Analysis Overview
Threat Level: Likely malicious
The file https://filedm.com/0QYhN was found to be: Likely malicious.
Malicious Activity Summary
Downloads MZ/PE file
Executes dropped EXE
Loads dropped DLL
Checks installed software on the system
Checks for any installed AV software in registry
Enumerates physical storage devices
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of SendNotifyMessage
Suspicious use of AdjustPrivilegeToken
Delays execution with timeout.exe
Enumerates system info in registry
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Opens file in notepad (likely ransom note)
Enumerates processes with tasklist
NTFS ADS
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-02-22 17:33
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-02-22 17:33
Reported
2024-02-22 17:45
Platform
win11-20240221-en
Max time kernel
673s
Max time network
681s
Command Line
Signatures
Downloads MZ/PE file
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Downloads\Vega X Windows_62325287.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\setup62325287.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\setup62325287.exe | N/A |
Loads dropped DLL
Checks for any installed AV software in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version | C:\Users\Admin\AppData\Local\setup62325287.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast | C:\Users\Admin\AppData\Local\setup62325287.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir | C:\Users\Admin\AppData\Local\setup62325287.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\AVG\AV | C:\Users\Admin\AppData\Local\setup62325287.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir | C:\Users\Admin\AppData\Local\setup62325287.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV | C:\Users\Admin\AppData\Local\setup62325287.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version | C:\Users\Admin\AppData\Local\setup62325287.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast | C:\Users\Admin\AppData\Local\setup62325287.exe | N/A |
Checks installed software on the system
Enumerates physical storage devices
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\timeout.exe | N/A |
Enumerates processes with tasklist
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\tasklist.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Local Settings | C:\Users\Admin\Downloads\Vega X Windows_62325287.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-627134735-902745853-4257352768-1000\{5B1B0886-513C-43B9-AD38-3DC4875302EA} | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-627134735-902745853-4257352768-1000_Classes\Opera GXStable | C:\Users\Admin\Downloads\Vega X Windows_62325287.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\Opera GXStable | C:\Users\Admin\Downloads\Vega X Windows_62325287.exe | N/A |
NTFS ADS
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\Downloads\Unconfirmed 746141.crdownload:SmartScreen | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| File opened for modification | C:\Users\Admin\Downloads\Vega X Windows_62325287.exe:Zone.Identifier | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| File opened for modification | C:\Users\Admin\Downloads\Vega X Dev Mode.zip:Zone.Identifier | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Opens file in notepad (likely ransom note)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\NOTEPAD.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\setup62325287.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\tasklist.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Downloads\Vega X Windows_62325287.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\Vega X Windows_62325287.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\Vega X Windows_62325287.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\setup62325287.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://filedm.com/0QYhN
