c2
SHA256aa3989bee002801f726b171dcc39c806371112d0cfd4b4d1d4ae91495a419820
SHA512c1e86e909473386b890d25d934de803f313a8d8572eb54984b97f3f9b2b88cbe2fb43a20f9c3361b53b040b3b61afb154b3ec99a60e35df8cf3563dabf335f54
-
Filesize
1014KB
MD54c448576c48fbe3edd9953ea5e096a9b
SHA1384b800fec1f0b3e672b6f3c39b77301d147fa25
SHA256fc49a8677620dabfe0329b5a5a9accfd6c1fe202d43b1774589da567c3f8b0bb
SHA512e110e98d7486132d3656268fad12a856755f768a4175a60aca8e22af0d34dcb4b9342c50f1d31aa244d8f243ed5e138aaf8a9335c66a227b5432f0b43477952d
-
Filesize
62KB
MD5e3fdef1f1a2509e4a9cdc2148f751322
SHA162520e5b88856a3328931138a12c5013271ea659
SHA256bf23cf1a0c5f51fa6fa8970b364e8db18572b201b0df4ee571b86e4e728573de
SHA512fa44fbab1e80aabf2d4783c11d5ea3621f63f9910c1987f2b04f702fb5a2cced4e7bbc53b29a42f0f91339519a220ba47fa6117d3900a92509a577798a0b787d
-
Filesize
31KB
MD59c7ea200afb2dcee2da5233f1c55e97a
SHA1ab32e8f411407c2fcbb115d785e8c4d905ee0247
SHA25617d6efe2bac1da8ade273d0ece69aa09de79305f405e045e9413dea1b3f022e4
SHA512da3dc551c7794552514b378d8cbae9fd0c32712663b947654967987b530707c82dcbbcd6c56662411cfc59da453861807ca5a527c980ce35534b495c15b88271
-
Filesize
64KB
MD5dddb088e8db2750ffb12a89289c8f112
SHA1ce83692bd2e3fc8598b35d70b831a9ba7c5cb969
SHA2561bce785eae58d7a19195aa2aaa683e57496478b230c9ff5a014f5a0d4bd4edac
SHA5127472f909ffebf6213cbfdbfa35b862744088d7ef598b7d4d4bfbd4d3076332bce4326db1fd658022bac986a61280c71254774532458577fc802396581d56930c
-
Filesize
20KB
MD57270c5efb635e161172d21ae40aaeac2
SHA1795d2180a973f421b5dcc1a508bb187d89feb05d
SHA25653540896da2a6487ef3bdc73e045fa23f41c58c299d5a295ada803ad939fc844
SHA512ced3dd3e57b5274ca5b5a37e10fd57c3e64735aebdd41b7bc9356d196f14dfadc49f734d069726a5be82026b1f9a8149ec9129f9e37324ca0b8caefe1225fcdc
-
Filesize
19KB
MD51fddf835f21c498f445ca8ca02d67a49
SHA1364efa8caa3bc5b787968044109ebae5ed223b75
SHA25637ded669b3f2252e1a40088234fe3e7404dc455a05d8cd38dca42bc88f519ccc
SHA5128eaf1fdf6dfcd9efbf27b458cb96301930e1fdd53c7279d68100b2823ddfd317017ddffce1ddf86e1a6344cb0c0a2149976d42f43533420620a5d64c2158882d
-
Filesize
20KB
MD587e8230a9ca3f0c5ccfa56f70276e2f2
SHA1eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7
SHA256e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9
SHA51237690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8
-
Filesize
50KB
MD5b559372796461f67fee0b12ff08352b0
SHA1835e55eb8016c86cf9cb77c3e1961265acae602b
SHA2569efe51469cf7c63c171070d9f011a00fc3bd41731d31d04b999c083d12a25749
SHA51262143e7ec7b7b922c056c9f0310219b9c93eed9bf0ac5681601c07735d19a3b466fff9414912f87f1085471c7de49d6a36eb5bb8225125240f60fd425955ccbb
-
Filesize
46KB
MD5dcfae2907d72940c725a985482d0f0b1
SHA1053c92c84730b591743284a0e69fb1ef639eb701
SHA25632e775c7b0976213c53a8d1d2f0357957482efa8a9483e068cccfff8503f64d1
SHA5128b57c84d513a77d837105cd1d56c0531533de74aabd727f581cb5351cf6ac7f16ec0e3dd0097794265f90e1ad0d895b9e1b3991607df48ced2efcd94ed78224e
-
Filesize
71KB
MD506262adc5c880e505177c3a7b563e942
SHA1af79a1acf2fddaf388b5947e753c74b1a95cfd8b
SHA256ffedaf4aa6a7994eca871dcb968d59a39bd74e08cfe51447f7725e55bd4737c5
SHA512557702aaf34944cb9af8d1c481fba630d7b6292f06d19d3cd98378494d7805b4e8e19b50e8baa02532c588f07c74e7bb6f6fcef3e0cf1b581c4f78d103d4dfcf
-
Filesize
87KB
MD5f6c573010fcd389b7dbdebcd92747756
SHA10c7306790cf8594e317e17b6c4d66da0d82e20a7
SHA256aacbb5cc04d1967b2f7c30131de705f0e7b63665426624611beda47106782c75
SHA512cd7ed9ece79e32cf6f7b7e56879a2d438700411b95d7860b4bb894627a10456dcaa008e6a044cb6056b1bc9c1363f6c709cbbb32116b3d3acf4fb7c1285cc910
-
Filesize
54KB
MD5116b624b6be29f344eb58a00fcfaa725
SHA18eae48bc4ff7cf44fec6455b7a7dd791a3722a87
SHA256834befb3d6c22a64b0054ec4e1ea80a6415417484e6c1d3d995417c53af37fc0
SHA5126f1ae00fa031ee17bbe502f6d2fe7ce4f54bb9dda946b75c1a68a0f18d20d873518f3540a0c37654300ca35aba36c26ea1ab3c3f85532c484df94e64f725d3ad
-
Filesize
21KB
MD56d8ea71440902e8225858f7f55c2cdc4
SHA14560a5698fc4aefee2920a13b817de453c9323b5
SHA256c3cdb26b6e874640d997f9fcd848686d29e2e4dc98821313961905350a9ef58b
SHA512f65f764c24f1e81cc1276663fb8a3f93d6bd3b59357a25b20644971fd14699c0c5f634f4d6f2bd8cf9a9413a5d2e60e4d9371021bf402a1e20c784a4c8a4af43
-
Filesize
245KB
MD59ec23f367df8e46f69d5eaace92526f9
SHA16c1672820dc27bc7817c5f1c48c9ee4c4ba1ec4d
SHA256c25b169b07f15dcc16e1130e0bb8ceed01faed90032a2e6be24481a597ebe722
SHA512676ff996dc4a454b81f898d701745cd070ee3eafbaa00a7125146b8fe34069bf9303c5390106fad9b886de20fd9091e8bdac2cd3b26fc6c50014ad6562943a89
-
Filesize
43KB
MD5721d5a7dc53f9de459ae2865b17e5e77
SHA1473fac88b0606668fee2323f3a8744d87c918d4d
SHA256a38813338c370ab7451d2122daf072fe683372bb68f3cfa107bad12a42d394c4
SHA512986f5b66607b6322e611122ccbd85392a939a9e61ab2db33d48ae09a53b1e749f51eab6496385210889693d3dc6a566f97760f8883882df1e3a28e8edefe0aef
-
Filesize
134KB
MD55b64c6650eafc72f8ae606218e2a5915
SHA1652f10e0e9c6ce7b756598066428d4b2b8b849d9
SHA2567458a9ae4b4f9ca76670ddb0f2cf151d71b50351423761b680be19272fc882b1
SHA512ec02c1dd2afcb763730ce137ddaf3ed80f78ebdb225cc4087f70a5f8ef65515ca1d91c808cfd537275a7d16ce64aa343a3efc3299129d5bc04192f99207edf4c
-
Filesize
69KB
MD50df504ebe4764e6c6308b6bf2511cd7d
SHA1cf6103d166562a2b8d5657e7d9b36f14fec3018a
SHA256661e85f736943e7b6688f185b063e9765ad910427a0c76a0b18fa152891cbd06
SHA5127685a0b828ec64efb3d8b29b482c297c9e0bda9eb26af62343274afa39fe8107cab31833b49b8b9c7a0afb7c71d255a0401bd42383a17ae41bf89554369604c1
-
Filesize
134KB
MD56df4b22798770ab0a4fbdfde60337cd9
SHA17b74c71626e8aab27ba0c627d9cc7d17d0baea83
SHA256724b53c5be6bf6ac13fdc315f74e10e833da9efc11bb1e36c63b099ff7ee75be
SHA512a6a38ef091f07c453e68971bd1b0d7d3041bb7630275800d452f75ab935432b25066c2ccad0f90ecc4cfed20d8a88e5e12ae03ccf6b0791b3e0fa832986f15a3
-
Filesize
33KB
MD5c15d33a9508923be839d315a999ab9c7
SHA1d17f6e786a1464e13d4ec8e842f4eb121b103842
SHA25665c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98
SHA512959490e7ae26d4821170482d302e8772dd641ffbbe08cfee47f3aa2d7b1126dccd6dec5f1448ca71a4a8602981966ef8790ae0077429857367a33718b5097d06