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff866f33cb8,0x7ff866f33cc8,0x7ff866f33cd8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,282104509425801964,16674798173857138423,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,282104509425801964,16674798173857138423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,282104509425801964,16674798173857138423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,282104509425801964,16674798173857138423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,282104509425801964,16674798173857138423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2212 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,282104509425801964,16674798173857138423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,282104509425801964,16674798173857138423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4076 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,282104509425801964,16674798173857138423,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,282104509425801964,16674798173857138423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,282104509425801964,16674798173857138423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,282104509425801964,16674798173857138423,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,282104509425801964,16674798173857138423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,282104509425801964,16674798173857138423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1892,282104509425801964,16674798173857138423,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6128 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,282104509425801964,16674798173857138423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:8
C:\Users\Admin\Downloads\Vega X Windows_62325287.exe
"C:\Users\Admin\Downloads\Vega X Windows_62325287.exe"
C:\Users\Admin\AppData\Local\setup62325287.exe
C:\Users\Admin\AppData\Local\setup62325287.exe hhwnd=197196 hreturntoinstaller hextras=id:ad413892c2b60f5-RO-0QYhN
C:\Users\Admin\AppData\Local\setup62325287.exe
C:\Users\Admin\AppData\Local\setup62325287.exe hready
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""
C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "PID eq 2364" /fo csv
C:\Windows\SysWOW64\find.exe
find /I "2364"
C:\Windows\SysWOW64\timeout.exe
timeout 5
C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\link.txt
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,282104509425801964,16674798173857138423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,282104509425801964,16674798173857138423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,282104509425801964,16674798173857138423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,282104509425801964,16674798173857138423,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6768 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,282104509425801964,16674798173857138423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,282104509425801964,16674798173857138423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,282104509425801964,16674798173857138423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3588 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,282104509425801964,16674798173857138423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,282104509425801964,16674798173857138423,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6548 /prefetch:2
C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Vega X Dev Mode\Vega X Dev Mode\TUTORIAL.txt
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe0,0x10c,0x7ff866f33cb8,0x7ff866f33cc8,0x7ff866f33cd8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,8192485059093428540,11589712916656404379,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1868,8192485059093428540,11589712916656404379,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1868,8192485059093428540,11589712916656404379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,8192485059093428540,11589712916656404379,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,8192485059093428540,11589712916656404379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,8192485059093428540,11589712916656404379,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,8192485059093428540,11589712916656404379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1868,8192485059093428540,11589712916656404379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3472 