-
Filesize
16KB
MD59c6b5ce6b3452e98573e6409c34dd73c
SHA1de607fadef62e36945a409a838eb8fc36d819b42
SHA256cd729039a1b314b25ea94b5c45c8d575d3387f7df83f98c233614bf09484a1fc
SHA5124cfd6cc6e7af1e1c300a363a9be2c973d1797d2cd9b9009d9e1389b418dde76f5f976a6b4c2bf7ad075d784b5459f46420677370d72a0aaacd0bd477b251b8d7
-
Filesize
201KB
MD5e3038f6bc551682771347013cf7e4e4f
SHA1f4593aba87d0a96d6f91f0e59464d7d4c74ed77e
SHA2566a55e169bc14e97dfcd7352b9bc4b834da37dd1e561282d8f2cc1dbf9964d29a
SHA5124bee876cea29ad19e6c41d57b3b7228f05f33f422e007dc1a8288fd1a207deb882c2789422e255a76c5bf21544f475689e7192b9a8a80dc2e87c94ee0bc6d75f
-
Filesize
164KB
MD5b2d307df606f23cb14e6483039e2b7fa
SHA1fddc8b1c688ef3baed0d5a46abf5f01f0edaf02b
SHA2564ac8e03606ffa4c37f61a6510a2080f1f37a7054f4726c214887d3b23f72e369
SHA5122623c2a235720f389e0d8668da01891b7a0d23a0fc3db82865d8cb9bb730804ee84fcd863f33d28aaa236c1261714ff7c325fa677a4599356c29682d3571acee
-
Filesize
145KB
MD537dac052614e6b0313388bb20acdc929
SHA107ab6772e27b7b9580d69cb0a1eb3fc13e1dde78
SHA256d332e2e2790c6b751d4fbba8862f382159c0560f947b85326c70e3ab346f7859
SHA51256ae6d57b47cdea40744c8b95cc5e5682387aafe7098ef27d3664dc7188261721b8e3dfd73e37e97623290922172f63e898fdc16442722131c76852772c5035c
-
Filesize
164KB
MD5f36638c2135b71e5a623dca52b611173
SHA184d102488738b0ebbc7a5087973effbd54c95bd5
SHA256319cff6e7a31f0f2a41c475dca42890aa5d19fe16017e2290f8c1d4e14f76481
SHA512e9d55580eddde182cd9ab96057e129039154f54efb0384613aa9513ed0d2d16eaccb5f6d77a299de601addf0150dcdde1fe98e31d047bbf85a66ac319c3280b5
-
Filesize
162KB
MD50134dd8fe6fe708de73909a71d842780
SHA1e0d7acf2ca3dd0ff68f533797bb94b0580397e95
SHA25604d2424978ab93cd524970aff21200ec88358176992af718ecd9fe96be5ae4b8
SHA5126959cb31295a4130a5e4641e96d4d29044acdd163b648dc87bb1ead82001e3c7486b47c3f8c66c503faece623632cfb7db696e30e5049fbba241a4e212d786fa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize8KB
MD5e20e7153589dbe07b4d3894b633cee9b
SHA107dfd971ab292348b6b155dcc0a20805e23cc8b9
SHA25672f7c6e8a889f53d14cdfc6719c7f1e8a35ff1aa49c4d88be2ca940153732448
SHA512c95955ddf6d872b0edfd38efe015b92ab78e526c6f95cf198a85450c7eb0bb8cb5798b87e9b7f2507e203a8f2887a03430f127d0485e33a0d8f75e0c1865cc5a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize6KB
MD5925d7dde9562f666c29f2d417c7f9cf6
SHA19b3c9480d9b4f12a968d80a29dd6c2b36ab27e6e
SHA256eb87dfd348af110e9dee702f4dc46f2804d8dceacc2c14e896ac5a43adeeb13c
SHA51209707971dee43454844160940999b1d8e04dc90d2dd0c4af4ccfd61c2977592ad5382078e295fdd1d1790bc01a14da03d816b084b599220c4e93b3090e6a8c32
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize8KB
MD5f47496e5471d3a4da9ac5acf997cd55f
SHA130b8c1fef3bfbf08d29df90ed134134e9d0355ab
SHA25630d04a147de41f6376237102cc44adbd1326090760c1513d0876e7e6d3a4a81b
SHA512b9434694dd9634861dd8ca48ef2b81f629ceb41461372c63c7efce8b86ad66ab4c4e149a54e55d088107f35ed45b3d55bc7db3a4ed6efccd04e3d6a20c325d3b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize4KB
MD5abe463064ea0ac06953ca21ad8d516f5
SHA1c2a5b625c8cf3633e5fb4f13e83864e0595024a9
SHA256543bf1c40480f9d1cbfb771c3644e22e5855e9f5db6ce565c87989f126de224a
SHA512b9490c14328a2f80205677dc5e1435a25c43fec7ba1d251828f6eb8508b5eaa1c36437e07d124a32739355e50a9221671742243f752b18aa76e817fd914ffcf9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize5KB
MD5888252f527102e2d95a7c8532d565bc0
SHA179b1d17dbf45967d770e9410775fa4a0acadc4af
SHA25659c5d6d1b7b6ad32b1089ebef5405e94155911c7c52de97f29947549fda02a64
SHA5128b1529473b191517e1cc7bb7f55806ae0787c5e07080ef682ec60f56e23e25f4d2966121b4702c79dd5adf81ad3cc7407bc392156531a86608c2b399441d8c8f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.techspot.com_0.indexeddb.leveldb\LOG.old
Filesize396B
MD5c17e1fe08f50f274be35769da17e8ace
SHA1d9bba9025d5649c5575f5a7e82b2c1c451b60f03
SHA256427f53fd353ddbaa6410bb514238e6cdbc5c24ff7232ebc31feee469473a8e47
SHA512972e8f6ecd5b744066912bc0ce072319a1fd2db75b7600ed4fba5487ac205de521cd0f184dc13f48b7ccb7743ce4fa4f7e5bec4024f4c56c2944c5cefa02e6dd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.techspot.com_0.indexeddb.leveldb\LOG.old~RFe61feb2.TMP
Filesize355B
MD57522d915aca6864d273343cb514f4eb0
SHA1bd2e84f3e7820df1dda3375d8a4efb121db1c956
SHA2560fc789d7ea6d7b65167b7b2041a9c1c7f3844e0aee664283c5cd10148ddbe5b5
SHA5121ca4e640e158e020ca0eab3e98885ce0ef9547d43c202ab122166ef17d87c37a90569d41e229962bd1b5b04c96ef2664b0d12c75f4a17261e2673b0f45c04bf5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.techspot.com_0.indexeddb.leveldb\MANIFEST-000001
Filesize23B
MD53fd11ff447c1ee23538dc4d9724427a3
SHA11335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA51210a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
248B
MD5b2cece252ffb248c18a9f1d8db06a85c
SHA12544526e7682c3ac66ee046c59cb8629f42b4593
SHA25652e0ed7ed2524d2b20831aaf8191c828f9c1bf12b95fbed14dd43135690813db
SHA512dee78ed54de580d03e0f9e20c72a6106f470fff6a01b78d3ec2d0f09b2b68c2fb38b9d0b39bc90e3f833149a0bb063c2577b45c105099eac6fcec067218189bd
-
Filesize
11KB
MD51e99030201bfbabb186156c70c5fcb6c
SHA19b701caa101c2ea2986c5ffa62364bce813b1f37
SHA2567db4cb97e3b2aa92c9aaf91145501290eb72aa77b331411ac077c98069335db0
SHA5124a0626c301736587386dec00debe66ce4fce6af005f1cd504d1ad9c9b1588c6907433dbc6be7649daffc1cdf6d6740bedb51d0f06be21fd422c4c5226f5bc6cb
-
Filesize
19KB
MD5edfd885be37ffee9e99b0d02f76895dd
SHA13a2b9964dea36a2c3d8fc4245ff0629a7b4a5726
SHA25678d47b1d308da6948a058efbcc1d3fbe9e4b2507910e984e116327f246177d29
SHA51293c9d63325f742dcc9b7154182c629088fe7094ca4e6c1468920c2d327077f4c88b1da8c8b16c60847e1fd50d2f42e25bb62e159c23fc0e06fb35a5cfbd40bd7
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
318B
MD5223bc9b4614b16dd79f5ee645adcfa92
SHA152a015e7a29db23ec5d6127a7471fc00d7ca5681
SHA2569837b48e81d74ace77ea339d73ee80ba0c478e8bc1250d62cf2e05ec583e618f