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,8192485059093428540,11589712916656404379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3420 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,8192485059093428540,11589712916656404379,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,8192485059093428540,11589712916656404379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4276 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,8192485059093428540,11589712916656404379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,8192485059093428540,11589712916656404379,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2752 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,8192485059093428540,11589712916656404379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,8192485059093428540,11589712916656404379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,8192485059093428540,11589712916656404379,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,8192485059093428540,11589712916656404379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1040 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,8192485059093428540,11589712916656404379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,8192485059093428540,11589712916656404379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1040 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,8192485059093428540,11589712916656404379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1868,8192485059093428540,11589712916656404379,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6024 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1868,8192485059093428540,11589712916656404379,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3728 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,8192485059093428540,11589712916656404379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.177.190.20.in-addr.arpa | udp |
| US | 188.114.96.2:443 | filedm.com | tcp |
| GB | 96.17.179.184:80 | apps.identrust.com | tcp |
| US | 216.239.34.36:443 | region1.google-analytics.com | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 104.21.65.91:443 | getfilenow.com | tcp |
| US | 104.21.65.91:443 | getfilenow.com | tcp |
| US | 216.239.34.36:443 | region1.google-analytics.com | udp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | tcp |
| US | 35.190.80.1:443 | a.nel.cloudflare.com | udp |
| US | 35.190.60.70:443 | www.dlsft.com | tcp |
| US | 35.190.60.70:443 | www.dlsft.com | tcp |
| US | 35.190.60.70:443 | www.dlsft.com | tcp |
| US | 188.114.96.2:443 | filedm.com | tcp |
| US | 104.17.9.52:443 | flow.lavasoft.com | tcp |
| US | 104.18.67.73:443 | sos.adaware.com | tcp |
| DE | 52.222.191.80:443 | webcf.quickdriverupdater.com | tcp |
| GB | 92.123.128.169:443 | www.bing.com | tcp |
| DE | 167.235.218.62:80 | a.directfiledl.com | tcp |
| DE | 167.235.218.62:80 | a.directfiledl.com | tcp |
| GB | 92.123.128.194:443 | www.bing.com | tcp |
| DE | 167.235.218.62:80 | a.directfiledl.com | tcp |
| DE | 167.235.218.62:80 | a.directfiledl.com | tcp |
| GB | 92.123.128.171:443 | r.bing.com | tcp |
| GB | 92.123.128.171:443 | r.bing.com | tcp |
| GB | 92.123.128.147:443 | th.bing.com | tcp |
| GB | 92.123.128.147:443 | th.bing.com | tcp |
| IE | 40.126.31.67:443 | login.microsoftonline.com | tcp |
| US | 13.107.5.80:443 | services.bingapis.com | tcp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 577e1c0c1d7ab0053d280fcc67377478 |
| SHA1 | 60032085bb950466bba9185ba965e228ec8915e5 |
| SHA256 | 1d2022a0870c1a97ae10e8df444b8ba182536ed838a749ad1e972c0ded85e158 |
| SHA512 | 39d3fd2d96aee014068f3fda389a40e3173c6ce5b200724c433c48ddffe864edfc6207bb0612b8a811ce41746b7771b81bce1b9cb71a28f07a251a607ce51ef5 |
\??\pipe\LOCAL\crashpad_4968_GDRONHZGCOQDJAME
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | d4604cbec2768d84c36d8ab35dfed413 |
| SHA1 | a5b3db6d2a1fa5a8de9999966172239a9b1340c2 |
| SHA256 | 4ea5e5f1ba02111bc2bc9320ae9a1ca7294d6b3afedc128717b4c6c9df70bde2 |
| SHA512 | c8004e23dc8a51948a2a582a8ce6ebe1d2546e4c1c60e40c6583f5de1e29c0df20650d5cb36e5d2db3fa6b29b958acc3afd307c66f48c168e68cbb6bcfc52855 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 37c13ab41f0f9a664df6fbef1db1ab5f |
| SHA1 | 9657b459062c510599c7dd44227d85fdf1bc56a0 |
| SHA256 | 037aef87cd0012a1952fa3e2af078ec2136910a12165b610e10cb1f58e9604a4 |
| SHA512 | 3f527e6450c50f1005626aa4240e0ad9a7de98cff9650893d5c16cc50204ddeecca0e3b2bc4087ff77a807e0b245e9af954230d2d4ac6eb31b1026aafb35bb4f |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 206702161f94c5cd39fadd03f4014d98 |
| SHA1 | bd8bfc144fb5326d21bd1531523d9fb50e1b600a |
| SHA256 | 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167 |
| SHA512 | 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 937edd44e9ded2c0a2705b0d1980ba5a |
| SHA1 | 89b13de0125ec780690c218a82644233adee290b |
| SHA256 | a59223289df9cee5c929dd163f115805fd0ce7706f67d3ca8c6ddcfe94d0833b |
| SHA512 | 7ed4529bf1d915c9e442696caf7215a920034b4921aa24941a5e34bef0e8d0d5462fbdc1e2d51f5a57374bb77d4f4ac9de5e38e7fdd147628a868d373ff691b2 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | e0e06b257ec30f9f70bb5c9d058ece81 |
| SHA1 | 58f91c10e436190462ccb49676c951cc20da2eb4 |
| SHA256 | b5b4622ff1e7ef9fdde43a821ed8f8a052abfd291cfcd1e3c8671e78d10bd622 |
| SHA512 | 9cdbea37ae02b8fdcf4e22746cbbb6dcd54b9ba868994d4e43794d89f58640c0ef4c0193378a3b172b2ca4c295a0a19d2a744027f32c960203de7a758dc8b735 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | f4965de07acaa968eb655e81a2f96f33 |
| SHA1 | 3bdf0e03bc3fd95757523823dae4e5f4fdbae93c |
| SHA256 | d1463e9da20494d33e1434c06812dcc5640ee3ac388660ed670ec308c545a7d5 |
| SHA512 | 65bbb4d57627c521f51abfa8c3ed8a7f19fa422e52afa49d9c1e07c003cb9fcce52e960605e57c9883a290cd185ae5cf001c551ae43fe0885b5f2c825b04a6a7 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 7bfaeaa4cca718c329b55e640668e78e |
| SHA1 | 4ae06a15b192cc34e0933ff914eaadef6598578f |
| SHA256 | b1f591a160fad769e39beab919a8cb58344d4926c86f6f59f009cf5a07332f67 |
| SHA512 | 75603cf31491e149e4a2f253e891563f18bd0974e7532f7bae0fbbf704cfc2df808ed676ba1ea46ab18f3da9437a5295ef5684b30ebed97a95bfe7904ddc15f2 |
C:\Users\Admin\Downloads\Vega X Windows_62325287.exe:Zone.Identifier
| MD5 | fbccf14d504b7b2dbcb5a5bda75bd93b |
| SHA1 | d59fc84cdd5217c6cf74785703655f78da6b582b |
| SHA256 | eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913 |
| SHA512 | aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98 |
C:\Users\Admin\Downloads\Vega X Windows_62325287.exe
| MD5 | 93d16508432c3ff3512eb9de584f48e6 |
| SHA1 | 6ed9fd4d190afc6c5154730d85cf883fd3ad4d2e |
| SHA256 | be5357f63b036da79d198978cbc5b652ea02b1ccfcb1538352442cdc7f4d5549 |
| SHA512 | 08ad71f9b6b3a65cb22b6a65c8e44d4e004de2d10683dd89a8eac5af67127b126db301ca55e00740e7342c2896cf4b7178257e9d4e446a03db13e122c4116338 |
C:\Users\Admin\Downloads\Vega X Windows_62325287.exe
| MD5 | 42a3d243103b7cc54e9a4455f121f092 |
| SHA1 | ce025f3e5846b5422fd08de559fb604a7c0e269e |
| SHA256 | f4f8976ce5e6708a7a89d2704ee99ca3cde47ec8ee8d40343c9b55678deff28e |
| SHA512 | 4c4d7ff63a2cafcc7b909e214878e9d2b0286b173e6f77a1e98bac437f381a2feedc7c438de05b8eba1b11f9ed72f3dc67586218bfe122f74a55ac7068ec16c7 |
C:\Users\Admin\AppData\Local\setup62325287.exe
| MD5 | 29d3a70cec060614e1691e64162a6c1e |
| SHA1 | ce4daf2b1d39a1a881635b393450e435bfb7f7d1 |
| SHA256 | cc70b093a19610e9752794d757aec9ef07ca862ea9267ec6f9cc92b2aa882c72 |
| SHA512 | 69d07437714259536373872e8b086fc4548f586e389f67e50f56d343e980546f92b8a13f28c853fc1daf187261087a9dceb33769ba2031c42382742d86c60e4b |
memory/2364-167-0x0000000000BF0000-0x0000000000FC8000-memory.dmp
memory/2364-168-0x0000000071F80000-0x0000000072731000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\vcruntime140.dll
| MD5 | 1a84957b6e681fca057160cd04e26b27 |
| SHA1 | 8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe |
| SHA256 | 9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5 |
| SHA512 | 5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa |
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\ServiceHide.dll
| MD5 | 72990c7e32ee6c811ea3d2ea64523234 |
| SHA1 | a7fcbf83ec6eefb2235d40f51d0d6172d364b822 |
| SHA256 | e77e0b4f2762f76a3eaaadf5a3138a35ec06ece80edc4b3396de7a601f8da1b3 |