SHA5129b88b522c638b30f1cbc8521afc6ab7a90c040007c0de83198460500d3914ad4bf5455e442e4e844edee1fc07d5bacb1fb54941bb0fc1cf3526a3cb687deb06d
-
Filesize
27KB
MD58c4db2e61173960169de6daee0d60356
SHA1157584cce9ae3df2c1918744cc179435925a5f3f
SHA25620a6a3aa75190470cbfcced9ea4ce18806c936fb86519305ce9c2cfa370f7ebb
SHA5127c74d7c55b7d8666eb7607d8141e71756eea6b8eda2e655b3c974fa52a5835ccf4722fa12108b29247eb124cc077042f641ce385c63c0c0398971a5556c68835
-
Filesize
5KB
MD56ae89481ba4a02c08d64a945d5aab323
SHA175444ae4ef8e0a59f80e41b11835eca2c8c9b2c2
SHA256fe35a7714790b801e5457c2b870bbc036682911af11735a302749d5ca0d4eb3c
SHA5129203dbd059a0226d3de2cc323ffc01e673a2efcceaca916e4fb5e62e406403b213dcf77d49107ffa1325188b57a5e239c5c37da265c8c74d25d69ea0b4b4737a
-
Filesize
5KB
MD5f13b8b19dfa392063300648def74e71f
SHA15b292f69f1072900e021fc23735df00d0ae7c1c5
SHA256aab4f9ca5e48df15df780513848fc984bdc3a7a156032f4b6aa04b6a13c66422
SHA51228703c46d4c1381782f2376f75b2d36f7397aea8c25753d11d8e2c2b433067353ae3b4969dc015b2bb0bb0d52134765294304e575aff5bc775ef7ee2e24ad83e
-
Filesize
8KB
MD5fd383a05988b271885262fb1c7753df5
SHA10b138261b79e6f31d6435563522250bc3969eb8b
SHA256d67052ae7099237813eeaf69557d21556156a637610a8e52e2bda24224e3e240
SHA512f6e8b90bd1d85f132f194e22633f18146db51357e07b40dcd6296c8fe398a778e3133d7f030585276eabc5ca3f5735db584ac5ddbfaf0e906daec27d05851c37
-
Filesize
13KB
MD567934d800ed5c5ca9e83a4e3f0a6ea39
SHA1954bf485662e4c5422ad14ae5503dfa166adba70
SHA25681e0e54753129629471680fd3ed594a77ea56303fd5c006f57a0a8dd4710fb1b
SHA5122c2e3b738b319adf02ebad35a351e54cdd7125396e6aa46a47b6e9b1e36dec4583bbf7ab4d64191a7a84cbda4ff876b06b7b0d087f9a5be7c25a609b5c5ae0c0
-
Filesize
14KB
MD514419e69bf930910f0770f89b299872d
SHA1cde4fc11cf8a830fb1c6a7a41a8ca4d514b5c1c2
SHA256bb17f9032166355b7bfe61882a9cd16bdc24fb2ee0e59ee41e6625a77612fc7e
SHA512de304187ab467355e2fa5c9409f42f164c3677d01d4155c2c967a80dd7de4d27b6e86299232f1886aef2859e4fe46343116188712e85219123e8d0bae97bb269
-
Filesize
15KB
MD53e14ef3eb31b3a0df6debd053b941523
SHA11f2d50496e0f8f31654aa1e7fe37be8cabff36c7
SHA256c1e27f5d2b62f7ae7b6f1433043b779cde8190ec47c3b0f2cbd78fc7950fd338
SHA512b244c75dbc0c4af2e2b246cba3bceada1e492df278f80362782f7c6a8939a2cea6b1b4dd9e5c0031a000e6a4c4b1e2156add3379f9950be09f4dd98f67f9d0ec
-
Filesize
16KB
MD5e293f5d72f2d455c499ab5b2bf0df8dd
SHA18bda0991e40077395b62699c769ff7af42f37be9
SHA256a6fd74c68d306364f728c8ed190d94169f8659cb260068ae2ae0dc8fb5459f05
SHA512ee9ff3c0e6a3cac4c9c2690f8d60684423ea6c30e129093e6f34a65d480ecb9bc1866a14c5a3f841b5561534d7b0c03d0157a195514ad21408cca4e04540e05f
-
Filesize
21KB
MD50406d8472e3dfa08f0f29f6223024ca3
SHA1bd7d95fbda9fc2da7af9d7bc5a9bef579676d33a
SHA256a6faf2a370fb51dd7d4024b15c2356ec7f6b47a7aaca6dcdcdf330974a883646
SHA512a538255d7a6e7eb4f9427dedc213bee7559ba7d1a574d7250211afe281350e12cf4484c1f44e63ebee97e57cebdcf21d895cb9efeb3c37475b5cf13cd7b3d741
-
Filesize
25KB
MD5dc15b04fcf55bb572fed5bfc32220002
SHA195609eb4748edad8d83a4bcb6b09d6fe0eb4deb7
SHA2567ee4e30fb6b9bf50d2a28ccdb4b40b5e58ca5a13bdecc477cb6537c115682054
SHA512f82ea29e9e9e84839c04954ff3201ff064df1f3e53b733940e234bb7fe55c63513958074d3f66b5a9b6d3d2e609629fc048e7e1cefe57f2325761f285d7241d2
-
Filesize
19KB
MD572049c9c10d56fc36a7e07d938c23e6d
SHA1156410a6df9962c9a5baadfc9d4c415bd649aae5
SHA2564f73a7edcda39fb8b8aff4f171e58e25d648d5c15d30633f8d515ac378e74662
SHA512be22141497d851a283b6ed4d5dd76f7d64a008c324c6ec93195adde0b53e5427675bcacd54ad973948844247e86ef10a22ddeec1b905a896fb897c7ffca42aaa
-
Filesize
6KB
MD529a5a0501f031f9f929c08a7a6dda9d5
SHA14889c44016d61765fe8f4bff7e331c2732c10d5f
SHA2563e78f9647d6743fea83cc5f388382395a8bcf6ce289c5458111a456819b382b1
SHA512a01a6d98a55d641e9cafe84f76d4b3e325ee64d542d2948d2b21582e65abe63768f3894814da5a8d4f515985686d7f421dea26389cb4d9ee171b2a51d18bfb5a
-
Filesize
15KB
MD59fd5dd5341b8ce1b8bd26155e95a8892
SHA13dae114d8e5af83ff7a68d6f2c488f3a8098c51a
SHA2567795a3bd10ca206c990b2820f37d758637d0662c4d2e0e58e7ceb4119f78a824
SHA51298a003c41c1d2d1fe33ec6a8f148c50449f20e0183184f12f24956785de6dce555c4d34090c30eb597b9de56cb45881b8806f7672640113a9122269c0306dbff
-
Filesize
15KB
MD505694933a1a2d8495fe163f5a83489dd
SHA1fcf05b17845db701f467cb55ec965bc7c6c5ec9c
SHA256053108aee43d97ce4df1a80a950500d8f1ba592fdc919a681b1d7aab7e75b0d2
SHA512621fcc774334086030b8fca31bd312371181283fff70391aa087210c177f6ed1dc7a6ac8aceb5e855951f1e121a75144c85cf3731d9521556bcca192bd4800a8
-
Filesize
17KB
MD526031d5adaa0d963f3a777c1db634862
SHA11d6a6199697ebc31e9a476b2b08aa6bd1da7634a
SHA25617bec26cb5b0cf879dacd7466ffeee2f02591f7dfba4e18b3f48a819cf8e6792
SHA512c4e98d65fa0307e2fad679fb2eb0d26133c534e61dfd0317eb58ca1be345206002546928f9a48846c6dd7dda90b51490b0c6375a454562b2cbfcc451fc1ee8c4
-
Filesize
17KB
MD5c5a5656e2e7c9557d3e1494122a157b5
SHA128dd7f2cf8567bce1d2ab634f67b8026cca60d50
SHA256932a69740918b9721109ec00908580ff75b1495c0dbf37016d3dc7b7cf3e4501
SHA512664358e739a13fbc0b63c8a3bf586f7fae4468cf9a14334eb79e30744884c077f3ba3b6e89bc967166582258a0a0f66e40cd3d099cd892fcdf04494ca2996fca
-
Filesize
16KB
MD5f4c1c2415cf391af8dc27cd5ffe2ddfc
SHA13bcb61ad039ecd1e1b704f9ad5cc7d8d69c438d2
SHA2566d26de59f11653b9e21f08403a3e72e1dc73d51414ff6433612f52bf43aef529
SHA512f66e51c1f18a93e902b33b0ae7b90cdec56a177626ca07cc2613969eedadedac756768c734122ce4fedb1d0a5f986ef1900d7547ad29d26dd37e010e0233fd91
-
Filesize
5KB
MD5969d239f670ba4d9d0ec17a25fa70ce8
SHA1be648bbce3c174b9b34a677592b07c2954f2601a
SHA25645e32fc52a9168f2c02a93457db067c6f2e79bbc13cc73d24e0d44bca5e4b4d4
SHA512ce3b88929fc9ac323813e7e6d72bfa85818613bb4ab258e928ca638e0af9c4ba20b2b6e51bac6c70435428e95b6910e55bbf4de05d024d0c1e98e5fa77a336e8
-
Filesize
17KB
MD513b81df402d1ffab33986c27debdf057
SHA1e9a8ddd6b64d84564425f9a02fcb06c235a880ea
SHA2569247bc599f5dd15a453fa662d851b91984ab3340bc1cc77272da7090a1aad8b7
SHA5124b0a804b2125839b30d6996f8a21843872f99e3f285b7fd75d27a00af83960c9a7c00d060b66231a7b9a03472090ffa498861584f492af771770cfc3903d48d0
-
Filesize
18KB
MD504b90c911836506fa017a91d55ed1055
SHA1b3243e179f428808458a75d5e8f8c8dc65d856d0
SHA2562d3ba1dba8e833002662fc17f1ea90a88948359ebe67d60ad4e9fd2a6a578ba9
SHA5121186e6aa2b918be7368b9bd5bef170c1f8a425443812c8c1b556a7ac0b9011606046eb213c73b6ca2cc0bc5d213851e237156f5e4ce48ab37ca87884498f9c7c
-
Filesize
24KB
MD5121510c1483c9de9fdb590c20526ec0a
SHA196443a812fe4d3c522cfdbc9c95155e11939f4e2
SHA256cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c
SHA512b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\f64dabeb54500ba8849cdb2d5c53c03f35b09605\076a6150-5266-4922-9a99-4c4a3cf6dd13\index-dir\the-real-index
Filesize72B
MD552c3b01dff042b74dc801c9f85788ffe
SHA1866cf0d1d4e0750b62772db1b51263d066585f60
SHA256e4a3d6ff754bfa470e2783fbefd0918574b626a2bba8724b3237f966c5ee82f2
SHA5121cd6a5e04814a09101f87709f17df54550ada1ae1b2b0c2ea286dd8a4b59ac549693a4e2dcb0d46b1c7381921cd78a4dc185b415e03be26bf9539636f3b231e6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\f64dabeb54500ba8849cdb2d5c53c03f35b09605\076a6150-5266-4922-9a99-4c4a3cf6dd13\index-dir\the-real-index~RFe5db6cf.TMP
Filesize48B
MD5ef30e3ea90c46d022fe5c1244f3bbba4
SHA12ad43b2b0ff594ab70147e428c9492d6fc4f178c
SHA2562df85de61825511bc5299c392fa9f4477654c90d08d89c177340ea710d65c8a0
SHA5122461e941b09310cf0ee0e22f28e613eb1be0cffade41b56f62f7d1f860bcd13890639a127251f732192c673d00a624c37389ec47340cd901fcd221a3f30ae0e1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\f64dabeb54500ba8849cdb2d5c53c03f35b09605\340f4b3d-2369-4bc8-86f9-6de51c51aa34\index-dir\the-real-index
Filesize288B
MD5c3941e590fd861e78d26d4afa9ebeec4
SHA1ff5e5f7ace6be2503b88e2f52a0631da1ea97dfb
SHA256414e6009beb34c97cdcbbc044089c8eb48c694f7e6188fd6e82145f3558e54c7
SHA512a145e853eb6ac46bc932dd3b61bda33d881745115980ebc13c8d34cd3b8452d0470f2aeb4f15f546386b2948c43548b8f5df80456f65e93f190531357dc59ed1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\f64dabeb54500ba8849cdb2d5c53c03f35b09605\340f4b3d-2369-4bc8-86f9-6de51c51aa34\index-dir\the-real-index~RFe5df177.TMP
Filesize48B
MD5467b2d5c27b1dcc26ee91f9891610cb6
SHA1f35f6e98465193dc8b715c3d03c7f1d5074b566a
SHA256ea1b1ff94f1b27046b279d5a18ccc98e71ffe2e35400a1d469c86b2553db23f9
SHA5128a1c0f3c6b95613cc0978315cdcf569d3ae0ccb461d711574facf44d45550ca0f4b93e07447f6c9b83bda118ea254ad8287bba421112dfb7c392329e14628c3b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\f64dabeb54500ba8849cdb2d5c53c03f35b09605\index.txt
Filesize131B
MD58d2c2dfd0f946d0e78d8d8616c611ff0
SHA124c252f7f50cbfa3d598fdec53039b21e471c62b
SHA256302981a991b193bcf2dd3f33d37d3d64b8c76ba65055f4d32e1bb1c351710bd3
SHA512da2686c2185287bf5adde7f6c98eb19fb245ef725e19cfbb332e9e78ccb234c0117a244bf38375d5edea954efbd6a7e4585888055306b68507fc3f0da545828b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\f64dabeb54500ba8849cdb2d5c53c03f35b09605\index.txt
Filesize224B
MD5c7b151396293e8d9ffb2b9d7a261d511
SHA13edd107c954ffcf0108f9db8a3470a3c05c1564e
SHA2561b38cdb37113a4156b52de5bde28bddca40a60a9b54f3b6b2ae086e734751d98
SHA51241fe8c1bc3ee699ee5d09cfec9e4d85cf198e75a0c475200e4064aca947f43474b15bf55341f9e0c3cf6a7a429d1c27ad7dd244ee8b320e287215172ff45d58d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\f64dabeb54500ba8849cdb2d5c53c03f35b09605\index.txt
Filesize219B
MD51cf682f6521fe976554a77134c715ce4
SHA15ab5bc550b75fc20285edda83afcc5e008f234f4
SHA2563cf777e0058a63abcc0375fd374ffebd3ed56a04357c5b88c055ec65a005a02c
SHA5123883b9a3e6a93afcbf4563f9de7d86a6f0458805aa4bd1777732619404f24c82773ef108b6ec7a5032b1d4a1a4e385af10fad3663d9e6f8a9a98d98d671d6e20
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Filesize7KB
MD5d22fe784060a369f882b34c1bc786978
SHA14584145f28d173c92633f63478c7b69d31507691
SHA25675cea76747eff394e59dabfa7bf611d6fae4ffe2ccd74a62c7d926ba028753bb
SHA5127ff9bb9abf93b15dfd14129bccc67e8e1112e92e43b9bc100b3fa19acc923c04b3650186c45ecca17a2b9e7ffb04a40b476a8e1656dde642c373dbaa393e4f37
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1
Filesize5KB
MD55ca4b906c710485ab69cf301ad47d56a
SHA132b8c2f7c4d13a2cde7213e29e3fd9da9968a495
SHA256743b77c18a412ba414501873b2843c67a11293a799f677affec01d1e86cd95c5
SHA512b66965240f3afb9cd6e1bd236c6c5c435611c567deb81e55eb56fe319568f8b405c590bbbbd3aa3c45d866375dcec0c9cbf131214af0f451254bca254e6dd42b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0
Filesize2KB
MD5cf46bb4a2be44c1b33aa4d76669120e5
SHA1ef3a0ebb61944c95c6f74866e7ea4ffeb4073c87
SHA25645475e3af2f87782405aada0e57c27c4da4fda6499ff18b1ba52a9cda6bd5fb7
SHA512346ddbad5dea2b7cd5bc714ede85d5d19d5f58d77705d99f7e2fbd62743932d24cdd1f4a01a9ba192dbf4e1c4b05a4ad99496e2dd3acfa13e834ccfa1c3940a8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_1
Filesize3KB
MD505130baea236c93270e1f997aadb3af7
SHA137ae08790c60735d1fba085bc235c6b85c0c5993
SHA2566a518a2170fe28d55ff68af38d0626fa3a510aea991fed181b60855392602ed3
SHA512e8bfecc3abf4b0c36db4ef3762cc3c800fed5706a97cf3464cd1d397781d117b56d8712cf39246dd03bf7de1b74473c42039ca800a6272b4bc130e61953aba1c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\67a473248953641b_0
Filesize4KB
MD55e5bb382bcf924ac17c608fa20626520
SHA1d35ac335c70bef634483fa97a8249030067707c8
SHA25697d938571bb1bb1ac90d1c683f1cc6f1bff3325842ba00c6e5a2c85c7c3dfc80
SHA5123a4c89778d87a4762fcfe8c524e51a210d52a81f8043d3b135a9e9345770da3a8a988a1745d5835c87db74a1b2c8a43d12cca56f90b7dfeca19c634af9163344
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\67a473248953641b_1
Filesize11KB
MD590c63a928aea02a0008c9478ab26f273
SHA12c108ffc12a045122deb5d07623a9c5dbc825a28
SHA256cafba825deabd4c88c8be43f655b0145ec761989fddc53d78250e3235a566d1b
SHA512550cab87169aef95478be241a470c99f8cfc9a9457cb4c3b461b2b085e871180c91e16a8290143b7a0a7b8ead6c57c644c87c034c90b04ea2f08f50612e0c979
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0
Filesize6KB
MD5d1480a2586a994160c3cff475939483c
SHA1202a6f33a927f27fab081b3c7ad5fd4cd739e6c8