| SHA512 | 2908b8c387d46b6329f027bc1e21a230e5b5c32460f8667db32746bc5f12f86927faa10866961cb2c45f6d594941f6828f9078ae7209a27053f6d11586fd2682 |
memory/2364-169-0x0000000005AA0000-0x0000000005AB0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\msvcp140.dll
| MD5 | 8ff1898897f3f4391803c7253366a87b |
| SHA1 | 9bdbeed8f75a892b6b630ef9e634667f4c620fa0 |
| SHA256 | 51398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad |
| SHA512 | cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03 |
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.LastScreen.dll
| MD5 | 6e001f8d0ee4f09a6673a9e8168836b6 |
| SHA1 | 334ad3cf0e4e3c03415a4907b2d6cf7ba4cbcd38 |
| SHA256 | 6a30f9c604c4012d1d2e1ba075213c378afb1bfcb94276de7995ed7bbf492859 |
| SHA512 | 0eff2e6d3ad75abf801c2ab48b62bc93ebc5a128d2e03e507e6e5665ff9a2ab58a9d82ca71195073b971f8c473f339baffdd23694084eaaff321331b5faaecf6 |
memory/2364-191-0x0000000005A30000-0x0000000005A44000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.dll
| MD5 | 08112f27dcd8f1d779231a7a3e944cb1 |
| SHA1 | 39a98a95feb1b6295ad762e22aa47854f57c226f |
| SHA256 | 11c6a8470a3f2b2be9b8cafe5f9a0afce7303bfd02ab783a0f0ee09a184649fa |
| SHA512 | afd0c7df58b63c7cfdbedea7169a1617f2ac4bad07347f8ed7757a25ab0719489d93272109b73a1b53e9c5997dedad8da89da7b339d30fc2573ca2f76c630ddb |
memory/2364-199-0x0000000005AB0000-0x0000000005AD4000-memory.dmp
memory/2364-207-0x0000000005AE0000-0x0000000005B08000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\SciterWrapper.dll
| MD5 | 105a9e404f7ac841c46380063cc27f50 |
| SHA1 | ec27d9e1c3b546848324096283797a8644516ee3 |
| SHA256 | 69fe749457218ec9a765f9aac74caf6d4f73084cf5175d3fd1e4f345af8b3b8b |
| SHA512 | 6990cbfc90c63962abde4fdaae321386f768be9fcf4d08bccd760d55aba85199f7a3e18bd7abe23c3a8d20ea9807cecaffb4e83237633663a8bb63dd9292d940 |
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OServices.dll
| MD5 | 6df226bda27d26ce4523b80dbf57a9ea |
| SHA1 | 615f9aba84856026460dc54b581711dad63da469 |
| SHA256 | 17d737175d50eee97ac1c77db415fe25cc3c7a3871b65b93cc3fad63808a9abc |
| SHA512 | 988961d7a95c9883a9a1732d0b5d4443c790c38e342a9e996b072b41d2e8686389f36a249f2232cb58d72f8396c849e9cc52285f35071942bec5c3754b213dd5 |
memory/2364-215-0x0000000005B10000-0x0000000005B3E000-memory.dmp
memory/2364-223-0x0000000005B40000-0x0000000005B68000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Ninject.dll
| MD5 | 8db691813a26e7d0f1db5e2f4d0d05e3 |
| SHA1 | 7c7a33553dd0b50b78bf0ca6974c77088da253eb |
| SHA256 | 3043a65f11ac204e65bca142ff4166d85f1b22078b126b806f1fecb2a315c701 |
| SHA512 | d02458180ec6e6eda89b5b0e387510ab2fad80f9ce57b8da548aaf85c34a59c39afaeacd1947bd5eb81bee1f6d612ca57d0b2b756d64098dfc96ca0bf2d9f62f |
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferSDK.dll
| MD5 | b199dcd6824a02522a4d29a69ab65058 |
| SHA1 | f9c7f8c5c6543b80fa6f1940402430b37fa8dce4 |
| SHA256 | 9310a58f26be8bd453cde5ca6aa05042942832711fbdeb5430a2840232bfa5e4 |
| SHA512 | 1d3e85e13ff24640c76848981ca84bafb32f819a082e390cb06fe13445814f50f8e3fc3a8a8e962aae8867e199c1517d570c07f28d5f7e5f007b2bb6e664ddb1 |
memory/2364-231-0x0000000005BB0000-0x0000000005BE2000-memory.dmp
memory/2364-239-0x0000000005B90000-0x0000000005BAA000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OModels.dll
| MD5 | c06ac6dcfa7780cd781fc9af269e33c0 |
| SHA1 | f6b69337b369df50427f6d5968eb75b6283c199d |
| SHA256 | b23b8310265c14d7e530b80defc6d39cdc638c07d07cd2668e387863c463741d |
| SHA512 | ad167ad62913243e97efaeaa7bad38714aba7fc11f48001974d4f9c68615e9bdfb83bf623388008e77d61cee0eaba55ce47ebbb1f378d89067e74a05a11d9fe3 |
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OUtilities.dll
| MD5 | 9d2c520bfa294a6aa0c5cbc6d87caeec |
| SHA1 | 20b390db533153e4bf84f3d17225384b924b391f |
| SHA256 | 669c812cb8f09799083014a199b0deee10237c95fb49ee107376b952fee5bd89 |
| SHA512 | 7e2e569549edb6ddd2b0cb0012386aed1f069e35d1f3045bb57704ef17b97129deb7cde8e23bc49980e908e1a5a90b739f68f36a1d231b1302a5d29b722e7c15 |
memory/2364-247-0x0000000005C20000-0x0000000005C44000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2ODAL.dll
| MD5 | 422be1a0c08185b107050fcf32f8fa40 |