SHA256f4687d0373a8b004f6074a50dc6895aabbf79ae8e7de8a13a9e05fa8ffc6bee4
SHA512307927e6ae4b6e1f53e1a9443db1e87e423024a3cbc9f3ebc43901cecf804b72aed40183c7c8406a4b69bd8a18b8a78a3f70d6fc5fd69bf463c96238ecd193fd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_1
Filesize16KB
MD59c195b32693984fbc88f92e0ea46ad2d
SHA1738934d9fb2e6f4514b8284603b55c19a9b6f4a8
SHA256642b53d205f8d9e6c467c2e15ec45c79db97375b255ec7506f291056c0ff3855
SHA512a61025d278950510b49684e2a7ad37620ed261ebbb194cadeb66dd3452b376cc8bae26189a570948cc16b439787f5593b2760195a1696ba64defdaa8e1402383
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
Filesize7KB
MD50c8450ea790057c4f3d39b7ddd1096e2
SHA1482ccdb8a982fa5633486db84784dc7b124636f2
SHA25613d8baf5638e39f256d6cfb2aac1ce81ddd4859c862c7fead417563b299c3187
SHA512c1f7788d725c829b637fea8d6741ca5dbbc6102fde591a3b8f39eacca182f1b44c94e9c715176f1f27332fac13746db4ca72f8bee20c2a3f20b3f43ebd988fcb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_1
Filesize25KB
MD5c42393061d82f3a03c01348a5f37c9ce
SHA1ed40058e892dbf44116fe471857c00fc3c638712
SHA256023cdd8bf896d1b7d3fd697274c2e41277c4253133dad66468d4015b38bda90a
SHA51242ecd57b124f488a4ce7edfbb7531d773619d4b07bbb67b81206ea5b041c46704a208ebaa4e508e5e57aee3c44e9d7bc864db2379b55faa4bb57705cb503bff1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_0
Filesize3KB
MD573101787ed6c706a34f1225820a90cfb
SHA164ddf3d566fb771dd4bb1839fa703a52240ba977
SHA256082fc10440725ca7c9e181b5cf2845e9b438c6c2d9cc8ef3abfa69593f213d59
SHA5124e3ba85123ecbc7a68ac7edbffb82db31e4b6b403bcd78cb7ee36ce2475d07fdaa9c14680490484b66e1276d09c8ca1b39a0748c6814bd3354c4775f49c7470b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_1
Filesize9KB
MD55eeb33e5a457f09bd0a0373b90415741
SHA1c2eb99559baf56ae53a9e94ff8cc553ee479d00c
SHA256719247c0f89def745dd076c25b5517af938bac2830c92cf9fa79b1a99805686f
SHA5129cce7399a5adda8888cfc92d775de7079ac23a9f0d128da4b5afe14c55ed89d64b0572441e2d8386610bff529757d5fe2693f9cc51196f8a547e9e40a38ec005
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize192B
MD5f10a89d8168c592cfcb22ce404956188
SHA19448e2a998c7e6c0c70277cca73d43bb076bef7b
SHA25607bb065a7f1ea481ac9b4c9ecf9cf688b20ffb8f268768f2e124a13829dd16eb
SHA512e0c5c99e5d49db559a296c4567183b4503594c6b3b552fedff109499c7a8ce51edc87a5b6a871d443f9cc491332a2c9bd65e66bcba6a9506d17cb1f092738868
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5dafbb.TMP
Filesize48B
MD551b33afc93a0b787bcf29fdc6344b128
SHA1eedfa5a96aeabe9895541ffc695822d06b39fb67
SHA256fe730e072f7dff37e6895dc3888ee921a4e99f7c9ef7417f408fc51ef1377970
SHA51279476a39cebaaf2d29c73d5f39428cbf42e80625a427fbb118a131a4e94cd64800a46fca849140830fa27f22dd19ad7c5158cf1c09ec57006bdc3e5fd52af772
-
Filesize
1KB
MD56e241ca164bd2cbc4833a32827e4aac5
SHA146850a7cf59f8a28341a8adb8f44f2891b94cb15
SHA25609f4fb0413e123c22654854504ca81caeb9593cd9c497a50d81caa75ab5ba48e
SHA5122e2aa38ba31b8b1d2b7b115db50195d2c4d899947a31df417450650f687e9b9ba3f56dfabd7ce02d516ffc171925a38091f03cc0d4f772b98d6c191c82ef0972
-
Filesize
3KB
MD5756d8298cfa600a5803d53f9ac123cad
SHA1ceffb96bbd815a7c834591460242216f0a668b74
SHA2565b37fc5d4034bc7a042d42878be00649e174f88ebe81ef0f70caaafbf4df1274
SHA5120370930fc374b27152a4cf46afa6a263442096e1b4cc6937768b360b649bbabb35a16018b2f921b0b06632495b70ae20d7bd5a4e6ee7b52ebc45be6b78d5a165
-
Filesize
4KB
MD599f407e9814864f8352d4c085b2eaf26
SHA16123ea03dd25f07f4c48774f9d80a4cd7fc625a4
SHA256be51b7ec7fcc594b0bd8651cc965305c0670e8c10ee226e4873bd6fca9a3d830
SHA512f025a5ed2dad57774fd2d3298b20f49963ec964dbecb2a5d04bc8bed3066a61c5a99d870f7425d5d884e90d68785bd46f6f15c039fa283f28897e5aab699fe63
-
Filesize
4KB
MD54b85c3d9d46dd14719053e6db62f63e3
SHA149b3985f48d2abb3fff9f69293b2b09c8acff2a5
SHA256c5fa53f62914f71b04abaf12b3d0cefc90860e850f18b71a519c2aac0f1563af
SHA512c1cf5ead1dac2886649f5ff63b37b2b978029fceef5b57e58c7709c2ab6c14806e0a91c015c86d98bd0cba119cdc1a7cd3aeecbecbc74e0cd36882abd54f353b
-
Filesize
6KB
MD575649611ffc8d9d8842398f7056c25ba
SHA148eb7317eca3ee3238fe0c0672a0ed1258cf2eed
SHA256bd9295fac0c477f5a0105b51d1e7a52ba2617a87bc1dd0cb8f45f03e81a001d3
SHA5121efaf9d9449618be1746f8442280ec5e2d7d7abc755be950a9595ba45df94476312304483e1f34febac375cc3b0deb4568c962ffedf9025c156b8b7f205f6918
-
Filesize
9KB
MD5c8796da9cc62e428c66c212769b9f68c
SHA1908937c6fabe15125b1f7dec1ae1bb9d395b47a6
SHA25641fdb39c27b4797b6f9ebbf6ada3382ab42bb7aa11150f74acb64b9c8b326465
SHA5127de1b547ff221a50551d93597633143fb23c7ba862259050e92373225fcdb976d628edbf09ead28f75d010f1581b1691d9d2d6ae6caebec3cfa91b3e9387250f
-
Filesize
7KB
MD5105249a65fcb7adddd092c7f97fa9028
SHA1c98aa8ae7642c83bbc964f559208ccce6b0dcebb
SHA2561144d5590effff12dc53092a527ccd59736e3fd75b703176408c744fd676c9c1
SHA51275f343c811d637d1930a4eeb6ab9a68b7e43926e6dc2608f9a82777217e5b0533ca7ca3d7d6782c626eaff750f53d0d9b0f62afb293bfbf62a7cb5c924a2621b
-
Filesize
5KB
MD581465d92d5f40f6520d08f43ebb9fd3c
SHA1a638dc6654c369cd5c76607c7661dcb2a72161a5
SHA25611fbb776229e9fe75082e30fdcbdad7c0321bc7d47b8289c7f8bdb4beb54500a
SHA512cee78f0c40cf7c9b7df56f83443592d7923f03621125ea46e7646e5aa5f6d29f8457bd7c628238afedb4ae9ada77367630f80b433c87636d3263a851369858c3
-
Filesize
5KB
MD5ac047637d42dc4b1efb7d8186665671f
SHA18f50e2ded5fd9b4b5b0b1c68df64bd59e7b2ba86
SHA256000484c462bc940be7e00af14ac17600a7d6efe7a991b32ce25cf910b6f4d865
SHA5129a6129f2a0aefab8d0d49ae44b9f6a413e989f0e45fdb3cba73c81eecdf3de607639a44f078396d6b917aded6fd79257fa0d924d1ab58191889136bb503642f4
-
Filesize
6KB
MD5d0703d21d70c15f8168e8b470e0ba5bf
SHA143b5182348d33fd88c82b9b97e1df8971c54a52d
SHA25697a5331d00b864b2bb92be39cdec539a7e679a1086cd1182360d77749150e634
SHA5127da83b4b8ae71773142f5cf97809f3f7295876e41afb177f0316c3efdfad8f4655bf13fb361350223c9c45068657761b4192b63da312004b4cf90a71d99b48a7
-
Filesize
8KB
MD5c5dcd28084804be487767d18543afa77
SHA107158a3349deac87860d02efcdb18a3c5c2c523f
SHA256cc32c3efcaa86f06c76df6b7b22ee30b1b3f776b1cfeee155eb324326729923e
SHA51202c86ba4a60d1cd5dfd948450550c7ae6de09e96f9fc8dcf44a21966c6eaaec836408aae891b51cd9f834589169e378f1ed8393c1d4c502ff731a5c7b51f0a31
-
Filesize
9KB
MD501cc9af25dcc894fc5a016fc4aade1a5
SHA1455367c1c5b4df9d65e0aec45ff33c83d865ddae
SHA2569cfc8878450826657e9697ce94a0418251b83f59997176a812a06c7569e25e7d
SHA512d8c04f5b81467e7856a28c3c241b4042bf239e0b864faa9bcaf9d7ef0fab5f0d755abcc2b937b13f3ca610abe087a7d1b015ab5c6e55105934f10fa741c58825
-
Filesize
9KB
MD5308c625c43327278046ae9ac5823b578
SHA1a019939a7204c06e633bcb3158e3f0d9e2eaeb1c
SHA2560ae58da7de68982b61f702db6c83e51b1ab160d3d3f2887d66f46fcbef872e60
SHA51263a4675ea85ad9d9d6199dcc4cc1b173eb8c04dc49ac044a5b1699864bdf542dc99e2c905f98a21bf22aac2222914dec83523270f20d32df18a9e2457d9d2f18
-
Filesize
5KB
MD5ebc7c9e640bb18882a58158f6edb6414
SHA1ed098def8089299dd0df81a7d33dfa35455f0cfe
SHA2568b90509ab9a38ed4d7e97692dc09ee94c9f33873cd4c55bc61483fa9ef79357b
SHA512ce1e639a36eef5aac8aa9f69e4fe2e7ae06d87a15ed132707aac8a061ae864965d2c999c6bac4118c2034dd0f0360e61b7f7f97cdde17f3fcd57fb2d1d7c25cb
-
Filesize
6KB
MD5ac8ef30408e001414083e33fb7ea7035
SHA1d99991a3f6b33f612b727127d21d5583c38ba8e1
SHA2561d29c0544bf1378d5ce285f480a3abbe108da7cd0c3b77d472c881b401a7169d
SHA5123c06312cc9de2c5dec60b449ab1c9c464b4e4f0690658aec1526c3b31f746f9821f488ac5fef9149acf699decef0ef304105f330287ea93d0b49d801353a5758
-
Filesize
6KB
MD510c31a91f4bbf579f68024ccb0675e86
SHA1d89be0948afbc4fd8c27e6cc7743844191cc3b30
SHA2568bd5d27e0e227620b591531fad972e22915af925cfdf97e4457ee328d92e2d0c
SHA512846bef67b2a2aee18019ccad137e8c5d2bd3515556a1cf36c045df88f795b5de56315781d6ec294a3fe62ead9377abfe801a7b967622f27dfaffe7dcbc0c363c
-
Filesize
6KB
MD5f9ef4c2bbda22a829d0697c49c97fe7c
SHA14ba8842cdaa51f1b58ed9b268c1901c96ae109bc
SHA25614fcff7349d6bbbffe28e29cf494a892397b1a8589aeef043b9a6df59e8cfc2b
SHA51231da7a44bea8cf8fa2ed3bd053e6ef8c3addff6d72577baa410d95d5b1233a57c8c6f39afc2dbb02f96701365d22789dda5ab82921b28a5b8f71dc49b2322a5e
-
Filesize
538B
MD5614636d7e21e3521942efda88736c2ca
SHA1ca6128911e5c00b309c4f2c77584b40646a67bcf
SHA2564b664d7fa4c3ffdf78761793d815c68d919562a41749d401f6cce579fec33971
SHA512eca38322f7a1829acf8c08c838abd0df257d54e5faf64b2ae8673abd4edb304b57fbe2ffb06c4715d128632d01b2a3e46d050f7aacc45793d36732746f1ae260
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5da4e7ebf5fa21559f6d451efef08d80d
SHA1745c7b5197c587b4e649ad25a9aab2c9b0f150f7
SHA256f526c877861a035ecdc95ba19bd117a996b81aab75f74b2dd092a199ad9dfaf1
SHA51230019b4e80e1ad7738bc45ab60b6aeb61fe0d60481fb6f440b5bec2644b7308d1741b71d483c8c8adc1ebe3b8cb60fa8cb0fc0881658fd48fd732f0bc625527d
-
Filesize
12KB
MD59051d5a9d18cff94c801bcb943510336
SHA1a2aba8b7d4dba07f81df5f9a46c2a68da40d3207
SHA25620760d9a01637f445227530d931e080afac4a628d8b642585f9338612cf2ad76
SHA5121dbcf9d2c8f17bbd5f25918349bb2f31432d1e96e1c7f02674e496f74238003d1f38989e33709cb1cc287e6a23bad762dced063015854bb12f9f1e4b604ff192
-
Filesize
12KB
MD578ab530edf81a971bcba9a2d734b5bc7
SHA1851df158ae6f9ed7a0f960d2fd845e2a4ef980b2
SHA256d6ec94718949eb82c153f371f063f42f0174a1128d55af02e068a7c389415f03
SHA5126271f95273952120cd5df391ecafee953ce34fdbf22a1ca46f7973985348317c15e2d8a4c01500dd9bd414eb454b6eb0a258a3fbd6f69c1494de01378aeed89c
-
Filesize
12KB
MD5d6a710da3e33b3f01b249761dc8adf85
SHA1bec7fd81cdc4d981aec8a64325081dc911077e0c
SHA256df8e6e88fad92124c8816d2d3b86dcc3462fbb84c8abce50d039e1397bea49b6
SHA512cf54d31df31e44ed4938c4980266712f04e32a0a51fcff09f6560a96c4418b84ab4dd43ae2c2c8f114703609e8e44b38f1ac8eaf7f0c4490f06f12b1579d4460
-
Filesize
12KB
MD5e677a8ebe2e6711c75edef5fc00ef04c
SHA1de65960d3799e07cb657399c644656f2503298c8
SHA256a4f5b5de438ee715f4b2b9497508c7e288f2f6ee52ac24be1178a0b4487b0845
SHA5129d608168a2ee1aa300fa399ea4b4104759075001252f2c79acc2ae3c374e6939e031927ec3b2530ca4045f7b16cf404682f6d4bc9b020551efb377fc271c7d97
-
Filesize
12KB
MD5199c76dc32eea0ebcffa2f4c3c39db32
SHA1a7ae8eb41071ebf080a58db940974a734e5c0a04
SHA2561c4c09d215a96aee31e706580626deda0bc8a9c645c5842d3bb84709f9df0039
SHA512e6ecc3cadf936c1bf2cc3ae4103cd85b8abc2005c34d6f47532678a805bfd34d196e890041c43a0bed7f228fa6417ba81dc5893f714c78976979a6b02aa04000
-
Filesize
12KB
MD5f17d47e55f4c47dfd1248b87e1e8aee7
SHA1ddb62ff19025567da18a6969ffb80168eecb31b3
SHA25692dcfcfc489af69472a61600641a23342a911103011a102080c7d0999e0c7df1
SHA512c7b18a84bf27e2b78cb01e882b9252c1ea395d4f0c0bb8129ee4e71131f6cce5139bdc5a76a108f1c6c136c72acc2b98a4f207592be29a3505a3dbfeef70956c
-
Filesize
10KB
MD547e464ebcd1876de1faa9a3f4d51e09d
SHA1b645e3b3e8d1fd1b81c2b335a7c52392a3d4f377
SHA25668eb4c428d2c21ee43abc524363a650ec129b72af0b9391aba1d5c2e59ce9989
SHA5129d9b9522815727736b175e62b7e58eb982b3a47f875175f3193b2ce56ba84a2a196e89f048255bf47410e840efbe5e7d7783f00ea3aa8843aed7055ae9b2809b
-
Filesize
1.4MB
MD5a1feb9078242d7f3d243ba9dfdd93fc3
SHA1118de60c5f317c060175584e49126a75b185f955
SHA2566ab81f7424449fa1ea00a7f49d849b330e6a3a8da6aae05d4e59b3ae521e7c42
SHA51278e0a6f734b0ac2f00597f470325c73ec5902c1576921d07373924ae572cb5a0e1791fdbf92ee96942a4de9f98253a20f4956d7a5def5b6d777a9334f26dacd0
-
Filesize
832KB
MD5b79c6f1642c518e1583ee017601b5206
SHA15cbe487b5c5b4ef757f5e0de598e1a0655d2524e
SHA256c2956200abb105308c1e5c3636d7dfb7e86d5a464ad6e2a2f3b93a6cb3316946
SHA512ad12ca04ee5ebc97622980c6f5421506417628a02e323a17ea1971ca02df6f7a2f8bfa40253e8a4d3c591b06cb615ffd06a46eaca3610d60e5436aa7f9b9b5a2
-
Filesize
4.9MB
MD5dcab47cc3565bf15611cfe9c84fff60a
SHA1905c216e725edb5db3ef9ccf8b1c3bea95619764
SHA256f5eef60d9e42e6fc66d625e347ed5cbf19205a0bcbf3a762477a832e55b7c354
SHA512bffabb4975971bcee0e215088963c367ed4ec2dcc6d487ddbfba53dc221641ae58320d56230847d48f4a7584ab6f9400d76f4b1f9a4581c4fb35be96335ef68c
-
Filesize
2.0MB
MD517deae8d009b99e1a77cd03fe4c10da8
SHA1b1661ad568a060da169b9991ab6010e9552a01f9
SHA256c0b8d58f116ef4cd493f71f1615411fa813fb10525576b8eb907e301f5543a4e