| SHA1 | c8746a8dad7b4bf18380207b0c7c848362567a92 |
| SHA256 | 723aea78755292d2f4f87ad100a99b37bef951b6b40b62e2e2bbd4df3346d528 |
| SHA512 | dff51c890cb395665839070d37170d321dc0800981a42f173c6ea570684460146b4936af9d8567a6089bef3a7802ac4931c14031827689ef345ea384ceb47599 |
memory/2364-255-0x0000000005BF0000-0x0000000005BFA000-memory.dmp
memory/2364-263-0x0000000005C80000-0x0000000005C88000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OViewModels.dll
| MD5 | be4c2b0862d2fc399c393fca163094df |
| SHA1 | 7c03c84b2871c27fa0f1914825e504a090c2a550 |
| SHA256 | c202e4f92b792d34cb6859361aebdbfc8c61cf9e735edfd95e825839920fb88a |
| SHA512 | d9c531687a5051bbfe5050c5088623b3fd5f20b1e53dd4d3ed281c8769c15f45da36620231f6d0d76f8e2aa7de00c2324a4bf35a815cefc70ca97bc4ab253799 |
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\HtmlAgilityPack.dll
| MD5 | 17220f65bd242b6a491423d5bb7940c1 |
| SHA1 | a33fabf2b788e80f0f7f84524fe3ed9b797be7ad |
| SHA256 | 23056f14edb6e0afc70224d65de272a710b5d26e6c3b9fe2dfd022073050c59f |
| SHA512 | bfbe284a2ee7361ada9a9cb192580fd64476e70bc78d14e80ad1266f7722a244d890600cf24bfb83d4914e2434272679ba177ee5f98c709950e43192f05e215e |
memory/2364-271-0x0000000005CD0000-0x0000000005CFC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\ServiceHide.Net.dll
| MD5 | 83d37fb4f754c7f4e41605ec3c8608ea |
| SHA1 | 70401de8ce89f809c6e601834d48768c0d65159f |
| SHA256 | 56db33c0962b3c34cba5279d2441bc4c12f28b569eadc1b3885dd0951b2c4020 |
| SHA512 | f5f3479f485b1829bbfb7eb8087353aee569184f9c506af15c4e28bfe4f73bf2cc220d817f6dfc34b2a7a6f69453f0b71e64b79c4d500ff9a243799f68e88b9f |
memory/2364-281-0x0000000005C60000-0x0000000005C7D000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | d82c62fa0f698e47dd895a5f726b7af2 |
| SHA1 | fb9624f43ae6e480ae5b8ce369eebdb136ac2e7f |
| SHA256 | 47ae85b8b4d8e65e2eba66928b73729f62ccd5961e57437e39023686eaf473af |
| SHA512 | ae333262e0e6e2c3b0c1a849c39ce678879fa758317ab0395ff218bc3f5fea80bdcbc962fa4e41e6a1c32d90b98c3ed5b8fcd6e5acd66cbd7fa33dc35e33c2f7 |
memory/2364-316-0x0000000006340000-0x0000000006352000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\MyDownloader.Core.dll
| MD5 | f931e960cc4ed0d2f392376525ff44db |
| SHA1 | 1895aaa8f5b8314d8a4c5938d1405775d3837109 |
| SHA256 | 1c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870 |
| SHA512 | 7fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\026A86A161D256DBB33076EDF20C0E5E_86AB612B21DEDF3B8CD155ED2E4114FF
| MD5 | ec95ba152315371a12b61e59736ef2af |
| SHA1 | 5420ca8697ddefc184f61745f4737305a68a4e75 |
| SHA256 | 55c56ef40fb19a4cf6d03acd5c5232286fe429d79e0f619701f32d51a5428198 |
| SHA512 | ecb8c92181c02083b06272b5d92acbbc51abcd3eee7e42e06d8df77fb2e4240d5fd2f5a1a084dc9c4f7945218fadc1f6a4532145c12dbc1887961cee79f19be9 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\026A86A161D256DBB33076EDF20C0E5E_86AB612B21DEDF3B8CD155ED2E4114FF
| MD5 | 76b63d508fb42d1e91fdac83a9f8519a |
| SHA1 | 0a3e4e7b117b615a0efdfe736103f7cbb5df07f4 |
| SHA256 | 5eac3f82a7db65aec5a3cc8be39703829577d04f025395c1282515d67696bbed |
| SHA512 | 9534bd30356ffb04cf6d11ee25a03368e4de58cef3e97db38f88cf12f920158e383b3100181a9a72fbb4d8c9f59d0d898fd39cc98075e1560f8cac103851f4e2 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A37B8BA80004D3266CB4D93B2052DC10_EBDB5A7037F08CDFB408DBFC0D44B43D
| MD5 | bee6945236b09fd8f8f2d0ddace382b7 |
| SHA1 | 99344d76406edc27fc60576dc263d947f0faf2dc |
| SHA256 | 2912b18f547e3bb4e841c5e24bb7fafd774700276fd9edbfa4cd958290880771 |
| SHA512 | 978015d8b1370c9b03ba4505c1ba1b9b05169ecd1c6d8c580f06a66418a08ee16d444503ee6bd5fbfb668dff04082064d2bd7e926a32e26146bafe777de0ff5d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A37B8BA80004D3266CB4D93B2052DC10_EBDB5A7037F08CDFB408DBFC0D44B43D
| MD5 | 680c9e6bd384d8ad719b369767b1a379 |
| SHA1 | b6ba39e6936de712fbdcea2e14bfeabb7066ffa9 |
| SHA256 | f61e0db47200c55725436b0fcde53977e627da8972824f963270dfbba44b05e9 |
| SHA512 | 8dd9acf574c3892dbfd80e8cc6e0e901805271e0ba61191539554cbcd3da2cc7f53192624390933eb85a98cd46377c08e7659f65f15bfbd84ca0788e88919fd8 |
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-us\default.dic