SHA512ca8da377ac718e2b1f7e31875264edd0680909940d0dc5af59f44b940d62ed0c919230da0219838ad61ea4693f71b028b8ca585c5ee648d77309c40c47145e44
-
Filesize
1.0MB
MD58f9f28183fdf3b9ea7234abc60c5a68f
SHA1bc670cd5771a228f443ce47e3c4ab554f745b4c3
SHA256e0a60ccbf8005a19db99c07bbb5a6e0b4c6921635fd9b5f7cca49d8003ea9a43
SHA5129e1809ecf28a5d12acd4adc266e6398c36dcdab17d8e37f654fe9f546c6e6c5f6e4d8ec4b7ebc9bbd2484eeb95332c38ea1f1c4d7b08ebf6a223022d344fcb77
-
Filesize
1.8MB
MD5a777cb84d42d9d4748736e7671ef59f3
SHA17c2d8d97eec499b5df631694dcbd66cb8d5f6453
SHA256e64e0802eacbc4534594197766863b911c45fb4e57b3a783c79fda9c5f30f37e
SHA512dc520970f4d1e7c919aa00f064d40f8f5fe958e4d9f1ab48dc3d8a9ba9e72f7dab13bbc3f4bdf16bcc21901d5a50db9be58db5c760948e88edb4f77ff850e4fa
-
Filesize
54KB
MD50d697e383b08e036e98f2f11ac1d1033
SHA1633f6ad7296c677a82ad16246abcd1e145065f30
SHA2561b5740a3b41852769d7595bc126c366a3ddcc5c2d1a8b849c85f25c24cc946cf
SHA51295e933e9dffd65e2c0415bd1e9f08ae4d7d79781d1d61ecd62922216f8c560657ac1a66b162146d7079ecb453390f8a50c6b72aff95a58f39469932d5adbbb31
-
Filesize
1.4MB
MD53f987d0b1d5ed0916e296ea15c8d9784
SHA185321531db1b09717bf3628f8e7fc3ac76433c79
SHA256a8285c2d4a94fd5b13e3530556645df92ab166e72cdda1f5d84535e83aa08c2c
SHA5121d36f2cc83da4981af626b17ab88e927a6c523e3dbb2c684f459018c41b80f4de0e5d8556dedd555f85bab8712f74208ad276c3697013c589f4c8201df986fcb
-
Filesize
10KB
MD502ca12792c4369eaf62caccaa9519c36
SHA1b1f4f26a56d08850489f6bd84bd6cd27147f7400
SHA256133c9a4f6007cac74ff51e9464cc10955a947b1a5cd787a02fe322c94c5fa1b7
SHA512a8a8428e37d1dc20cb1210135624cf264034cfc3665270e3fb462f934b96c23a9d67770c230db44ffbe2a6e7f8ad7ebe0a0fb63d0a87cf22a03b724208777753
-
Filesize
3.9MB
MD5ed6de2dde0ff0bb42885c5aad4a2bce5
SHA125cc62ff323c04404b1c980ff49d1d50e0eb3398
SHA2565042cbc94c7999438bbe44744db1ce48cf0341399637e30b51bf4ba3eb45cf3a
SHA51219dc5f7b0da815a3e3029b23384a2d8e38ae836d72997ffc711be4b0e9ac2a758e0d206bd83c453a42870c8a9ccbb8f3208e4a05be0815981db39d05206d3a73
-
Filesize
3.5MB
MD5a1e9dbba7735ea23b21c83da995c36b3
SHA1e98ee1b70d193d30995200442481e29e515fa585
SHA256fd5580bcd413b8d465492b8da9ce42fda4eabf575d1f0ca2da19b9ec17cd51e0
SHA512090ba3e07c6150418c238796b58206fde55179e5b4bac87f9bb760ba969f68c34727ec771901813b49c3f6ebb1b9e988cf28aedf545a437d92225561b3deaaab
-
Filesize
1.9MB
MD5d5cef51f625a67978890abc2e50247c9
SHA14e6419b9b71f9075a8562b685a6031e3146deb98
SHA2567dccfd96b16bc5ff172087487a8c724ef597b812a22b94651179f988c40bdb50
SHA5122af1297665deba7024f1b52cee81dc35126ec2639157915d27202a5918448cba2b0989985dae312902da7ebdb5746ea87688752ef2e742a6cf0617f58ad37efb
-
Filesize
474KB
MD5e65c032e538ca1d85b8b9e0ff6548e69
SHA119e057f6f1f9e16189f5fe0e492042cc3e4784da
SHA256e8dc283aa5dc0c5446fe132f3427395b7dae5c14896a8896eee7489e8bbf768a
SHA512ed07ef30e14292aab809c0a88cab5db7d825cc183b421afeb7b9f5f27e227be27f4a9bf3ec9cb2c2c6ae784f692e88fb8852ca2b3c98c7f7e276b80a29e85634
-
C:\Users\Admin\AppData\Local\Temp\Barracuda X_FirmwareUpdater_v2.4.0_r4\YST USB Image HID Downloader.exe
Filesize2.9MB
MD5cfec97966aabd572a7c89affeab7748c
SHA103726647196001feb0fc7f74a914fc9514c1d196
SHA2568204b00c487eed2b30229f160aec2a117528e86f3d0d506e0be8327328cde8e7
SHA51212447553d25e21df3d7f2fb288f365c50c0f83aa5936f28d976052a551ef18ed98d4bd6fe48754b5c6f41a26158401781ff2303f57258392a9a5264e7f9d6184
-
C:\Users\Admin\AppData\Local\Temp\Barracuda X_FirmwareUpdater_v2.4.0_r4\de-DE\BarracudaXCustomerFWU.resources.dll
Filesize8KB
MD5db8aa14d93a04ba951489adc740a3559
SHA1a60d8524a2b6c6a3019606473207d842bfd81abc
SHA256e8f1c0244d4ee91ea208b59cbf7929f9146bdbd79a4e6c6eb2478b8f0961b15f
SHA512bc11e5fd050808b24a4b144e7ff8b7395ea0a578cbf6a9c14ba3024b08f55cef7abfe3f7f276ba811750ecb2c1f07e633a4fc8ff8131d023f8c19f002212d666
-
C:\Users\Admin\AppData\Local\Temp\Barracuda X_FirmwareUpdater_v2.4.0_r4\es-ES\BarracudaXCustomerFWU.resources.dll
Filesize8KB
MD5c85b565d7411db72fb1fb9837a6386b7
SHA1af8dbf971b0278c271f80c8703988aae51513e63
SHA25690e1326bd6b98a6cad451c0691d11941015db89dfc017c458690abe7b578aa2b
SHA512a75c1ec5ec1e7f16446ec4fbd087710b190065564571b042e53419143780a74998612967ccfe5963fd86195acb6fe1335e5d780a0899e4cb4fb923dd4e27ccc7
-
C:\Users\Admin\AppData\Local\Temp\Barracuda X_FirmwareUpdater_v2.4.0_r4\fr-FR\BarracudaXCustomerFWU.resources.dll
Filesize8KB
MD518d23b11f79fca71314711100b001c2c
SHA1545ef955e2facfb03bcb78235a26577693b3cc47
SHA2569594b770786d96ced6b1210a6d4d1a8782a8788c258b2512a2555b87f0549b62
SHA512e3972d61702fc0503ab89b92369f3620fedb9778a0596d274450c5c9fecc56fbe0dd02f5528d7cd344a036ef464fa6e52c53a1b0b182a1caa084c5f757b0d0b9
-
C:\Users\Admin\AppData\Local\Temp\Barracuda X_FirmwareUpdater_v2.4.0_r4\ja-JP\BarracudaXCustomerFWU.resources.dll
Filesize9KB
MD5624702e363b91adfe73da330c4722ed9
SHA180751e5e97751f66662ac065988257ea6d299c54
SHA2565f9b73bfa284baa4d6dfac6139a7a031e59849a13c892693df307216dc83674a
SHA51220dc626461e245418b934272cbb754131dd39ec1d8f64100ac84becab4cea7bd29fa4451b64bb2f6f9d441ef6bf0a52555eb9e36132a109322a6b099a6021443
-
C:\Users\Admin\AppData\Local\Temp\Barracuda X_FirmwareUpdater_v2.4.0_r4\ko-KR\BarracudaXCustomerFWU.resources.dll
Filesize8KB
MD5924f9720f57722adb1c2e8ae95f850e2
SHA1898a7bf7620c26ea6cbe0febbd71508b31298c57
SHA2565be5a228c06177c1604756eec13354a401ba2d9077d23c72e0df7aa72ee64ace
SHA512baba12c0fda29d428c666d3183b8ec1b9394e5223ed0a820af3cd8b8894f08af4d26c5f2f393b1c1b17f70b864cd86bcc8a0565af0cde7773455e770415aa773
-
Filesize
8KB
MD5ebe5658e21cf00e6d99ff2d9ae7d6279
SHA195f510fff6553d44b784025c80a5089c043b678b
SHA2564f14b49343648534c291c9c316a2ba8602710c6820b5058ab1cbe145b90d6826
SHA51209065ab444b51fd6912fa5136d9039b179dc618d89a4d1f2bc8b3d997497d5db0b848ba70cd57b3d7d7bd18c28bf880c2823da9181e3248ae051d74f013cbdbd
-
C:\Users\Admin\AppData\Local\Temp\Barracuda X_FirmwareUpdater_v2.4.0_r4\pt-BR\BarracudaXCustomerFWU.resources.dll
Filesize8KB
MD544a1d8a1f10cc64406cd3d8f9dec0899
SHA16e912d7cc18384e39fce81e66baec475f17b77b0
SHA256d7855b0e12463aaf43501a91f8016d600ba976de903f902124a256e89217fa78
SHA512ccb12462c0820bd959f8ab70296bf0e27315c291a55e091db1b05887c224546cd849f6065917ee1e6d6ac9fcc84ada4094c7366cf150d5defdf3ed16ec861b46
-
C:\Users\Admin\AppData\Local\Temp\Barracuda X_FirmwareUpdater_v2.4.0_r4\ru-RU\BarracudaXCustomerFWU.resources.dll
Filesize9KB
MD5514184c52336b441da1f6174ad038f6d
SHA170746b9dca9973eb31c1cb62280080156dd85168
SHA25650b2105cbeb1c44ecc38d74ee00b431eca0d3f612e46a22a8771051d33b060b1
SHA51206eb4118da8dbaeb1b44ab69c8f8f0e8358322937e2dbc6d24823789defc310eb0935948d32aa5039d98ecf39d69f535b41a1ca58d254788c17e7a069f2bd430
-
C:\Users\Admin\AppData\Local\Temp\Barracuda X_FirmwareUpdater_v2.4.0_r4\zh-CHT\BarracudaXCustomerFWU.resources.dll
Filesize7KB
MD54532c8bfd9a85af594470c9b7a2afe39
SHA15ac9fdc5754e3c641d2f663f5fc404c77453067d
SHA2569b44ac1f890cf5f418ad479ca7ea4ca78351bf3670f3c273dac5f24634beb82b
SHA512b54c689e6eb1fdda8858cf964169f2dac3d8ec89f14b8dbaa2fe993a1ba5e494a3a892f1a9d7ca934e6cb3073f1078aabda27799eb60169fa291fdced06d8971
-
C:\Users\Admin\AppData\Local\Temp\Barracuda X_FirmwareUpdater_v2.4.0_r4\zh-CN\BarracudaXCustomerFWU.resources.dll
Filesize7KB
MD52b63b9a931fb0e1ab4213bd135a499b6
SHA1dd108b4fb4e8077402d69b04a16c02cd4e45e4f6
SHA25654e50767e1acee37122bb0558294fd82f17b7b72e8d54fcde6f755709a2dcfce
SHA5127001084daa5a982603425c25919b91921464125e9445677c549b38267b22a3617acb3cdcb5a9ddf8a87b31555d5e2ab07f56f90cf7e8736b56c429d225e9ae15
-
Filesize
202B
MD54566d1d70073cd75fe35acb78ff9d082
SHA1f602ecc057a3c19aa07671b34b4fdd662aa033cc
SHA256fe33f57205e2ebb981c4744d5a4ddc231f587a9a0589e6565c52e1051eadb0c0
SHA512b9584ebfdd25cc588162dd6525a399c72ac03bf0c61709b96a19feba7217d840ae2c60d7b0d3b43307a2776f497a388e79ef8a646c12ae59a7f5cc4789bbf3c8
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize11KB
MD5b1a70afc0767e7a574c280299ed6ecb6
SHA101a0c51454c541c8450f28018df01b8084275474
SHA25644c9ac9ce432ec4ed09c902ab6e9d2df1b0b021f21d6caeab2030ab9e5a1e453
SHA51252ce3771a32a50f494f1d0db567f541b94bfefd26afd1edc0925ee7f7fcf3e32bb296bd0beafe3eebbea6ce7b4cd75eec999762eae0201def7448fe7efadb402
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize10KB
MD54f147ddfc6b564f705a6c5f797e64a7d
SHA19ebed87bcd0a5371284092f063c7ffe0724fd97c
SHA25678d8751360153daedfbb98ea3a7312585823d8dde6edd981fb9b929c9f7c06ef
SHA5126622e02a1009b00d691f282a814fe5d1fd645d2ae3b5d52a352068077734ce33d5dfcace16d3e5cfd4e3c7e6c151234fd75c3951877bf3172744ffa97a306ab1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize10KB
MD567457a3581b23e771bbecc096d41ce4d
SHA123a4e6e98d9331fd9d86db8699a47f497dc06798
SHA2567b677fdefd36ebda8a8141747feeeded4b0d468ab079d8ea8397ae01def75d8f
SHA512b6ed00451b3f82478f21987602d4e8e61d3058a22f41371c1020e04e8fa78da56e88a0ea1c1ab869d6a4e05167f78a3bb81f375b6cf71b3f0f481a66c5c7d0c7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize10KB
MD5ce87bfc8c80b24b4d58c2154fb8d0f3d
SHA1d41217ccdb1941a3e8a02df2865d3e69543076f7
SHA2561c709062ac822f78c6756163c7964b1a2ceaa33c39ffde98a2932a3be1f93eb2
SHA51213b1b5f9e6991b18cdf36e3d0ec8014302d1d403904a8fd7c212d1656d71359fefcedbb8bb0bc76b08d785c27fe7b7bf1ae2396e6b03d695f1375789e6a0320d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize10KB
MD5f64504d35774f5aab9af6064ec532bf3
SHA1086c5ba4637f741419c9fbd37d029ce3bd6acdbb
SHA256d723514ed2db79d202823aa41adc8f36d5201bdf977795586f1236e4900b2d0e
SHA512ea014e2a2ff899964f24faf87573095d6e72f248aa3f48d8054ca557c6f1f291e1168cc4cc65ea056282f0984f479d2920799d729e28da090bdac558db43fb73
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize10KB
MD5e7ee9cb4f474a79311c505fc06a7739e
SHA17189687b777f3833d798a6eeda931b418e0cdda0
SHA2561119f6999e6fabd52f5792aac7fcb4595499373a0312b7666a12ff64cf75949b
SHA5128655588c155571dac01b908c18d888f9f9729b01800ec54eb62e2f1885b10080a5d46e65643172ceee4af40ec23d3a1ebd3d866aac97c62fecceb26046f8b49a
-
Filesize
1.3MB
MD55fcf6f00d1c1a46fee4e9938842d0dc7
SHA18727f63c5d333fc8c79ffab7c341873954a3e780
SHA25601645fb2552024f36f29e141660b43ba26c3f3226cc90fc068eddd301513cb45
SHA5125e65c4ae095ad8c75b3174876f5d5d0349afe1b8196f913e48fe01b195978a5b127eaf3f9e6bd87ff4826e10d3f36d6841b0dc6978b4700042cd3d20d70d1cee
-
Filesize
1.6MB
MD54a195a5cc7b0e75d21c53fecc7235324
SHA1aa01e19303840d20f5335da21b2e8bded9501f97
SHA256fa037b48204cdf66f66064a838494856f5952acd5c234602863fdbcb348ed3ad
SHA51284e3d76f4bd172f637c93042e5bf08fe68925c1e5f84080dee7426a4071d7b8841f5114d7a32cc31335a8400618ff80b23e1bfef7f4edcacb7c0e18391879859
-
Filesize
256KB
MD5c9c958d4747ad19f6979cb57a7043309
SHA1c1446a18f573970784a70c29fad9e4ae1c533250
SHA2566632f5b1c3af2056e448b654b3dc24516ab6a16f3144b6b9ebd3c46775924a4c
SHA512bda95d72845cb706bcf06285e7b42c4c989c189fe77e34362ee91d5c7b62b0c1799c3bbdb896f886ac42b859226a97b08299d039b1393e1682fef9bc664d841e
-
Filesize
2.1MB
MD5c4796bd483ee9786d1b72581747754c1
SHA187c4b1e6ef4443a96ebbc98d80414090685c2fef
SHA2564cb7766e88ce3f10423ad20bd048231ed3367696756fb9ed3db90bb55f457764
SHA512c00fb7d17a3f0faed6cfe7f35be08f68d69aeb9787ea38314682d953411540c1e5b801153c104d277c54dc8e13e7b4515090afcefd7385855b41de3f5d947a67
-
Filesize
7B
MD54047530ecbc0170039e76fe1657bdb01
SHA132db7d5e662ebccdd1d71de285f907e3a1c68ac5
SHA25682254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750
SHA5128f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e
-
Filesize
5.0MB
MD509cd66349c2e7d3a414801fbb4606d60
SHA1cf186dd4b1e6057be605785f1eba484598735097
SHA2568bb9ef7b7e208505c1865685ceb7fa7682b028ec32e08af0f7a4c153ef10b17d
SHA512df76cba932e7ece593e4e3bcd2ceb004749b697094fce4c114bec8a26678a240fe26030cedf367b29f290fc2b73ef21fa03d570cb19b39846892e1c995045d74
-
Filesize
18.4MB
MD5a98728fa8d4c674d9bb6773f10ed3ed4
SHA19810c2f6685104187a12f2a01222c4d4ce1f1e65
SHA256fda0aae85da77fd658cc11746d80a5197b64286c30bcadd4bfc896640cd0ccfc
SHA512bb2487f9751f9c7658c6d246fe427f9828518bafd1f3ad1d1b74276ebf4795c2d6a8d45cccd5061710a207b3f45d36b32739e0a50880f636bbd5d20792442148