| MD5 | f3b25701fe362ec84616a93a45ce9998 |
| SHA1 | d62636d8caec13f04e28442a0a6fa1afeb024bbb |
| SHA256 | b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209 |
| SHA512 | 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84 |
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Newtonsoft.Json.dll
| MD5 | 9de86cdf74a30602d6baa7affc8c4a0f |
| SHA1 | 9c79b6fbf85b8b87dd781b20fc38ba2ac0664143 |
| SHA256 | 56032ade45ccf8f4c259a2e57487124cf448a90bca2eeb430da2722d9e109583 |
| SHA512 | dca0f6078df789bb8c61ffb095d78f564bfc3223c6795ec88aeb5f132c014c5e3cb1bd8268f1e5dc96d7302c7f3de97e73807f3583cb4a320d7adbe93f432641 |
memory/2364-360-0x0000000006A30000-0x0000000006ABC000-memory.dmp
memory/2364-365-0x00000000069B0000-0x00000000069BA000-memory.dmp
memory/2364-369-0x0000000006C20000-0x0000000006C42000-memory.dmp
memory/2364-372-0x0000000006C50000-0x0000000006FA7000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OResources.dll
| MD5 | 554c3e1d68c8b5d04ca7a2264ca44e71 |
| SHA1 | ef749e325f52179e6875e9b2dd397bee2ca41bb4 |
| SHA256 | 1eb0795b1928f6b0459199dace5affdc0842b6fba87be53ca108661275df2f3e |
| SHA512 | 58ce13c47e0daf99d66af1ea35984344c0bb11ba70fe92bc4ffa4cd6799d6f13bcad652b6883c0e32c6e155e9c1b020319c90da87cb0830f963639d53a51f9c6 |
memory/2364-380-0x0000000007110000-0x000000000711C000-memory.dmp
memory/2364-383-0x00000000076F0000-0x0000000007C96000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OCommonResources.dll
| MD5 | 80a81451b8650c4c3a6ce14dd6b75390 |
| SHA1 | 480a73aee3814581a9087a3366fd19125f691d38 |
| SHA256 | af38d3a682a82c25d2f8301c811410821ec30fa9bbbf11751534696a893cfc0e |
| SHA512 | b7d3400fe74c4c3e9e98018fa955f117330083b5618ec2c9b3a28ec5b5d9a27456e3992bd3bd01ca02c40928bd432cb427b661d03f4ad03a02606be6d8d3846a |
memory/1416-391-0x0000000071F80000-0x0000000072731000-memory.dmp
memory/2364-390-0x0000000008260000-0x0000000008814000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OCommonResources.dll
| MD5 | 868934eb11c3d889fca6e794a1ebe966 |
| SHA1 | d89b664a818840d3badd6262f3ccce17227c9b4c |
| SHA256 | 3b4e351e35c8375333f3acc410767103f6374695459a3fddc8cf07c6c1580776 |
| SHA512 | 8cc3e4898e11b55d3c482e97a6b5adaff2abb5f3dfc47f3dd21eeb4c74a6845dc7d2ee093540fcdb706ed8ff096847161c1c115952d056f0017de174ad98b53d |
memory/2364-406-0x0000000007360000-0x00000000073F2000-memory.dmp
memory/1416-407-0x0000000004DD0000-0x0000000004DE0000-memory.dmp
memory/2364-422-0x00000000070B0000-0x00000000070DE000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\MyDownloader.Extension.dll
| MD5 | 28f1996059e79df241388bd9f89cf0b1 |
| SHA1 | 6ad6f7cde374686a42d9c0fcebadaf00adf21c76 |
| SHA256 | c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce |
| SHA512 | 9654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29 |
memory/1416-436-0x0000000071F80000-0x0000000072731000-memory.dmp
memory/2364-439-0x0000000071F80000-0x0000000072731000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | b9c33123752e3a2665feced4014b451d |
| SHA1 | bfd548a4b09bd0abb2e492743c93b4a3ae197ff9 |
| SHA256 | 93d6bc51ed54fb03942fd862d33ad739458c6b8cf7a92e8f8a70ceebcebe2a0d |
| SHA512 | fd418e4588d476969b0c3774ab95160d851959fc3b7db80b2262e2f338638a283f0f66b2af1a94ab2175292713d9b4481f48c9e76aa6097a0be80141ceae5013 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 5492356d25babec6ae02498b9a60088b |
| SHA1 | b53325c48806bca070b54aff84635a3f4891bd8a |
| SHA256 | b5f2cfe4e4ccbb9f8d83ae164407b88eef2898d519fe64e61e284601ae15f8fd |
| SHA512 | ed98fa3dc7c56ecbc54b94f3937b9ec7ccca95c666c335aa5159d2e2be0c25cc546803e09bca1062a5cd0d5d8ce3403d5d08128170be2dba825d6eb7737a9be5 |
C:\Users\Admin\Downloads\Unconfirmed 207526.crdownload
| MD5 | 0ea423445ed1e05e442b530f9f69f0c4 |
| SHA1 | 832a77754ff8866a57446a9e804e66d6284f6831 |
| SHA256 | c65d6cce86f6538afd07588cc37544734bdf8ded5f944ef55f4c51974d02f6dc |
| SHA512 | 42e20146b32da6e7061ab17a03f187d31a5378919389cd8c996388c4b632b4133f15af87b319e89a660943eb4db6bb81e4d8af368fa3080f4166797c6b53556d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | e24f2c92e13317e9a47caa481b09a228 |
| SHA1 | eaec6842fd66b46d97fc48a632d8b9d7fdd5018a |
| SHA256 | 9e9df584a2b5c36c19de2ea6e01f3c5e16571893907e8c4c7c9dc1e5584036c4 |
| SHA512 | 366c263e7cceedcfe1c4c08f34ede1ae7262936f54b92b6d04e87afcff25b9f63f280654295d371dc19bff8646bc0f18ffbaef81c597dfff9b1ca702de29de71 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | b7c46a982a9856f5b293764bc33f6054 |
| SHA1 | 807ac74124e690a7e57da84b6dbf2b84bd415735 |
| SHA256 | a23ec56dd7e613185434d6d3ddae3a2e0d18b5bb09a757328a46b0dcba0ba750 |
| SHA512 | 7f3f395ce43753ea09a82cc0794bfd956285eba3c3e3e28af300ea110e71b6353cf5998d6eb1579867255556b1857b3a1f5065149b80f1bc0f726f15062e00c3 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | e3b2a1822dba0702d55fbb9a1904f2d6 |
| SHA1 | 460550797bfbaebeb0b6190e97aae185ca94cab9 |
| SHA256 | a0e3360cd5241ecb47929eb9bc5af1b4012ed3de1ce4d9f06b03cf307f119b3e |
| SHA512 | e13c52a31963cf1511874220678347b57ff909f27618201ce7c13e1603472c3a801b3223b6ed086d8a90592e436b17fd4dcdb32978c91d7796e9b2fa54f3aee1 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 97dbc44db97daf1ab8a5f427e5fd9eac |
| SHA1 | 80cc201d229f9dd0fab1fc33fac9dec9fee2918e |
| SHA256 | 2dc108fb289d9213f973ab92d2476b75c407c2d3ee659d54bda457e087e0f6da |
| SHA512 | 96ddc1a49e80dcb84335ecf567f37bec471c94ee05d5a46a831ba59ce93efe87fb892752a18bc288dd18d725a406e486bb436f0eaaf57f564863a9a39c3db6bc |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 2a3b34279f8373c745cf85d502ee0670 |
| SHA1 | 4bd02a6ac4d600c40e4b4dd9d36c7727f46891d5 |
| SHA256 | e024391a7649fe69dbe86272e2d3d1375aa876c9aee7e5b1c7cdda072c41c7be |
| SHA512 | 3280d612ce610e1dc6034ffeb6f7e8b32f7ffec8d8cb3f7489dd8c2ee8bfd63bb3932905d0d37918ce891ee744afdcac61492be0f49ce95e5397cf1d80bfe163 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | cfb7f468d2475f2e567d0d4f4f061ac0 |
| SHA1 | 35e30421b9426fb34b9825ff64523dbf89f869c7 |
| SHA256 | f78617e168fb0cf91669a1f5d3bd81f27cde5a4dc32256d036983f27ae9dc3ef |
| SHA512 | eea8372f5c2c9c2b5270879c9b51162e3bd4a97fc386a460b27105babef146a9a5904799873779e89c4c169461ad1cfb63d7dcf9b4caf243d6c67679bc2b936d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | e1b7b5094b96c2e0c80a83c3e599cc52 |
| SHA1 | 448df637d614012c1608b9102c7c216f3b017140 |
| SHA256 | e2e74c3d9447c312932390272ecb6ad788a837f29088f7b827439f5d4b49949d |
| SHA512 | 15f8946d593636ddf5819bcc0b86490efa8663e7b62f71ea2db825553a5710dd0362e929bb4e06a708d21e1b80041c948d1a3b651e7dfd376d841607d3f403b1 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | c9efea3a4ce26b7645a4c205104e1aa1 |
| SHA1 | 0f28f83b334b15b14cccf1cfeb52220e53e7995e |
| SHA256 | 51b8a06bcfc570b1924bba3ed826cf9fce949b6c00fb853ad914022d3a6f85db |
| SHA512 | 5eea8b988d54dd0078ce36ee74e4cb978af97349868521ff36b899825cb8c2a26bb8175035740802b96e60c05666a280baaa7faf1c5f30d6f117cfca8b9d6f97 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 58962f7b57842db81a4d72d858c55476 |
| SHA1 | f9074a17fdc48ea728a29ca8fd3ba4e6b8b3eaa1 |
| SHA256 | ed5a0412b4db7f004412443c0899730852c2cb0a634f7e14bed147ad95b7c488 |
| SHA512 | 2032f26919820d391c63725e1b813eae7e881790a83f9a123b5f9583fc225ac178d31c3411d8ef24fd9b5ee2cfc37570394ad32d0fc888a2d480d2595563ebf8 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 24a21e7421ae819c698fdadd50f09a68 |
| SHA1 | 82f1529000914e2689169dda329fb6ca18591cb8 |
| SHA256 | d2e5a545371c3726c94353e59b9d7b927abb7717ed7374d01194e201ae959756 |
| SHA512 | d7f1bd173561c85214e95a221f2ef98ee6b6a6b08f00cec138cebfeb2b491443201b14bb6c7e2e906e0b59f9a94b7cf1e9546a490bc187d617c30ae12c3719bd |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | f1c65c1f0aa55c05faf4f596f4fc3ad8 |
| SHA1 | f864e8e2c14259d069fad32a07adca059e516dda |
| SHA256 | 6add62a2ae55227b64c4089053f3653640d08bee9bcdb78830bd95d764e4c4a8 |
| SHA512 | e9b67a51d68c713745ae3a574a0f0af56a7813cc05895bf4b6d576eb40640307a124caed94784c4944db4b9fd1301945de2334773e3ffeaba049824eb42f4854 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 5f6b2165a032ec59429d588f24ef159b |
| SHA1 | a3a20af6208dd6b00d1223a4bfb1911411fcbaf6 |
| SHA256 | efbb4b56dbc1c5ec09e8ac22eac413cba4a05d9d17477a9a53f14893137e2d2d |
| SHA512 | bd1f0832c2f2f60e8c6ffb6f6c9520fe916147bfc1a55fbbc7e823939821ceecb552cf9ff6c34d87acba61b52805e7f7f0139a91dc04b8d4100113c0847b8d63 |